Hier finden Sie wissenschaftliche Publikationen aus den Fraunhofer-Instituten.

Information security management in ICT and non-ICT sector companies: A preventive innovation perspective

: Mirtsch, Mona; Blind, Knut; Koch, Claudia; Dudek, Gabriele

Volltext urn:nbn:de:0011-n-6387839 (1.5 MByte PDF)
MD5 Fingerprint: 532b9c7dde40f45cd0200c67c3f93cf1
(CC) by
Erstellt am: 18.8.2021

Computers & security 109 (2021), Art. 102383, 23 S.
ISSN: 0167-4048
Zeitschriftenaufsatz, Elektronische Publikation
Fraunhofer ISI ()
information security; ISO / IEC 27001; management system standard; certification; information security management system; preventive innovation; resource-based-view; institutional theory

Despite the growing dependence of companies on information technology and the increasingly negative impact of security incidents worldwide, there is little research on the management of information security at the company level. This paper seeks to expand knowledge on the implementation of an information security management system based on the widely used international standard ISO/IEC 27001. We present motives, experienced impacts, and obstacles related to ISO/IEC 27001 implementation using data from a survey of 125ISO/IEC 27001 certified companies in Germany. Since adoption rates vary between ICT and non-ICT sector companies, we highlight sector-related variations. We classify the adoption of this standard as a preventive organizational innovation and apply Structural Equation Modeling to unearth explanations for the comparatively low adoption of this management system standard among companies outside the ICT sector. We, therefore, derive recommendations for policymakers, standardization, and certification bodies to foster its diffusion.