Information security: management's effect on culture and policy

• Published in: Information management & computer security 2006-01, Vol.14 (1), p.24-36
• Main Authors: Knapp, Kenneth J, Marshall, Thomas E, Kelly Rainer, R, Nelson Ford, F
• Format: Article
• Language: English
• Subjects: Corporate culture; Cybersecurity; Data analysis; Data collection; Enforcement; Exact sciences and technology; Grounded theory; Information and communication sciences; Information and communication technologies; Information control; Information management; Information science. Documentation; Information systems; Management effectiveness; Miscellaneous; Organizational culture; Polls & surveys; Professionals; Questionnaires; Research methodology; Sciences and techniques of general use; Security; Security management; Structural equation modeling; Studies; Surveys
• ISSN: 0968-5227; 2056-4961; 1758-5805; 2056-497X
• DOI: 10.1108/09685220610648355

Purpose - This study proposes to put forward and test a theoretical model that demonstrates the influence of top management support on an organization's security culture and level of security policy enforcement.Design methodology approach - The project used a combination of qualitative and quantitative techniques. The grounded theory approach was used to analyze responses to open-ended questions answered by 220 certified information system security professionals. Using these responses, a survey instrument was developed. Survey results were analyzed using structural equation modeling.Findings - Evidence suggests that top management support is a significant predictor of an organization's security culture and level of policy enforcement.Research limitations implications - During instrument validation, a special effort removed survey items that appeared overly intrusive to the respondents. In this endeavor, an expert panel of security practitioners evaluated all candidate items on a willingness-to-answer scale. While especially helpful in security, this scale may be used in other research domains.Practical implications - Practitioners should understand the impact of top management support on achieving security effectiveness. Based on the findings of this study, low levels of executive support will produce an organizational culture less tolerant of good security practices. Low levels of support will diminish the level of enforcement of existing security policies.Originality value - Researchers developed original scales to measure levels of top management support, policy enforcement, and organizational culture. The scales demonstrated acceptable reliability and validity scores.