Information Security Policy: A Management Practice Perspective

Authors

Moneer Alshaikh, Department of Computing and Information Systems, Melbourne School of Engineering, University of Melbourne, Victoria, AustraliaFollow
Sean B. Maynard, Department of Computing and Information Systems, Melbourne School of Engineering, University of Melbourne, Victoria, AustraliaFollow
Atif Ahmad, Department of Computing and Information Systems, Melbourne School of Engineering, University of Melbourne, Victoria, AustraliaFollow
Shanton Chang, Department of Computing and Information Systems, Melbourne School of Engineering, University of Melbourne, Victoria, AustraliaFollow

Abstract

Considerable research effort has been devoted to the study of Policy in the domain of Information Security Management (ISM). However, our review of ISM literature identified four key deficiencies that reduce the utility of the guidance to organisations implementing policy management practices. This paper provides a comprehensive overview of the management practices of information security policy and develops a practice-based model. The model provides comprehensive guidance to practitioners on the activities security managers must undertake for security policy development and allows practitioners to benchmark their current practice with the models suggested best practice. The model contributes to theory by mapping existing information security policy research in terms of the defined management practices.

Recommended Citation

Alshaikh, Moneer; Maynard, Sean B.; Ahmad, Atif; and Chang, Shanton, "Information Security Policy: A Management Practice Perspective" (2015). ACIS 2015 Proceedings. 12.
https://aisel.aisnet.org/acis2015/12