We address the need for security requirements to take into account risks arising from complex supply chains underpinning cyber-physical infrastructures such as industrial control systems (ICS). We present SEISMiC (SEcurity Industrial control SysteM supply Chains), a framework that takes into account the whole spectrum of security risks-from technical aspects through to human and organizational issues-across an ICS supply chain. We demonstrate the effectiveness of SEISMiC through a supply chain risk assessment of Natanz, Iran's nuclear facility that was the subject of the Stuxnet attack. Index Terms-security requirements, cyber-physical systems, risk decision-making, supply chains.

This paper advances existing theoretical understanding of the factors impacting upon organisational responses to regulative pressures in the process of information security management (ISM). Drawing on institutional theory, we conduct a case study of ISM in a Chinese hospital. A theoretical framework is presented, which proposes that organisational response strategies devised in response to regulative pressures are determined jointly by internal organisational incentives and external government supervision and enforcement. Practical implications for policymakers to promote organisational ISM are given and suggestions for future research based on the theoretical findings of the case study are provided.

Information Security is an issue of growing concern to organisations, typically addressed by development of information security policies. However, policies are only effective if organizational employees comply with them. This paper reviews literature related to employees' security behaviour and information security policy compliance and presents research gaps from literature review on influencing employees' compliance behaviour with information security policy. Here, we analyse the institutional factors that shape employee behaviour towards information security policy compliance. Applying institutional theory, we posit that an employee's compliance behaviour with information security policy is positively influenced by regulative, normative and culture-cognitive forces in organisations.