Information security governance in Saudi organizations: An empirical study

被引：22

作者：

Abu-Musa A. ^{[1
]}

机构：

[1] Accounting Department, Tanta University, Tanta

来源：

Information Management and Computer Security | 2010年 / 18卷 / 04期

关键词：

Data security; Governance; Information management; Saudi Arabia; Self-assessment;

D O I：

10.1108/09685221011079180

中图分类号：

学科分类号：

摘要：

Purpose: This paper seeks to empirically examine the existence and implementation of information security governance (ISG) in Saudi organizations. Design/methodology/approach: An empirical survey, using a self-administered questionnaire, is conducted to explore and evaluate the current status and the main features of ISG in the Saudi environment. The questionnaire is developed based on ISG guidelines for boards of directors and executive management issued by the Information Technology (IT) Governance Institute and other related materials available in the literature. A total of 167 valid questionnaires are collected and processed using the Statistical Package for Social Sciences, version 16. Findings: The results of the study reveal that although the majority of Saudi organizations recognize the importance of ISG as an integrant factor for the success of IT and corporate governance, most of them have no clear information security strategies or written information security policy statements. The majority of Saudi organizations have no disaster recovery plans to deal with information security incidents and emergencies; information security roles and responsibilities are not clearly defined and communicated. The results also show that alignment between ISG and the organization's overall business strategy is relatively poor and not adequately implemented. The results also show that risk assessment procedures are not adequately and effectively implemented, ISG is not a regular item in the board's agenda, and there are no properly functioning ISG processes or performance-measuring systems in the majority of Saudi organizations. Accordingly, appropriate actions should be taken to improve implementing and measuring the ISG performance in Saudi organizations. Originality/value: From a practical standpoint, managers and practitioners alike stand to gain from the findings of this study. The results of the paper enable them to better understand and evaluate ISG and to champion IT development for business success in Saudi organizations. © Emerald Group Publishing Limited 0968-5227.

引用

页码：226 / 276

页数：50

共 42 条

[1]

Abu-Musa A.A., Exploring perceived threats of CAIS in developing countries: The case of Saudi Arabia, Managerial Auditing Journal, 21, 4, pp. 387-407, (2006)

[2]

Abu-Musa A.A., Exploring information technology governance (ITG) in developing countries: An empirical study, The International Journal of Digital Accounting Research, 7, 13, pp. 71-117, (2007)

[3]

Abu-Musa A.A., Exploring COBIT processes for ITG in Saudi organizations: An empirical study, The International Journal of Digital Accounting Research, 9, pp. 99-126, (2009)

[4]

Abu-Musa A.A., Exploring the importance and implementation of COBIT processes in developing countries: An empirical study, Information Management & Computer Security, 17, 2, pp. 73-95, (2009)

[5]

Allen J.H., Westby J.R., Governing for Enterprise Security (GES): Implementation Guide, Article 1: Characteristics of Effective Security governance, (2007)

[6]

Veiga D.A., Eloff J.H., An information security governance framework, Information Systems Management, 24, 4, pp. 361-372, (2007)

[7]

Eloff J.H.P., Eloff M., Integrated information security architecture, Computer Fraud & Security, 11, pp. 10-16, (2005)

[8]

Entrust, Information Security Governance (ISG): An Essential Element of Corporate governance, (2004)

[9]

Hong K.-S., Chi Y.-P., Chao L.R., Tang J.-H., An integrated system theory of information security management, Information Management & Computer Security, 11, 5, pp. 243-248, (2003)

[10]

Huang S.-M., Lee C.-L., Kao A.-C., Balancing performance measures for information security management: A balanced scorecard framework, Industrial Management & Data Systems, 106, 2, pp. 242-255, (2006)

← 1 2 3 4 5 →