Information Security in Higher Education: A Neo-Institutional Perspective

Abstract

External pressures could be a compelling force that drives higher education institutions to attain information security. Drawing on the neo-institutional theory, this study examined how the three external expectations: regulative, normative, and cognitive expectations drive the higher education of the United States to attain information security. The research findings suggest that, through regulatory and social normative pressure, cognitive expectation indirectly promotes information security in higher education. That is, cognitive expectation or stakeholder's perception of higher education determines information security in higher education by harnessing the coercive force of regulatory pressure and leveraging the pressure of meeting social normative expectation.

Adoption of Information Security Measures in Public Research Institutes

“…Therefore, information security should be treated based on theories that help to understand it from a social perspective, as proposed by Dhillon and Backhouse (2001), Björck (2004Björck ( , 2005, Marciano and Lima-Marques (2006) Albrechtsen (2008) and Coles-Kemp (2009). Besides, the adoption of Information Security measures must be addressed by a theory that considers the influence of external factors, which is consistent with the Institutional Theory (Kam, Katerattanakul, Gogolin, & Hong, 2013), a theoretical approach that is common in studies of social sciences and suggested for studies on Information Security by different authors, such as Björck (2004), Kam et al (2013) and .…”

“…According to Luesebrink (2011), Information Security management structures are influenced by normative and coercive mechanisms of institutional change. Kam et al (2013) observed that regulatory and normative external pressures influence compliance with Information Security Policies. Finally, Spears, Barki and Barton (2013) concluded that external factors encourage the adoption of measures in a regulatory context, and that ensuring Information Security is supported more in its symbolic representation, and less in the effectiveness of the measures.…”

“…As postulated by Institutional Theory, these measures are not adopted because Information Security Governance structure rationally decides about it, but because the organization is exposed to external pressure, which may be coercive, mimetic or normative. For this reason, Kam et al (2013) argue for Institutional Theory as a theoretical approach to research phenomena related to Information Security. Nevertheless, Björck (2004) notes that the institutional approach is rarely used in Information Security studies, despite being common in Information Systems and IT researches.…”

Adoption of Information Security Measures in Public Research Institutes

“…The author noted that management structures of Information Security are influenced by normative and coercive mechanisms of institutional change. Kam et al (2013) studied how academic organizations in the United States are influenced by institutional expectations to comply with Information Security Policies and the influence of these expectations in the awareness of their members. The authors concluded that external pressures influence significantly compliance of these organizations with Information Security Policies, particularly coercive and normative pressures.…”

“…Thus, these organizations may adopt measures that do not meet the needs identified after a risk analysis, but that are responses to external forces to which they are subject. Kam, Katerattanakul, Gogolin and Hong (2013) note that external pressures influence Information Security in academic organizations and that this influence may be understood from the perspective of Institutional Theory, approach suggested by Björck (2004) and for research on Information Security.…”