Filtern
Dokumenttyp
- Vortrag (13)
- Zeitschriftenartikel (7)
- Beitrag zu einem Tagungsband (5)
- Forschungsbericht (3)
- Sonstiges (2)
- Buchkapitel (1)
Sprache
- Englisch (18)
- Deutsch (12)
- Italienisch (1)
Schlagworte
- ISO/IEC 27001 (11)
- Zertifizierung (10)
- Konformitätsbewertung (9)
- Information security (7)
- QI-FoKuS (7)
- COVID-19 (6)
- Certification (6)
- Corona (6)
- Managementsysteme (5)
- Web Mining (5)
Organisationseinheit der BAM
Eingeladener Vortrag
- nein (13)
Global supply chains rely on the compliance and safety of their products, processes, and facilities. These vital services (often referred to as ‘quality assurance’ or ‘conformity assessment’ services) are provided by Conformity Assessment Bodies (CABs). This empirical study explores the impact of the COVID-19 pandemic on CABs as well as their response to the resulting challenges. Data was gathered through an online survey among all accredited CABs in Germany, which resulted in 555 valid responses. Taking a resilience perspective, we reveal that CABs were hit hard by the disruptions caused by the pandemic, albeit to different degrees, in part due to their type of services, size, and sectors served. Furthermore, we find that contingency plans do not directly cushion order declines (as the main indicator of the economic impact of the pandemic) but rather indirectly through helping CABs respond more quickly, which in turn mitigates their order declines. However, our results show that contingency plans can also have adverse effects if they hinder flexible reaction to the crisis. The findings of our study help managers and policymakers learn from the COVID-19 pandemic and improve the resilience of the conformity assessment sector and quality assurance in the event of future crises.
Despite the increasing relevance of cybersecurity for companies’ performance, there is limited research on the adoption of ISO/IEC 27001, an international information security management standard. The aim of our study is to expand this limited body of literature. First, we analyse the influence of companies’ networks on the adoption of ISO/IEC 27001 as an organisational innovation based on firm website data and their hyperlinks, using the entire population of ISO/IEC 27001 certified firms identified via web mining. Second, we validate the method of constructing and analysing companies’ “digital layer” following the call for new methodological approaches to study the organisational adoption of innovations. Our findings reveal that companies' decision to adopt ISO/IEC 27001 increases significantly with their number of linkages to other companies and to those having the same certificate. Finally, their cognitive and organisational distances to linked partners have the expected inverted u-shaped influence on their own adoption decision.
Impact of the COVID-19 Pandemic on Conformity Assessment: Insights from a Multinational Study
(2021)
The COVID-19 pandemic has posed new and manifold challenges to organizations and their operations worldwide. Conformity assessment bodies (CABs), such as testing or medical laboratories, certification, and inspection bodies, are also affected by the associated disruptions. Their situation in this crisis is highly relevant, as CABs are essential pillars of the quality infrastructure: Their activities ensure that products and services meet requirements as defined in standards and regulations, thereby contributing to their safety and reliability. Considering the roles and functions of CABs in economy, health, and innovation, the question arises how CABs and their operations were affected by the pandemic and how they responded. To this end, we present the results of an international survey of 986 CABs of all types in Germany, the UK, Italy, and New Zealand. Overall, CABs reported on average a negative development of demand during the pandemic, facing restrictions in all countries. In addition, the pandemic had overall negative impact on the CABs’ investment and innovation activities. However, investments in digital infrastructure were increased as countermeasure, with CABs reporting an increased need for digitalization. Resources relevant to organizational resilience were available to different extents, affecting the speed of response to the challenges of the pandemic. The paper highlights and discusses results from in-depth analyses, which are relevant for policy makers and industry alike.
Despite the growing dependence of companies on information technology and the increasingly negative impact of security incidents worldwide, there is little research on the management of information security at the company level. This paper seeks to expand knowledge on the implementation of an information security management system based on the widely used international standard ISO/IEC 27001. We present motives, experienced impacts, and obstacles related to ISO/IEC 27001 implementation using data from a survey of 125 ISO/IEC 27001 certified companies in Germany. Since adoption rates vary between ICT and non-ICT sector companies, we highlight sector-related variations. We classify the adoption of this standard as a preventive organizational innovation and apply Structural Equation Modeling to unearth explanations for the comparatively low adoption of this management system standard among companies outside the ICT sector. We, therefore, derive recommendations for policymakers, standardization, and certification bodies to foster its diffusion.
