Issues and Opinions: Assessing the Emphasis on Information Security in the Systems Analysis and Design Course

2015 | Communications of the Association for Information Systems | Citations: 0

Authors: Salisbury, William D.; Ferratt, Thomas W.; Wynn, Donald Jr.

Abstract: Due to several recent highly publicized information breaches, information securi ... Expand

Abstract: Due to several recent highly publicized information breaches, information security has gained a higher profile. Hence, it is reasonable to expect that information security would receive an equally significant emphasis in the education of future systems professionals. A variety of security standards that various entities (e.g., NIST, COSO, ISACA-COBIT, ISO) have put forth emphasize the importance of information security from the very beginning of the system development lifecycle (SDLC) to avoid significant redesign in later phases. To determine the emphasis on security in typical systems analysis and design (SA&D) courses, we examine (1) to what extent security is emphasized in the core SA&D courses and (2) at what phase in the SDLC do most SA&D courses begin to emphasize security. In order to address these questions, we reviewed SA&D textbooks currently on the market to identify how extensively they cover security-related issues. Given the fairly high awareness of information security in practice, we expected to see an equally high emphasis on such matters in the textbooks. However, our review suggests that this is not the case, which suggests a gap in our preparation. To address this gap, we offer a proposal for modifying a portion of the SA&D curricula. Collapse

Topics: data security systems development risk management COBIT IS curriculum

Methods: literature sample design science capability maturity model

Shareholder reaction to firm investments in the capability maturity model: an event study

2013 | European Journal of Information Systems | Citations: 2

Authors: Filbeck, Greg; Swinarski, Matthew; Zhao, Xin

Abstract: This study investigates the differential effects of successfully completed capab ... Expand

Abstract: This study investigates the differential effects of successfully completed capability maturity model (CMM) appraisals on a firm's short-term and long-term stock performance. Our results indicate a positive share price response on the days surrounding the appraisal date for the stocks of companies obtaining the CMM appraisal. Stocks of firms successfully completing CMM appraisals generally outperform the S&P 500 index over longer-holding periods, although they do not outperform a matched sample. We find support that firms from the information technology industry, firms that are larger, firms of higher CMM maturity levels, and firms completing multiple appraisals are more likely to experience both short-term and long-term benefits from their investing in the CMM. Collapse

Topics: financial performance accounting organizational productivity systems development IT investment

Methods: event study longitudinal research cross sectional research parametric test Student's t-test

Theories: transaction cost economics

WHY FIRMS SEEK ISO 20000 CERTIFICATION - A STUDY OF ISO 20000 ADOPTION

2012 | European Conference On Information Systems | Citations: 0

Authors: Disterer, Georg

Abstract: Since the end of 2005, the ISO 20000 international standard for IT service manag ... Expand

Abstract: Since the end of 2005, the ISO 20000 international standard for IT service management has been in existence, offering a normative management and organization concept for aligning the performance of IT services, and enabling companies to certify their compliance according this standard by third parties. There is a great interest in the standard, and the forecasts for the adoption and dissemination of the standard are, to a large extent, very positive. In contrast, some critical voices cast doubts upon the wisdom of normative management and organization concepts, and upon the possibility to verify or measure the conformity with public standards. Collapse

Topics: ISO 9000 marketing management electronic mail

Methods: survey Student's t-test parametric test exploratory factor analysis data transformation

Collective Learning in Global Diffusion: Spreading Quality Standards in a Developing Country Cluster

2011 | Organization Science | Citations: 0

Authors: Perez-Aleman, Paola

Abstract: This research analyzes how foreign organizational practices diffuse among indige ... Expand

