"SME executives' perceptions and the information security preparedness model". (29th March 2021)

• Record Type: Journal Article
• Authors: Saban, Kenneth Albert; Rau, Stephen; Wood, Charles A.
• Is Part Of: Information and computer security. Volume 29:Number 2(2021)
• Page Start: 263
• Page End: 282
• Publication Date: 2021-03-29
• Subjects: Small to medium-sized enterprises -- Information security -- Information security modeling -- SME executives -- Security importance -- Implementation challenges -- External influences -- Security awareness/preparedness; Computer security -- Management -- Periodicals; Computer networks -- Security measures -- Periodicals; Data protection -- Management -- Periodicals; 658.47
• DOI: 10.1108/ICS-01-2020-0014
• Languages: English
• ISSNs: 2056-4961

Abstract

Abstract : Purpose: Information security has increasingly been in the headlines as data breaches continue to occur at alarming rates. This paper aims to propose an Information Security Preparedness Model that was developed to examine how SME executives' perceptions of security importance, implementation challenges and external influences impact their awareness and commitment to security preparedness. Design/methodology/approach: Funded by the Department of Justice, a national survey of SME executives' perceptions of information security preparedness was conducted. Using PLS-SEM, the survey responses were used to test the proposed Information Security Preparedness Model. Findings: The results indicate that as perceptions of security importance and external influences increase, SME executives' awareness and commitment to information security also increases. In addition, as implementation challenges increase, awareness and commitment to information security decreases. Finally, as security importance and awareness and commitment to information security increases, executives' perception of security preparedness also increases. Research limitations/implications: Executive perceptions of information security were measured and not the actual level of security. Further research that examines the agreement between executive perceptions and the true state of information security within the organization is warranted. Originality/value: Prior information security studies using Roger's (1975, 1983) Protection Motivation Theory have produced mixed results. This paper develops and tests the Information Security Preparedness Model to more fully explain SME executive's perceptions of information security.