The COVID-19 pandemic posed new and manifold challenges to organizations and their operations worldwide. Conformity assessment bodies (CABs), such as testing or medical laboratories, certification, and inspection bodies, were also affected by the associated disruptions. Their role in this crisis is highly relevant, as CABs are essential pillars of the quality infrastructure: their activities ensure that products and services meet requirements as defined in standards and regulations, thereby contributing to their safety and reliability. The question arises of how CABs and their operations were affected by the pandemic and how they responded. To this end, we present the results of an international survey of 986 CABs of all types in Germany, the UK, Italy, and New Zealand. Overall, CABs reported, on average, a reduction in demand for their services during the pandemic, facing restrictions in all countries. In addition, the pandemic had an overall negative impact on the CABs’ investment and innovation activities. However, investments in digital infrastructure were increased as a countermeasure, with CABs reporting a higher need for digitalization. The paper highlights and discusses results from in-depth analyses relevant to policymakers and industry alike.
Digital transformation and especially the dramatic rise of products and services connected to the Internet of Things raise the questions on how to deal with the increasing risks related to Privacy and Cybersecurity. Presumably, these risks seem to be insufficiently reflected in the European Union’s current regulative system – by being neither part of the traditional definition of a safe product nor part of product-specific vertical or horizontal directives. Certification based on standards as underlying requirements has been identified by policymakers as an instrument to address this issue. The latest European draft regulation aims at increasing security and trust in ICT products and services, and reducing current European market fragmentation with a new Cybersecurity Certification Framework. Based on the results of a qualitative analysis of stakeholder statements on the current proposal on the Cybersecurity Act, this paper discusses elements of the proposed Cybersecurity Certification Framework. As a theoretical background, this paper provides definitions of the terms Safety, IT-security, and Cybersecurity, presents selected Cybersecurity-related standards and provides an outlook on future challenges to Conformity Assessment in the digital transformation.
In the light of digitalization and recent EU policy initiatives, information is an important asset that organizations of all sizes and from all sectors should secure. However, in order to provide common requirements for the implementation of an information security management system, the internationally well-accepted ISO/IEC 27001 standard has not shown the expected growth rate since its publication more than a decade ago.In this article, we apply web mining to explore the adoption of ISO/IEC 27001 through a series of 2664 out of more than 900 000 German firms from the Mannheim Enterprise Panel dataset that refers to this standard on their websites. As a result, we present a “landscape” of ISO/IEC 27001 in Germany, which shows that firms not only seek certifications themselves but often refer on their websites to partners who are certified instead. Consequently, we estimate a probit model and find that larger and more innovative firms are more likely to be certified to ISO/IEC 27001 and that almost half of all certified firms belong to the information and communications technology (ICT) service sector. Based on our findings, we derive implications for policymakers and management and critically assess the suitability of web mining to explore the adoption of management system standards.
Mit QI-FoKuS / Forschung für Konformitätsbewertung und Sicherheit streben wir auf Basis einer wiederkehrenden Befragung von Unternehmen und Konformitätsbewertungsstellen in Deutschland die Schaffung einer besseren Datengrundlage für die Forschung an. Diese soll es erleichtern, wichtige Zusammenhänge evidenzbasiert zu analysieren, um das systemische Zusammenwirken der Elemente der Qualitätsinfrastruktur besser zu verstehen. Dabei sollen zunächst die Elemente Konformitätsbewertung und Akkreditierung besonders im Vordergrund stehen.
In the wake of digitalization, organizations are increasingly exposed to risks associated with security breaches and must take measures to preserve the confidentiality, integrity, and availability of information, and to ensure business continuity. The international standard ISO/IEC 27001 assists organizations in setting up, maintaining and continuously improving their information security management systems. However, despite high growth rates, its international diffusion rates are quite heterogeneous. This paper explores why the diffusion of the international management system standard ISO/IEC 27001 differs across countries. We classify the adoption of ISO/IEC 27001 as a ‘preventive organizational innovation’ and draw from diffusion studies of other management system standards and information security research to develop a set of hypotheses. These relate to the impact of cultural dimensions and national ICT development. We use a negative binomial regression model with panel data covering 57 countries over a 12-year period from 2006 to 2017 to test our hypotheses. We find that the cultural dimensions future orientation, power distance, and institutional collectivism as well as high ICT development are driving factors for the diffusion of ISO/IEC 27001. We derive policy recommendations and avenues for future research.
