Information security in supply chains: a management control perspective. (9th November 2015)

• Record Type: Journal Article
• Authors: P N, Sindhuja; Kunnathur, Anand S.
• Is Part Of: Information and computer security. Volume 23:Number 5(2015)
• Page Start: 476
• Page End: 496
• Publication Date: 2015-11-09
• Subjects: Supply chain -- Information security -- Management control -- Informal control -- Formal control -- Technical control; Computer security -- Management -- Periodicals; Computer networks -- Security measures -- Periodicals; Data protection -- Management -- Periodicals; 658.47
• DOI: 10.1108/ICS-07-2014-0050
• Languages: English
• ISSNs: 2056-4961

Abstract

Abstract : Purpose: – This paper aims to discuss the need for management control system for information security management that encapsulates the technical, formal and informal systems. This motivated the conceptualization of supply chain information security from a management controls perspective. Extant literature on information security mostly focused on technical security and managerial nuances in implementing and enforcing technical security through formal policies and quality standards at an organizational level. However, most of the security mechanisms are difficult to differentiate between businesses, and there is no one common platform to resolve the security issues pertaining to varied organizations in the supply chain. Design/methodology/approach: – The paper was conceptualized based on the review of literature pertaining to information security domain. Findings: – This study analyzed the need and importance of having a higher level of control above the already existing levels so as to cover the inter-organizational context. Also, it is suggested to have a management controls perspective for an all-encompassing coverage to the information security discipline in organizations that are in the global supply chain. Originality/value: – This paper have conceptualized the organizational and inter-organizational challenges that need to be addressed in the context of information security management. It would be difficult to contain the issues of information security management with the existing three levels of controls; hence, having a higher level of security control, namely, the management control that can act as an umbrella to the existing domains of security controls was suggested.