represents that its use would not infringe privately owned •rights. Reference herein to any specific commercial product, prc:icess, or service by trade name, trademark, manufacturer, or otherwise does not necessarily constitute or imply its endorsement, recommendation, or favoring by the United State~ Government vr duy agency tliereof. The views arid opinions of authors expressed herein do not necessarily state or reflect those of the United States Government or any agency thereof.

A risk assessment method is used to carry out a risk assessment for an organization’s information security. Currently, there are many risk assessment methods from which to choose, each exhibiting a variety of problems. For example, methods may take a long time to perform, may rely on subjective estimates for the security input data, may rely heavily on quantification of financial loss due to vulnerability, or may be costly to purchase and use. Discusses requirements for an ideal risk assessment method, and develops and evaluates factors to be considered in the selection method. Empirical research was carried out at two large, Australian organizations, in order to determine and validate factors. These factors should be of use to organizations in the evaluation, selection or development of a risk assessment method. Interesting conclusions are drawn about decision making in organizational information security.

Many organisations worldwide are benefiting from the use of electronic mail (e-mail)

Managers and researchers alike have sought new ways to address the challenges of sharing dispersed knowledge in modern business environments. Careful consideration by sharers of receivers’ knowledge needs and behaviours may improve the effectiveness of knowledge sharing. This research examines how sharers react to their perceptions of receivers’ knowledge needs and behaviours when making choices relating to sharing knowledge. The focus of this article is to propose and explore a theoretical framework for a study of the role of the receiver in knowledge sharing – receiver-based theory. Data collected from two case studies highlight a key role played by perceived receiver knowledge needs and behaviours in shaping sharer choices when explicit knowledge is shared. A set of receiver influences on knowledge sharing is provided that highlights key receiver and sharer issues. The paper concludes that companies should develop better ways to connect potential sharers with receivers’ real knowledge needs. Further, the findings suggest that sharing on a need-to-know basis hinders change in organisational power structures, and prevents the integration of isolated pockets of knowledge that may yield new value.

Corporate information technology (IT) management is increasingly service-oriented, offering continuous evaluation and improvement of application, communication, delivery and support services to internal and external customers. Service-oriented requirements engineering (SoRE) plays a significant role in identifying and specifying service requirements, formally defined through service-level agreements (SLAs). However, the new frameworks and approaches emerging to guide these developments have not yet addressed how requirements for such services can be effectively developed, nor identified the diverse issues involved. We report a case study of a web services team development of requirements for an internal Service Desk service. The study revealed five main issues of concern when developing service provider requirements: service roles, responsibilities and accountability; service performance metrics; resolution of conflicting stakeholder service requirements; customer acceptance of service change; and service provider team structure. This study suggests that in the new IT services era, new techniques and approaches are needed for eliciting and determining provider and customer requirements that involve key stakeholder groups equitably and more closely negotiate the sometimes-conflicting provider and customer needs.