Information Security Management Success Factors

Abstract

Information Security Management (ISM) is one of the growing challenges to organisations in the current digitalised era. Despite the efforts of organisations in securing their information assets, internal threats and cyber attacks are constantly targeting organisations and successfully achieving their malicious goals. Thus, to support organisations in better coping with the increasing challenges of information security, a study on the success factors of ISM from multiple aspects is needed. Focusing on the technological aspect or some factors only is not adequate in defending the organisation against the different security threats and achieving successful ISM. There should be a more comprehensive view of the various success factors and their aspects. Therefore, the purpose of this qualitative research is to propose a multidimensional ISM success factors framework that brings together the success factors from different aspects. As a first step, a systematic literature review was conducted on the most recent ISM literature to identify the success factors. To evaluate and prioritise the identified success factors and explore additional ones, semi-structured interviews with information security professionals in different industries have been conducted. As a result, a framework with fifteen success factors classified in five dimensions, including human, process, legal and compliance, organisational culture and technology has been developed with the highest priority assigned to the human related factors. The resulted framework would serve as guidance for organisations in understanding the collaborative relationship between the factors and the effectiveness of ISM. It would encourage them in shedding light on the deficiencies in the ISM practices, especially from the human aspect. Moreover, the framework would add to the knowledge of ISM by acting as a research tool for further studies in the domain.