S Qualitätsinfrastruktur
Filtern
Dokumenttyp
- Forschungsbericht (18)
- Vortrag (6)
- Zeitschriftenartikel (3)
- Beitrag zu einem Tagungsband (2)
Sprache
- Englisch (27)
- Mehrsprachig (2)
Schlagworte
- Certification (29) (entfernen)
Organisationseinheit der BAM
Eingeladener Vortrag
- nein (6)
Despite the growing dependence of companies on information technology and the increasingly negative impact of security incidents worldwide, there is little research on the management of information security at the company level. This paper seeks to expand knowledge on the implementation of an information security management system based on the widely used international standard ISO/IEC 27001. We present motives, experienced impacts, and obstacles related to ISO/IEC 27001 implementation using data from a survey of 125 ISO/IEC 27001 certified companies in Germany. Since adoption rates vary between ICT and non-ICT sector companies, we highlight sector-related variations. We classify the adoption of this standard as a preventive organizational innovation and apply Structural Equation Modeling to unearth explanations for the comparatively low adoption of this management system standard among companies outside the ICT sector. We, therefore, derive recommendations for policymakers, standardization, and certification bodies to foster its diffusion.
Digital transformation and especially the dramatic rise of products and services connected to the Internet of Things raise the questions on how to deal with the increasing risks related to Privacy and Cybersecurity. Presumably, these risks seem to be insufficiently reflected in the European Union’s current regulative system – by being neither part of the traditional definition of a safe product nor part of product-specific vertical or horizontal directives. Certification based on standards as underlying requirements has been identified by policymakers as an instrument to address this issue. The latest European draft regulation aims at increasing security and trust in ICT products and services, and reducing current European market fragmentation with a new Cybersecurity Certification Framework. Based on the results of a qualitative analysis of stakeholder statements on the current proposal on the Cybersecurity Act, this paper discusses elements of the proposed Cybersecurity Certification Framework. As a theoretical background, this paper provides definitions of the terms Safety, IT-security, and Cybersecurity, presents selected Cybersecurity-related standards and provides an outlook on future challenges to Conformity Assessment in the digital transformation.
QI-FoKuS stands for „Quality Infrastructure – Research for Conformity Assessment and Safety“. Supported by the BMWi, a new recurring survey of companies was launched under this name in end-September 2019 in a joint project between the TU Berlin and the Federal Institute for Materials Research and Testing (BAM). The first company survey deals with the use and certification of management systems with a special focus on information security and the criteria for the selection of certification bodies.
Digital transformation and especially the dramatic rise of products and services connected to the Internet of Things raise the questions on how to deal with the increasing risks related to Privacy and Cybersecurity. Presumably, these risks seem to be insufficiently reflected in the European Union’s current regulative system – by being neither part of the traditional definition of a safe product nor part of product-specific vertical or horizontal directives. Certification based on standards as underlying requirements has been identified by policymakers as an instrument to address this issue. The latest European draft regulation aims at increasing security and trust in ICT products and services, and reducing current European market fragmentation with a new Cybersecurity Certification Framework. Based on the results of a qualitative analysis of stakeholder statements on the current proposal on the Cybersecurity Act, this paper discusses elements of the proposed Cybersecurity Certification Framework. As a theoretical background, this paper provides definitions of the terms Safety, IT-security, and Cybersecurity, presents selected Cybersecurity-related standards and provides an outlook on future challenges to Conformity Assessment in the digital transformation.
Against the backdrop of numerous security breaches and cyber-attacks, organizations need to take measures to secure their data and information. However, the well-known management system standard ISO/IEC 27001 for information security has shown a lower adoption rate – in terms of annual ISO survey data – than was previously expected by scholars and practitioners. Through the lens of Rogers' diffusion of innovation theory, we consider the adoption of ISO/IEC 27001 as a 'preventive innovation' and aim to identify factors that help gain a better understanding of its adoption. Therefore, we conducted a survey among German organizations on the use and impact of management system standards, explicitly distinguishing between organizations that implement ISO/IEC 27001 and those that are additionally certified against this standard. This study provides insights and contributes to an advanced understanding of motives, impacts, barriers, and useful measures to increase adoption of ISO/IEC 27001. Our findings may be useful to organizations considering the adoption of this management system standard, to certification bodies providing certification services, and to policymakers seeking means to improve information security in organizations.
This report summarizes findings from the first comprehensive study on digitalization in conformity assessment in Mexico. The reults are based on data from a survey among conformity assessment bodies (CABs) conducted in 2022. It highlights the digital maturity of the organizations, the motives, benefits and obstacles of digital transformation as well as the actual technology trends.
This study is part of a global project that covers various other countries (see www.qi-fokus.de).
This report summarizes findings from the first comprehensive study on digitalization in conformity assessment in the United Kingdom. The reults are based on data from a survey among conformity assessment bodies (CABs) conducted in 2022. It highlights the digital maturity of the organizations, the motives, benefits and obstacles of digital transformation as well as the actual technology trends.
This study is part of a global project that covers various other countries (see www.qi-fokus.de).
This report summarizes findings from the first comprehensive study on digitalization in conformity assessment in West Africa. The reults are based on data from a survey among conformity assessment bodies (CABs) conducted in 2022. It highlights the digital maturity of the organizations, the motives, benefits and obstacles of digital transformation as well as the actual technology trends.
This study is part of a global project that covers various other countries (see www.qi-fokus.de).
This report summarizes findings from the first comprehensive study on digitalization in conformity assessment in Peru. The reults are based on data from a survey among conformity assessment bodies (CABs) conducted in 2022. It highlights the digital maturity of the organizations, the motives, benefits and obstacles of digital transformation as well as the actual technology trends.
This study is part of a global project that covers various other countries (see www.qi-fokus.de).
This report summarizes findings from the first comprehensive study on digitalization in conformity assessment in the Netherlands. The reults are based on data from a survey among conformity assessment bodies (CABs) conducted in 2022. It highlights the digital maturity of the organizations, the motives, benefits and obstacles of digital transformation as well as the actual technology trends.
The study on Dutch CABs is part of a global project that covers various other countries (see www.qi-fokus.de).