Wissenschaftliche Artikel der BAM
Filtern
Dokumenttyp
- Zeitschriftenartikel (6)
- Buchkapitel (1)
Schlagworte
- Certification (3)
- ISO/IEC 27001 (2)
- Information security (2)
- Management system standard (2)
- Adoption (1)
- Conformity assessment (1)
- Conformity assessment body (1)
- Connectivity (1)
- Corona (1)
- Covid-19 (1)
Organisationseinheit der BAM
Against the backdrop of numerous security breaches and cyber-attacks, organizations need to take measures to secure their data and information. However, the well-known management system standard ISO/IEC 27001 for information security has shown a lower adoption rate – in terms of annual ISO survey data – than was previously expected by scholars and practitioners. Through the lens of Rogers' diffusion of innovation theory, we consider the adoption of ISO/IEC 27001 as a 'preventive innovation' and aim to identify factors that help gain a better understanding of its adoption. Therefore, we conducted a survey among German organizations on the use and impact of management system standards, explicitly distinguishing between organizations that implement ISO/IEC 27001 and those that are additionally certified against this standard. This study provides insights and contributes to an advanced understanding of motives, impacts, barriers, and useful measures to increase adoption of ISO/IEC 27001. Our findings may be useful to organizations considering the adoption of this management system standard, to certification bodies providing certification services, and to policymakers seeking means to improve information security in organizations.
The COVID-19 pandemic posed new and manifold challenges to organizations and their operations worldwide. Conformity assessment bodies (CABs), such as testing or medical laboratories, certification, and inspection bodies, were also affected by the associated disruptions. Their role in this crisis is highly relevant, as CABs are essential pillars of the quality infrastructure: their activities ensure that products and services meet requirements as defined in standards and regulations, thereby contributing to their safety and reliability. The question arises of how CABs and their operations were affected by the pandemic and how they responded. To this end, we present the results of an international survey of 986 CABs of all types in Germany, the UK, Italy, and New Zealand. Overall, CABs reported, on average, a reduction in demand for their services during the pandemic, facing restrictions in all countries. In addition, the pandemic had an overall negative impact on the CABs’ investment and innovation activities. However, investments in digital infrastructure were increased as a countermeasure, with CABs reporting a higher need for digitalization. The paper highlights and discusses results from in-depth analyses relevant to policymakers and industry alike.
Despite the growing dependence of companies on information technology and the increasingly negative impact of security incidents worldwide, there is little research on the management of information security at the company level. This paper seeks to expand knowledge on the implementation of an information security management system based on the widely used international standard ISO/IEC 27001. We present motives, experienced impacts, and obstacles related to ISO/IEC 27001 implementation using data from a survey of 125 ISO/IEC 27001 certified companies in Germany. Since adoption rates vary between ICT and non-ICT sector companies, we highlight sector-related variations. We classify the adoption of this standard as a preventive organizational innovation and apply Structural Equation Modeling to unearth explanations for the comparatively low adoption of this management system standard among companies outside the ICT sector. We, therefore, derive recommendations for policymakers, standardization, and certification bodies to foster its diffusion.
Smart Products Enable Smart Regulations—Optimal Durability Requirements Facilitated by the IoT
(2021)
The challenges and opportunities linked with IoT have been intensively discussed in recent years. The connectivity of things over their entire life cycle and the smart properties associated with it provide new functionalities and unprecedented availability of (usage) data. This offers huge opportunities for manufacturers, service providers, users, and also policymakers. The latter May impact policy areas such as the regulations on resource and materials efficiency under the Ecodesign Directive 2009/125/EC. With the general approach as it is practiced today, legal requirements are usually set for entire product groups without considering the products individually, including user behavior and environmental conditions. The increasing number of smart products and the growing availability of product data are sparking a discussion on whether these requirements could be more product and application-specific. This paper presents a method for calculating the economically and ecologically optimal durability of a product. It allows determining the point in time when a product should be replaced by combining consumer data with product design data. This novel Approach could contribute to making product regulation more flexible and possibly more efficient. In this context, fundamental challenges associated with smart products in policymaking are also discussed.
In the light of digitalization and recent EU policy initiatives, information is an important asset that organizations of all sizes and from all sectors should secure. However, in order to provide common requirements for the implementation of an information security management system, the internationally well-accepted ISO/IEC 27001 standard has not shown the expected growth rate since its publication more than a decade ago.In this article, we apply web mining to explore the adoption of ISO/IEC 27001 through a series of 2664 out of more than 900 000 German firms from the Mannheim Enterprise Panel dataset that refers to this standard on their websites. As a result, we present a “landscape” of ISO/IEC 27001 in Germany, which shows that firms not only seek certifications themselves but often refer on their websites to partners who are certified instead. Consequently, we estimate a probit model and find that larger and more innovative firms are more likely to be certified to ISO/IEC 27001 and that almost half of all certified firms belong to the information and communications technology (ICT) service sector. Based on our findings, we derive implications for policymakers and management and critically assess the suitability of web mining to explore the adoption of management system standards.
Das Ziel dieses Kapitels besteht darin, die Rolle von Konformitätsbewertung für die Erhöhung der Cybersicherheit von Produkten, Dienstleistungen und Prozessen zu betrachten. Dazu wird der Begriff Cybersicherheit beleuchtet sowie ausgewählte Cybersicherheitsnormen kurz vorgestellt. Im Folgenden wird der regulative europäische Rahmen für die Konformitätsbewertung aus ordnungspolitischer Sicht sowie der aktuelle Verordnungsentwurf zum Cybersecurity Act dargestellt und kritsch beleuchtet.
Standardization research is a fairly new and is a still-evolving field of research, with possibly major practical ramifications. This article presents a summary of the authors’ subjective views of the most pressing research topics in the field. These include, among others, standards (e.g. incorporation of ethical issues), the potential impact of standards, the corporate management of standardization and legal issues like Intellectual Property Rights (IPR). In addition, gaps have been identified with a respect to a basic understanding of standardization, suggesting a need for better education in the field.