Factors Contributing to the Success of Information Security Management Implementation

Abstract

Information Security Management (ISM) concerns shielding the integrity, confidentiality, availability, authenticity, reliability and accountability of the organisation's information from unauthorised access in order to ensure business continuity and customers' confidence. The importance of information security (IS) in today's situation should be given due attention. Recognising its importance, organisations nowadays have devoted wide efforts in protecting their information. They establish information security policy, processes, and procedures as well as reengineer their organisational structures to align with ISM principles. Regardless of the efforts, security incidents continue to occur in many organisations. This phenomenon shows that the current implementation of ISM is still ineffective due to unaware of the factors contributing to the success of ISM. Thus, the objective of this paper is to identify ISM success factors and their elements through a large-scale survey. The survey involves 243 practitioners from statutory bodies, public and private organisations in Malaysia. The results of the survey indicate that top management, IS coordinator team, ISM team, IS audit team, employees, third parties, IS policy, IS procedures, resource planning, competency development and awareness, risk management, business continuity management, IS audit and IT infrastructure are the factors that contribute to the success of ISM implementation. These factors shall guide practitioners in planning and refining ISM implementation in their organisations.

Organisational Information Security Management Maturity Model

“…The data collected from the survey were analysed using Statistical Analysis. The findings of this empirical II have been reported in [60].…”

Assessing Challenges Facing Implementation of Information Security Critical Success Factors: A Case of National Examination Council, Tanzania

“…The finding of the study coincide that of Alotaibi & Almagwashi (2018) who found that in order to implement information system security awareness there are cost need to be incurred that is material and technology cost needs money, the study collaborate that of Alghamdi et al (2020) who found cost in changing organization culture, because after awareness program the organization culture should change to become with security change as is found in ISG framework. Zammani et al (2019) argued that there is no motivation towards awareness of latest security policy, threats and issues that occur in the organization hence cost of awareness programs is to ensure the employees, third parties and stakeholders are aware of IS policy, IS issues and IS threats as well as their responsibilities in protecting the organization's information is needed. Zaslavskiy et al (2018) found challenge that some stakeholders are not aware of specific threats to the cloud infrastructure, hence there is a need to take measures to detect threats and avoid them before they occur, Also according to Alotaibi et al (2018) there is a challenge in both information security technology and human factor awareness and many organization concentrate mainly on technology awareness and weaken human factor awareness which is considered as the weakest link in line of defense.…”