When Do IT Security Investments Matter? Accounting for the Influence of Institutional Factors in the Context of Healthcare Data Breaches

A Holistic View on Organizational IT Security: The Influence of Contextual Aspects During IT Security Decisions

“…Thus, the close relation between both theory types is attenuated and the influence of external factors such as legal and social structures promoted. In this regard, IS studies which employ an Institutional Theory approach, have investigated and demonstrated the influence of environmental aspects such as conformity with external norms and social influence on investment decisions [7,18].…”

“…Selection criteria were mostly determined by the theoretical framework and the resulting focus on the decision process. As a result, publications like Angst and colleagues' investigation of institutional factors in healthcare security investment [7] which detail the evaluation and implementation of investments rather than the decision process leading towards the investment, were excluded. Similarly, Baskerville's [5] study on risk analysis covers only the second phase of Straub and Welke's [14] model and was thus suspended after full text screening.…”

“…, 5]. Recently however, commonly employed cost-benefit analyses [e.g., 6] or the consideration of institutional factors [e.g., 3,7] increasingly acknowledge the presence and influence of economic, organizational or environmental aspects during the IT security decision process.…”

“…Against this backdrop, this paper proposes a conceptual framework that builds on insights from organizational IT security research before employing a qualitative approach to identify which contextual aspects affect decision-makers in predominantly small and medium-sized enterprises (SME) regarding the decision-making process in organizational IT security through 25 expert interviews. Small and medium-sized enterprises have been particularly overlooked by IS security literature which continues to focus on large enterprises within specific industries, i.e., healthcare and finance [e.g., 7,10] although SME account for more than 95% of enterprises worldwide [11]. Decision-makers in SME however are directly responsible for their businesses' survival which requires them to take various internal and external factors into account and heightens the influence of individual characteristics when deciding upon investing in IT measures in general, and IT security in particular [e.g., 12,13].…”

A Adopção de Medidas Formais, Informais e Técnicas de Segurança da Informação e sua Relação com as Pressões do Ambiente Institucional

“…A abordagem institucional foi utilizada recentemente em trabalhos sobre o tema (Tejay & Barton, 2013;Anthony et al, 2014;Lopes & Sá-Soares, 2014;Alkalbani, Deng & Kam, 2015;Angst, Block, D'Arcy, & Kelley, 2017;Alkalbani et al, 2017;Hou et al, 2018;Choi, Lee, & Hwang, 2018), mas, se analisados em conjunto, esses trabalhos são inconclusivos quanto aos mecanismos institucionais que pressionam as organizações a adoptarem medidas de Segurança da Informação, pois apontam para pressões normativas e miméticas (Tejay & Barton, 2013), coercitivas (AlKalbani et al, 2015Hou et al, 2018), miméticas e coercitivas (Anthony et al, 2014;Alkalbani et al, 2017), e coercitivas e normativas (Kam et al, 2013;Lopes & Sá-Soares, 2014;Choi et al, 2018). Além disso, os trabalhos abordam principalmente medidas formais (Williams et al, 2013;Kam et al, 2013;Lopes & Sá-Soares, 2014;Anthony et al, 2014;Angst et al, 2017;Alkalbani et al, 2017;Hou et al, 2018;Choi et al, 2018), dando pouca atenção às medidas informais e técnicas.…”