Strategic value alignment for information security management: a critical success factor analysis. (11th June 2018)

• Record Type: Journal Article
• Authors: Tu, Cindy Zhiling; Yuan, Yufei; Archer, Norm; Connelly, Catherine E.
• Is Part Of: Information and computer security. Volume 26:Number 2(2018)
• Page Start: 150
• Page End: 170
• Publication Date: 2018-06-11
• Subjects: Information security management -- Top management support -- Business alignment -- Critical success factor -- Organizational awareness -- Value alignment; Computer security -- Management -- Periodicals; Computer networks -- Security measures -- Periodicals; Data protection -- Management -- Periodicals; 658.47
• DOI: 10.1108/ICS-06-2017-0042
• Languages: English
• ISSNs: 2056-4961

Abstract

Abstract : Purpose: Effective information security management is a strategic issue for organizations to safeguard their information resources. Strategic value alignment is a proactive approach to manage value conflict in information security management. Applying a critical success factor (CSF) analysis approach, this paper aims to propose a CSF model based on a strategic alignment approach and test a model of the main factors that contributes to the success of information security management. Design/methodology/approach: A theoretical model was proposed and empirically tested with data collected from a survey of managers who were involved in decision-making regarding their companies' information security ( N = 219). The research model was validated using partial least squares structural equation modeling approach. Findings: Overall, the model was successful in capturing the main antecedents of information security management performance. The results suggest that with business alignment, top management support and organizational awareness of security risks and controls, effective information security controls can be developed, resulting in successful information security management. Originality/value: Findings from this study provide several important contributions to both theory and practice. The theoretical model identifies and verifies key factors that impact the success of information security management at the organizational level from a strategic management perspective. It provides practical guidelines for organizations to make more effective information security management.