In the wake of digitalization, organizations are increasingly exposed to risks associated with security breaches and must take measures to preserve the confidentiality, integrity, and availability of information, and to ensure business continuity. The international standard ISO/IEC 27001 assists organizations in setting up, maintaining and continuously improving their information security management systems. However, despite high growth rates, its international diffusion rates are quite heterogeneous. This paper explores why the diffusion of the international management system standard ISO/IEC 27001 differs across countries. We classify the adoption of ISO/IEC 27001 as a ‘preventive organizational innovation’ and draw from diffusion studies of other management system standards and information security research to develop a set of hypotheses. These relate to the impact of cultural dimensions and national ICT development. We use a negative binomial regression model with panel data covering 57 countries over a 12-year period from 2006 to 2017 to test our hypotheses. We find that the cultural dimensions future orientation, power distance, and institutional collectivism as well as high ICT development are driving factors for the diffusion of ISO/IEC 27001. We derive policy recommendations and avenues for future research.
Das Ziel der Initiative QI-FoKuS ist es, eine Datenbasis für neue wissenschaftliche Erkenntnisse zu Einflussfaktoren und Effekten in der Konformitätsbewertung und Akkreditierung zu schaffen. Ende 2019 wurden in einer ersten Online-Erhebung Unternehmen verschiedener Branchen und Größenklassen in Deutschland zur Nutzung von Managementsystemen und ihren Wirkungen befragt. Diese umfasste weit verbreitete genormte Managementsysteme wie ISO 9001 und ISO 14001 genauso wie bisher wenig untersuchte Systeme wie die ISO 50001 oder ISO/IEC 27001. Es konnten 180 Fragebögen für die vorliegende Studie ausgewertet werden.
Im Vortrag wurden die Ergebnisse der von BAM gemeinsam mit der TU Berlin und Fraunhofer ISI durchgeführten Befragung zur Lage der Konformitätsbewertungsstellen während der Corona-Pandemie vorgestellt und mit den Teilnehmer*innen diskutiert. Schwerpunkte lagen auf den wirtschaftlichen Auswirkungen (Aufträge, Arbeitsfähigkeit, Existenz), der Resilienz der Branche sowie den Wirkungen auf die Digitalisierung. Mehr Informationen unter www.qi-fokus.de.
Die Studie fasst Ergebnisse einer Befragung von Konformitätsbewertungsstellen zu deren Lage und den Aussichten während der Corona-Pandemie zusammen. Besondere Schwerpunkte wurden auf die wirtschaftlichen Auswirkungen und die Arbeitsfähigkeit, aber auch auf die Resilienz und die Wirkungen auf die Digitalisierung gelegt.
Das Ziel der Initiative QI-FoKuS ist es, eine Datenbasis für neue wissenschaftliche Erkenntnisse zu Einflussfaktoren und Effekten in der Konformitätsbewertung und Akkreditierung zu schaffen und hierbei insbesondere auch auf aktuelle Trends und Entwicklungen einzugehen. Von Januar bis März 2020 wurden in einer Online-Erhebung Unternehmen verschiedener Branchen und Größenklassen in Deutschland zur Nutzung und den Wirkungen ihres zertifizierten Managementsystems für Informationssicherheit nach ISO/IEC 27001 befragt. Es konnten 125 vollständig ausgefüllte Fragebögen für die vorliegende Studie ausgewertet werden.
Ergebnisvorstellung im mitgliederexklusiven Webinar der Deutschen Gesellschaft für Qualität - DGQ zur Nutzung und Wirkung von genormten Managementsystemen als die erste Erhebung im Rahmen von QI-FoKuS. Neben der Motivation hinsichtlich der Anwendung verschiedener Normen, die Anforderungen an Managementsysteme darlegen, sowie den Wirkungen werden insbesondere die Zertifizierung für diese Normen sowie daran anknüpfend die Rolle und Funktion der Akkreditierung – und somit verschiedene Bausteine der QI – adressiert.
Traditional innovation indicators often lack coverage, granularity as well as timeliness and involve high data collection costs, especially when conducted at a large scale. Based on the assumption that firms publish information about their products and services on their own websites, the Centre for European Economic Research in Mannheim (ZEW) has developed a framework to extract information from German firm websites applying Web Mining using a free-to-use web-scraping tool.
Categorized as an intraorganizational procedural innovation, management system standards often lack research especially during the early stages of their diffusion mainly due to low data availability. Therefore, we introduce Web Mining to study the diffusion of the international management system standard ISO/IEC 27001 in Germany. Using the Mannheim Enterprise panel dataset, we first apply Web Mining to identify firms that refer to these and other common management system standards, followed by manual categorization. Second, we estimate a probit model to identify drivers for its implementation. Finally, we derive recommendations for policy makers.