Abstract
The ISO/IEC 17799 standard is commonly viewed as a necessary element in information security management. However, there is no empirical evidence of the usefulness of the standard in practice. To study this issue, this study analyses the implementation experiences of four organisations that have implemented the ISO/IEC 17799 standard. Through semi-structured interviews, the results of the study suggest that clients’ needs and competitive advantage are the major reasons for implementing the standard. Furthermore, the implementation of the standard has increased the understanding of information security in all personnel groups and the understanding of security has broadened from the technical aspects to corporate security. As downsides of implementing the ISO/IEC 17799 standard, the costs and increased amount of work were mentioned as the worst. In addition, the difficulties in deploying the standard, and the readability of the standard were criticised. The standard was also criticised because it does not directly affect the quality of the end product or service; it only has an indirect effect owing to the improved information security practices.
Recommended Citation
Wiander, Timo, "Positive and Negative Findings of the ISO/IEC 17799 Framework" (2007). ACIS 2007 Proceedings. 75.
https://aisel.aisnet.org/acis2007/75