Filtern
Dokumenttyp
- Zeitschriftenartikel (2)
- Beitrag zu einem Tagungsband (1)
- Vortrag (1)
Sprache
- Englisch (4)
Schlagworte
- Management system standard (4) (entfernen)
Organisationseinheit der BAM
Eingeladener Vortrag
- nein (1)
Despite the increasing relevance of cybersecurity for companies’ performance, there is limited research on the adoption of ISO/IEC 27001, an international information security management standard. The aim of our study is to expand this limited body of literature. First, we analyse the influence of companies’ networks on the adoption of ISO/IEC 27001 as an organisational innovation based on firm website data and their hyperlinks, using the entire population of ISO/IEC 27001 certified firms identified via web mining. Second, we validate the method of constructing and analysing companies’ “digital layer” following the call for new methodological approaches to study the organisational adoption of innovations. Our findings reveal that companies' decision to adopt ISO/IEC 27001 increases significantly with their number of linkages to other companies and to those having the same certificate. Finally, their cognitive and organisational distances to linked partners have the expected inverted u-shaped influence on their own adoption decision.
Despite the growing dependence of companies on information technology and the increasingly negative impact of security incidents worldwide, there is little research on the management of information security at the company level. This paper seeks to expand knowledge on the implementation of an information security management system based on the widely used international standard ISO/IEC 27001. We present motives, experienced impacts, and obstacles related to ISO/IEC 27001 implementation using data from a survey of 125 ISO/IEC 27001 certified companies in Germany. Since adoption rates vary between ICT and non-ICT sector companies, we highlight sector-related variations. We classify the adoption of this standard as a preventive organizational innovation and apply Structural Equation Modeling to unearth explanations for the comparatively low adoption of this management system standard among companies outside the ICT sector. We, therefore, derive recommendations for policymakers, standardization, and certification bodies to foster its diffusion.
Against the backdrop of numerous security breaches and cyber-attacks, organizations need to take measures to secure their data and information. However, the well-known management system standard ISO/IEC 27001 for information security has shown a lower adoption rate – in terms of annual ISO survey data – than was previously expected by scholars and practitioners. Through the lens of Rogers' diffusion of innovation theory, we consider the adoption of ISO/IEC 27001 as a 'preventive innovation' and aim to identify factors that help gain a better understanding of its adoption. Therefore, we conducted a survey among German organizations on the use and impact of management system standards, explicitly distinguishing between organizations that implement ISO/IEC 27001 and those that are additionally certified against this standard. This study provides insights and contributes to an advanced understanding of motives, impacts, barriers, and useful measures to increase adoption of ISO/IEC 27001. Our findings may be useful to organizations considering the adoption of this management system standard, to certification bodies providing certification services, and to policymakers seeking means to improve information security in organizations.