Abstract: This research analyzes how foreign organizational practices diffuse among indigenous enterprises in a developing economy. It highlights the collective knowledge-building process as central for understanding diffusion. Based on a longitudinal case study of a cluster of dairy producers in Nicaragua, a representative low-income country, it looks at cross-border diffusion in conditions that differ significantly from advanced economies. The current literature that highlights institutional pressures driving global spread of practices has limits for capturing a significant dynamic caused by increased integration of markets and production. By focusing on production organization and practices in a late developing context, this paper explains the intertwined process of spreading new standards and changing existing local practices by elaborating the relationship among building collective capabilities, learning, and standards diffusion. This study enriches current views on institutional effects and adds to the practice-based literature, as well as to the work on developing economy firms in organizational research. Collapse

Topics: communities of practice manufacturing information system organization learning accounting ISO 9000

Methods: qualitative interview field study longitudinal research case study triangulation

Theories: organizational theory

Behind the Iron Cage: An Institutional Perspective on ISO 9000 Adoption and CEO Compensation

2011 | Organization Science | Citations: 3

Authors: Yeung, Andy C. L.; Lo, Chris K. Y.; Cheng, T. C. E.

Abstract: Although institutional theorists maintain that the widespread diffusion of ISO 9 ... Expand

Abstract: Although institutional theorists maintain that the widespread diffusion of ISO 9000 is the result of institutional forces, they have neglected the potential gains to top management in the perpetuation of the standard. Based on a long-horizon event study with control firms to detect long-term abnormal financial gains, we investigate the impact of ISO 9000 adoption on CEO compensation in the U.S. manufacturing industry from 1994 to 2006. We find that the CEOs' total cash compensation was positively adjusted when their firms received ISO 9000 certification, and they received higher-value stock options when their firms embarked on ISO 9000 certification. However, the performance of the ISO 9000 certified firms was not improved throughout this period. Our further analyses suggest that it is likely that the CEO influences the board to obtain higher compensation under an institutionalized environment. Contrary to the traditional institutional theory-based view, we argue that a highly institutionalized environment does provide political opportunities for organizational actors to garner personal advantages. Collapse

Topics: ISO 9000 organizational productivity financial performance database system organizational innovation

Methods: longitudinal research event study logarithmic transformation experimental group descriptive statistic

Theories: institutional theory

Near-Term Liability of Exploitation: Exploration and Exploitation in Multistage Problems

2009 | Organization Science | Citations: 0

Authors: Fang, Christina; Levinthal, Daniel

Abstract: The classic trade-off between exploration and exploitation reflects the tension ... Expand

Abstract: The classic trade-off between exploration and exploitation reflects the tension between gaining new information about alternatives to improve future returns and using the information currently available to improve present returns. By considering these issues in the context of a multistage, as opposed to a repeated, problem environment, we show that exploratory behavior has value quite apart from its role in revising beliefs. We show that even if current beliefs provide an unbiased characterization of the problem environment, maximizing with respect to these beliefs may lead to an inferior expected payoff relative to other mechanisms that make less aggressive use of the organization's beliefs. Search can lead to more robust actions in multistage decision problems than maximization, a benefit quite apart from its role in the updating of beliefs. Collapse

Topics: business process management problem solving decision making new product development innovation management

Methods: simulation

A design theory for managing software process improvement

2009 | DESRIST | Citations: 1

Authors: Pries-Heje, Jan; Baskerville, Richard

Abstract: This article summarizes a management design theory in the form of technological ... Expand

Abstract: This article summarizes a management design theory in the form of technological rules for software process improvement. A general model of the improvement recommendation process can include four elements: agenda, observation, analysis and synthesis. This model supports a design theory in the form of technological rules for each of the four elements. This design theory is useful as a framework in which practitioners can better manage their software process improvement process through more precise orientation of their organization and their goals. Collapse

Topics: ISO 9000 Six Sigma balanced scorecard software process improvement

Methods: synthesis design methodology design theory

Theories: management theory

Corporate Greening Through ISO 14001: A Rational Myth?

