Start Date

11-12-2016 12:00 AM

Description

Industry surveys report that information security management is a top concern for managers. While information security policy is central for organizational information security, research and practitioner-oriented guidelines provide little advice on crafting such a policy. Therefore, this ethnographic study seeks to understand the crafting of an organization-wide policy in practice and the practices that lead to successful policy crafting. Drawing on ethnographic evidence from 15-month participant observation at a global corporation, the study provides insight into and suggests five implications for successful policy crafting. The implications advice managers in (1) building the foundation of their information security policy; (2) contextualizing policy's practices; (3) inviting participation of organizational members; (4) legitimizing the policy; and (5) estimating the ramifications of the policy implementation. Contributions are discussed and conclusion drawn.

Share

COinS
 
Dec 11th, 12:00 AM

Crafting an Information Security Policy: Insights from an Ethnographic Study

Industry surveys report that information security management is a top concern for managers. While information security policy is central for organizational information security, research and practitioner-oriented guidelines provide little advice on crafting such a policy. Therefore, this ethnographic study seeks to understand the crafting of an organization-wide policy in practice and the practices that lead to successful policy crafting. Drawing on ethnographic evidence from 15-month participant observation at a global corporation, the study provides insight into and suggests five implications for successful policy crafting. The implications advice managers in (1) building the foundation of their information security policy; (2) contextualizing policy's practices; (3) inviting participation of organizational members; (4) legitimizing the policy; and (5) estimating the ramifications of the policy implementation. Contributions are discussed and conclusion drawn.