Document Type
Conference Proceeding
Source of Publication
Information & Computer Security
Publication Date
3-12-2018
Abstract
Purpose; ; ; ; ; The frequent and increasingly potent cyber-attacks because of lack of an optimal mix of technical as well as non-technical IT controls has led to increased adoption of security governance controls by organizations. The purpose of this paper, thus, is to construct and empirically validate an information security governance (ISG) process model through the plan"“do"“check"“act (PDCA) cycle model of Deming.; ; ; ; ; Design/methodology/approach; ; ; ; ; This descriptive research using an interpretive paradigm follows a qualitative methodology using expert interviews of five respondents working in the ISG domain in United Arab Emirates (UAE) to validate the theoretical model.; ; ; ; ; Findings; ; ; ; ; The findings of this paper suggest the primacy of the PDCA Deming cycle for initiating ISG through a risk-based approach assisted by industry-wide best practices in ISG. Regarding selection of ISG frameworks, respondents preferred to have ISO 27K supported by NIST as the core framework with other relevant ISG frameworks/standards forming the peripheral layer. The implementation focus of the ISG model is on mapping ISO 27K/NIST IT controls relevant IT controls selected from ISG frameworks from a horizontal and vertical perspective. Respondents asserted the automation of measurement and control mechanism through automation to assist in the feedback loop of the PDCA cycle.; ; ; ; ; Originality/value; ; ; ; ; The validated model helps academics and practitioners gain insight into the methodology of the phased implementation of an information systems governance process through the PDCA model, as well as the positioning of ITG and ITG frameworks in ISG. Practitioners can glean valuable insights from the empirical section of the research where experts detail the success factors, the sequential steps and justification of these factors in the ISG implementation process.
DOI Link
ISSN
Publisher
Emerald
Volume
26
First Page
10
Last Page
38
Disciplines
Business | Computer Sciences
Creative Commons License
This work is licensed under a Creative Commons Attribution-NonCommercial 4.0 International License
Recommended Citation
Nicho, Mathew, "A process model for implementing information systems security governance" (2018). All Works. 228.
https://zuscholars.zu.ac.ae/works/228
Indexed in Scopus
no
Open Access
yes
Open Access Type
Green: A manuscript of this publication is openly available in a repository