2007 | Organization Science | Citations: 8

Authors: Boiral, Olivier

Abstract: The process used by organizations to integrate the ISO 14001 standard has not ye ... Expand

Abstract: The process used by organizations to integrate the ISO 14001 standard has not yet been the subject of extensive research in environmental management despite the rapid development of this standard, particularly in industrial companies. The results of a case study conducted among nine ISO 14001 certified Canadian organizations showed that adopting this standard tends to lead to a ceremonial behaviour intended to superficially show that the certified organizations conformed to the standard. Although rigorous compliance with the standard often resulted in real improvements, these improvements were primarily technical and administrative in nature. However, in most of the cases studied, daily practices remained somewhat decoupled from the prescriptions of the ISO 14001 system, of which employees generally had only a vague understanding. The organizations studied adopted different strategies to reconcile external pressures in favour of adopting this standard and internal constraints associated with a management system whose support varied from one case to the next. While the standard often appeared to be some sort of "rational myth" (Meyer and Rowan 1977) to which organizations superficially committed themselves, the adaptation to institutional pressures was not necessarily straightforward. Using the example of the ISO 14001 standard, our study helps to show how this myth can be integrated, transformed, and even created through rhetoric by organizations to resolve certain contradictions. This research also illustrates how adopting the ISO 14001 system can have an ambiguous effect on environmental management practices and performances. Collapse

Topics: ISO 9000

Methods: qualitative interview case study grounded theory literature study company material

Making Sense of Institutionalizing Information Systems Security Management in Organizations

2007 | International Conference on Information Systems | Citations: 4

Authors: Hsu, Carol

Abstract: Information Systems (IS) security management has gained renewed importance for t ... Expand

Abstract: Information Systems (IS) security management has gained renewed importance for the past few years resulting from the rising numbers of security incidences and compliance pressure. While majority of IS security research has been focusing on the technical value and the effectiveness of IS security implementation, studies on the organizational process of implementation is rather limited. This paper employs a socio-cognitive perspective to examine the sense-making process of IS security BS 7799 Part 2 certification among different stakeholder groups in the organization. Using a qualitative case study approach, the findings reveal different understandings on the strategy and consequence of IS security implementation. We argue that socio-cognitive perspective, in particular the concept of frames analysis, can act an analytical tool to interpret meanings and anticipate actions in managing IS security in organizations. Collapse

Topics: information security management security policy IT security sensemaking analytical information system

Methods: qualitative interview field study case study

Theories: technological frames of reference institutional isomorphism theory

How To Build Enterprise Data Models To Achieve Compliance To Standards Or Regulatory Requirements (and share data)

2007 | Journal of the Association for Information Systems | Citations: 5

Authors: Kim, Henry M.; Fox, Mark S.; Sengupta, Arijit

Abstract: Sharing data between organizations is challenging because it is difficult to ens ... Expand

Abstract: Sharing data between organizations is challenging because it is difficult to ensure that those consuming the data accurately interpret it. The promise of the next generation WWW, the semantic Web, is that semantics about shared data will be represented in ontologies and available for automatic and accurate machine processing of data. Thus, there is interorganizational business value in developing applications that have ontology-based enterprise models at their core. In an ontology-based enterprise model, business rules and definitions are represented as formal axioms, which are applied to enterprise facts to automatically infer facts not explicitly represented. If the proposition to be inferred is a requirement from, say, ISO 9000 or Sarbanes-Oxley, inference constitutes a model-based proof of compliance. In this paper, we detail the development and application of the TOVE ISO 9000 Micro-Theory, a model of ISO 9000 developed using ontologies for quality management (measurement, traceability, and quality management system ontologies). In so doing, we demonstrate that when enterprise models are developed using ontologies, they can be leveraged to support business analytics problems - in particular, compliance evaluation - and are sharable. Collapse

Topics: ISO 9000 knowledge representation quality management Sarbanes–Oxley Act analytical information system

Methods: ontological modelling design artifact data modeling case study qualitative interview