Start Date
11-12-2016 12:00 AM
Description
Industry surveys report that information security management is a top concern for managers. While information security policy is central for organizational information security, research and practitioner-oriented guidelines provide little advice on crafting such a policy. Therefore, this ethnographic study seeks to understand the crafting of an organization-wide policy in practice and the practices that lead to successful policy crafting. Drawing on ethnographic evidence from 15-month participant observation at a global corporation, the study provides insight into and suggests five implications for successful policy crafting. The implications advice managers in (1) building the foundation of their information security policy; (2) contextualizing policy's practices; (3) inviting participation of organizational members; (4) legitimizing the policy; and (5) estimating the ramifications of the policy implementation. Contributions are discussed and conclusion drawn.
Recommended Citation
Niemimaa, Elina, "Crafting an Information Security Policy: Insights from an Ethnographic Study" (2016). ICIS 2016 Proceedings. 6.
https://aisel.aisnet.org/icis2016/Practice-OrientedResearch/Presentations/6
Crafting an Information Security Policy: Insights from an Ethnographic Study
Industry surveys report that information security management is a top concern for managers. While information security policy is central for organizational information security, research and practitioner-oriented guidelines provide little advice on crafting such a policy. Therefore, this ethnographic study seeks to understand the crafting of an organization-wide policy in practice and the practices that lead to successful policy crafting. Drawing on ethnographic evidence from 15-month participant observation at a global corporation, the study provides insight into and suggests five implications for successful policy crafting. The implications advice managers in (1) building the foundation of their information security policy; (2) contextualizing policy's practices; (3) inviting participation of organizational members; (4) legitimizing the policy; and (5) estimating the ramifications of the policy implementation. Contributions are discussed and conclusion drawn.