Filtern
Dokumenttyp
- Vortrag (6)
- Zeitschriftenartikel (2)
- Forschungsbericht (2)
- Beitrag zu einem Tagungsband (1)
Schlagworte
- ISO/IEC 27001 (11) (entfernen)
Organisationseinheit der BAM
Eingeladener Vortrag
- nein (6)
Despite the growing dependence of companies on information technology and the increasingly negative impact of security incidents worldwide, there is little research on the management of information security at the company level. This paper seeks to expand knowledge on the implementation of an information security management system based on the widely used international standard ISO/IEC 27001. We present motives, experienced impacts, and obstacles related to ISO/IEC 27001 implementation using data from a survey of 125 ISO/IEC 27001 certified companies in Germany. Since adoption rates vary between ICT and non-ICT sector companies, we highlight sector-related variations. We classify the adoption of this standard as a preventive organizational innovation and apply Structural Equation Modeling to unearth explanations for the comparatively low adoption of this management system standard among companies outside the ICT sector. We, therefore, derive recommendations for policymakers, standardization, and certification bodies to foster its diffusion.
In the wake of digitalization, organizations are increasingly exposed to risks associated with security breaches and must take measures to preserve the confidentiality, integrity, and availability of information, and to ensure business continuity. The international standard ISO/IEC 27001 assists organizations in setting up, maintaining and continuously improving their information security management systems. However, despite high growth rates, its international diffusion rates are quite heterogeneous. This paper explores why the diffusion of the international management system standard ISO/IEC 27001 differs across countries. We classify the adoption of ISO/IEC 27001 as a ‘preventive organizational innovation’ and draw from diffusion studies of other management system standards and information security research to develop a set of hypotheses. These relate to the impact of cultural dimensions and national ICT development. We use a negative binomial regression model with panel data covering 57 countries over a 12-year period from 2006 to 2017 to test our hypotheses. We find that the cultural dimensions future orientation, power distance, and institutional collectivism as well as high ICT development are driving factors for the diffusion of ISO/IEC 27001. We derive policy recommendations and avenues for future research.
In the wake of digitalization, organizations are increasingly exposed to risks associated with security breaches and must take measures to preserve the confidentiality, integrity, and availability of information, and to ensure business continuity. The international standard ISO/IEC 27001 assists organizations in setting up, maintaining and continuously improving their information security management systems. However, despite high growth rates, its international diffusion rates are quite heterogeneous. This paper explores why the diffusion of the international management system standard ISO/IEC 27001 differs across countries. We classify the adoption of ISO/IEC 27001 as a ‘preventive organizational innovation’ and draw from diffusion studies of other management system standards and information security research to develop a set of hypotheses. These relate to the impact of cultural dimensions and national ICT development. We use a negative binomial regression model with panel data covering 57 countries over a 12-year period from 2006 to 2017 to test our hypotheses. We find that the cultural dimensions future orientation, power distance, and institutional collectivism as well as high ICT development are driving factors for the diffusion of ISO/IEC 27001. We derive policy recommendations and avenues for future research.
Das Ziel der Initiative QI-FoKuS ist es, eine Datenbasis für neue wissenschaftliche Erkenntnisse zu Einflussfaktoren und Effekten in der Konformitätsbewertung und Akkreditierung zu schaffen. Ende 2019 wurden in einer ersten Online-Erhebung Unternehmen verschiedener Branchen und Größenklassen in Deutschland zur Nutzung von Managementsystemen und ihren Wirkungen befragt. Diese umfasste weit verbreitete genormte Managementsysteme wie ISO 9001 und ISO 14001 genauso wie bisher wenig untersuchte Systeme wie die ISO 50001 oder ISO/IEC 27001. Es konnten 180 Fragebögen für die vorliegende Studie ausgewertet werden.
Das Ziel der Initiative QI-FoKuS ist es, eine Datenbasis für neue wissenschaftliche Erkenntnisse zu Einflussfaktoren und Effekten in der Konformitätsbewertung und Akkreditierung zu schaffen und hierbei insbesondere auch auf aktuelle Trends und Entwicklungen einzugehen. Von Januar bis März 2020 wurden in einer Online-Erhebung Unternehmen verschiedener Branchen und Größenklassen in Deutschland zur Nutzung und den Wirkungen ihres zertifizierten Managementsystems für Informationssicherheit nach ISO/IEC 27001 befragt. Es konnten 125 vollständig ausgefüllte Fragebögen für die vorliegende Studie ausgewertet werden.
Ergebnisvorstellung im mitgliederexklusiven Webinar der Deutschen Gesellschaft für Qualität - DGQ zur Nutzung und Wirkung von genormten Managementsystemen als die erste Erhebung im Rahmen von QI-FoKuS. Neben der Motivation hinsichtlich der Anwendung verschiedener Normen, die Anforderungen an Managementsysteme darlegen, sowie den Wirkungen werden insbesondere die Zertifizierung für diese Normen sowie daran anknüpfend die Rolle und Funktion der Akkreditierung – und somit verschiedene Bausteine der QI – adressiert.
Traditional innovation indicators often lack coverage, granularity as well as timeliness and involve high data collection costs, especially when conducted at a large scale. Based on the assumption that firms publish information about their products and services on their own websites, the Centre for European Economic Research in Mannheim (ZEW) has developed a framework to extract information from German firm websites applying Web Mining using a free-to-use web-scraping tool.
Categorized as an intraorganizational procedural innovation, management system standards often lack research especially during the early stages of their diffusion mainly due to low data availability. Therefore, we introduce Web Mining to study the diffusion of the international management system standard ISO/IEC 27001 in Germany. Using the Mannheim Enterprise panel dataset, we first apply Web Mining to identify firms that refer to these and other common management system standards, followed by manual categorization. Second, we estimate a probit model to identify drivers for its implementation. Finally, we derive recommendations for policy makers.
Informationssicherheit in deutschen Unternehmen: Ergebnisse der QI-FoKuS Umfrage zur ISO/IEC 27001
(2021)
Ergebnisvorstellung im mitgliederexklusiven Webinar der Deutschen Gesellschaft für Qualität (DGQ) zur Studie: "Nutzung und Wirkung von einem ISMS nach ISO/IEC 27001". Neben Zweck und Design der Studie werden sowohl Hürden bei der Implementierung, fördernde Maßnahmen, die Anwender nützlich finden und die Frage, warum Firmen diese Norm nicht nutzen, erörtert.