Abstract
Although several studies have discussed the framework and value of information systems (IS) security standards and certification, there has been relatively little empirical research on how different groups of stakeholders in an organization interpret and behave during the implementation process. In an attempt to fill this research gap, this study employs a socio-cognitive perspective, namely the concept of frames analysis, to investigate how the managers and employees of a financial institution make sense of IS security certification, BS 7799 Part 2, and how these interpretations influence their actions. Using an interpretive case study approach, the findings show that the expectations of management have a strong impact on the implementation of the certification process. Moreover, the incongruence between the perceptions of managers and those of the certification team and other employees means that IS security management concepts may not be fully embedded in the organization's work practices and routines. This article argues that during the certification process, managers should place more emphasis on the identification of frame incongruence and undertake early intervention to align frames in order to achieve overall security effectiveness in the organization.
Additional information
Notes on contributors
Carol W Hsu
Carol Hsu is an assistant professor in the Department of Information Management at National Taiwan University, Taiwan. She holds a Ph.D. in information systems from the London School of Economics and Political Science, U.K. Her current research focuses on the organizational and cultural issues concerning security policy and technology implementation. Her work has been published in Journal of Information Systems Security, Communications of the ACM and MIS Quarterly.