What do we know about information security governance?

Abstract

Purpose This paper aims to review the information security governance (ISG) literature and emphasises the tensions that exist at the intersection of the rapidly changing business climate and the current body of knowledge on ISG. Design/methodology/approach The intention of the authors was to conduct a systematic literature review. However, owing to limited empirical papers in ISG research, this paper is more conceptually organised. Findings This paper shows that security has shifted from a narrow-focused isolated issue towards a strategic business issue with “from the basement to the boardroom” implications. The key takeaway is that protecting the organisation is important, but organizations must also develop strategies to ensure resilient businesses to take advantage of the opportunities that digitalization can bring. Research limitations/implications The concept of DSG is a new research territory that addresses the limitations and gaps of traditional ISG approaches in a digital context. To this extent, organisational theories are suggested to help build knowledge that offers a deeper understanding than that provided by the too often used practical approaches in ISG research. Practical implications This paper supports practitioners and decision makers by providing a deeper understanding of how organisations and their security approaches are actually affected by digitalisation. Social implications This paper helps individuals to understand that they have increasing rights with regard to privacy and security and a say in what parties they assign business to. Originality/value This paper makes a novel contribution to ISG research. To the authors’ knowledge, this is the first attempt to review and structure the ISG literature.

A quantification mechanism for assessing adherence to information security governance guidelines

“…Senior leaders and board members' commitment is crucial in establishing an effective information security governance system (Damenu & Beaumont, 2017). However, the uplifting of information security "from the basement to the boardroom" (Schinagl & Shahim, 2020) has not been accompanied by the provision of appropriate tools and techniques that board members and other organisational leaders, without an information security background, could use to support their decisions (Mishra, 2015). Information security governance is an under-explored field of study, with the very term 'governance' meaning different things to different people (Nicho, 2018).…”

“…Organisational leaders' role in establishing a solid information security governance system is further complicated by the uncertainty that reigns in this domain. Characterised by a mix of practical (the majority) and theoretical (the minority) approaches, the discipline of information security governance is relatively immature, mainly descriptive, and with limited empirical or theoretical guidance (Schinagl & Shahim, 2020).…”

“…Overall, frameworks for information security governance suffer from flaws that can be broadly synthesised around the following points (Schinagl & Shahim, 2020): first, an information security governance model applicable to all organisations does not exist: industry type, underlying regulatory scenario, years of operations, organisational structure, etc. are all factors that impact the type of model most suitable to a given entity.…”

Informatization of the Society in the Digital Age

“…In this direction, the important issue of information security in maintaining e-governance processes is raised [5], as an analysis of the information security problems is made in the article [6].…”

Tensions that Hinder the Implementation of Digital Security Governance

“…Recent studies argue that digital security is becoming of strategic importance in contemporary firms [1,7,13,21]. Specifically, these studies argue that governance needs to be organized around digital security.…”