Abductive innovations in information security policy development: an ethnographic study. Issue 5 (3rd September 2019)

• Record Type: Journal Article
• Authors: Niemimaa, Marko; Niemimaa, Elina
• Is Part Of: European journal of information systems. Volume 28:Issue 5(2019)
• Page Start: 566
• Page End: 589
• Publication Date: 2019-09-03
• Subjects: Michael Myers; Anat Hovav; Information security policy development -- ISS policy -- ethnography -- abductive innovation; Information technology -- Periodicals; Information technology -- Europe -- Periodicals; Management information systems -- Periodicals; Management information systems -- Europe -- Periodicals; 658.403805
• DOI: 10.1080/0960085X.2019.1624141
• Languages: English
• ISSNs: 0960-085X

Abstract

ABSTRACT: Developing organisational information security (InfoSec) policies that account for international best practices but are contextual is as much an opportunity for improving InfoSec as it is a challenge. Previous research indicates that organisations should create InfoSec policies based on best practices (top-down) and simultaneously encourages participatory development (bottom-up). These contradictory suggestions place managers in a dilemma: Should they follow a top-down or bottom-up approach? In this research, we build on an ethnographic approach to study how an innovative engineering company (MachineryCorp) managed the contradiction when the firm developed an InfoSec policy. Drawing on the dialectical theory of organisations as a lens, the findings suggest the InfoSec policy development is a recurrent process consisting of three phases: (1) drawing interpretations of InfoSec requirements from best practices (deductive adoption) and (2) constructing possibilities for local implementation (inductive adjustment) (3) that engender tensions between best practices and local contingencies facilitating innovative local resolutions (synthetic innovation). We call this process abductive innovation. At MachineryCorp, a triangle of tensions surfaced due to economic realities, infrastructure affordances, and social arrangements, and were necessary in explaining how the InfoSec policy gradually and iteratively materialised and resulted in an organisationally contingent policy.