Governing Information Security: Governance Domains and Decision Rights Allocation Patterns

Yu ’Andy’ Wu and Carol Stoak Saunders
Additional contact information
Yu ’Andy’ Wu: University of North Texas, USA
Carol Stoak Saunders: University of Central Florida, USA

Information Resources Management Journal (IRMJ), 2011, vol. 24, issue 1, 28-45

Abstract: Governance of the information security function is critical to effective security. In this paper, the authors present a conceptual model for security governance from the perspective of decision rights allocation. Based on Da Veiga and Eloff’s (2007) framework for security governance and two high-level information security documents published by the National Institute of Standards and Technology (NIST), the authors present seven domains of information security governance. For each of the governance domains, they propose a main decision type, using the taxonomy of information technology decisions defined by Weill and Ross (2004). This framework recommends the selection of decision rights allocation patterns that are proper to those decision types to ensure good security decisions. As a result, a balance can be achieved between decisional authority and responsibility for information security.

Date: 2011
References: Add references at CitEc
Citations: View citations in EconPapers (1)

Downloads: (external link)
http://services.igi-global.com/resolvedoi/resolve. ... 4018/irmj.2011010103 (application/pdf)

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:igg:rmj000:v:24:y:2011:i:1:p:28-45

Access Statistics for this article

Information Resources Management Journal (IRMJ) is currently edited by George Kelley

More articles in Information Resources Management Journal (IRMJ) from IGI Global
Bibliographic data for series maintained by Journal Editor ().