An Information Security Performance Measurement Tool for Senior Managers: Balanced Scorecard Integration for Security Governance and Control Frameworks

2023 | Information Systems Frontiers | Citations: 0

Authors: Herath, Tejaswini C.; Herath, Hemantha S. B.; Cullum, David

Abstract: As organizations have become increasingly reliant on information systems, senior ... Expand

Abstract: As organizations have become increasingly reliant on information systems, senior managers are keen in assessing the progress of implemented information security strategies. Although the balanced scorecard approach has been suggested for security governance, a critical issue affecting information security practitioners is complexity, as there are many standards and frameworks, with duplication and overlaps to adhere to when organizing the data. Consequently, the article attempts to develop a more inclusive framework for information security governance, a research gap recently identified in the literature. The article maps five governance and control frameworks (COBIT, SABSA, ISG, ITIL, and ISO 27000) to the information security balanced scorecard (InfoSec BSC) to develop a conceptual design of an effective information security performance measurement tool that can be used by senior managers. Using a real-life case application and interviews with a panel of experts, the article identifies IS initiatives, performance measures for each of the mapped objectives derived from governance and control frameworks that may provide guidance for practitioners. Collapse

Topics: data security COBIT IT security ITIL information security management

Methods: qualitative interview case study personal interview survey delphi study

Theories: theory of everything

Key Factors in Achieving Service Level Agreements (SLA) for Information Technology (IT) Incident Resolution

2023 | Information Systems Frontiers | Citations: 0

Authors: Swain, Ajaya K.; Garza, Valeria R.

Abstract: In this paper, we analyze the impact of various factors on meeting service level ... Expand

Abstract: In this paper, we analyze the impact of various factors on meeting service level agreements (SLAs) for information technology (IT) incident resolution. Using a large IT services incident dataset, we develop and compare multiple models to predict the value of a target Boolean variable indicating whether an incident met its SLA. Logistic regression and neural network models are found to have the best performance in terms of misclassification rates and average squared error. From the best-performing models, we identify a set of key variables that influence the achievement of SLAs. Based on model insights, we provide a thorough discussion of IT process management implications. We suggest several strategies that can be adopted by incident management teams to improve the quality and effectiveness of incident management processes, and recommend avenues for future research. Collapse

Topics: missing data analytical information system ITIL corporate network security logistics management

Methods: support vector machine artificial neural network machine learning regression analysis method logistic regression

Theories: information systems theory

Designing a Thrifty Approach for SME Business Continuity: Practices for Transparency of the Design Process

2022 | Journal of the Association for Information Systems | Citations: 6

Authors: Järveläinen, Jonna; Niemimaa, Marko; Zimmer, Markus

Abstract: Business continuity (BC) management is an organizational approach to preparing ... Expand

Abstract: Business continuity (BC) management is an organizational approach to preparing information systems (IS) for incidents, but such approaches are uncommon among small and medium-sized enterprises (SMEs). Past research has indicated a gap in approaches that are designed for SMEs since BC management approaches tend to originate from larger organizations and SMEs lack the resources to implement them. To fill this gap, and to respond to a practical need by an IT consultancy company, we employed design science research (DSR) to develop a BC approach for SMEs coined as the thrifty BC management approach. Jointly with the company's practitioners, we developed a set of metarequirements for BC approaches for SMEs anchored in prior BC literature, practitioners' practical expertise, and the theories of collective mindfulness and sociotechnical systems. We evaluated our thrifty BC management approach with multiple SMEs. These evaluations suggest that the designed approach mostly meets the defined meta-requirements. Moreover, the evaluations offered ample opportunities for learning. The design process, unfolding in a real-world setting, was precarious, rife with contingencies and ad hoc decisions. To render the design process transparent, we adapted four writing conventions from the confessional research genre familiar to ethnographic research but novel to DSR. We offer a threefold contribution. First, we contribute to SMEs' BC with meta-requirements and their instantiation in a new BC approach (artifact); second, we contribute with four practices of confessional writing for transparency of DSR research; and third, we contribute with reflections on our theoretical learning from throughout the design process.Marko Niemimaa is an associate professor at the University of Agder and an adjunct professor at the University of Turku. His research focuses on the organizational aspects and implications of cybersecurity and philosophical aspects of IS research, including sociomateriality. His work has been published in top-tier IS outlets, such as Collapse

Topics: mindfulness business continuity planning business process management decision making pseudonymity

Methods: design process design artifact design theory design requirement ethnography

Theories: sociotechnical systems theory socio technical theory

Demystifying Job Roles in Data Science: A Text Mining Approach

2021 | European Conference On Information Systems | Citations: 16

Authors: Michalczyk, Sven; Nadj, Mario; Maedche, Alexander; Gröger, Christoph

Abstract: The continuing proliferation of data science these days is causing organization ... Expand

Abstract: The continuing proliferation of data science these days is causing organizations to reassess their workforce demands. Simultaneously, it is unclear what types of job roles, knowledge, skills, and abilities make up this field and how they differ. This ambiguity is generating a misleading myth around the Data Scientist's role. Against this background, this paper attempts to provide clarity about the heterogeneous nature of job roles required in the field of data science by processing 25,104 job advertisements published at the online job platforms Indeed, Monster, and Glassdoor. We propose a text mining approach combining topic modeling, clustering, and expert assessment. Therefore, we identify and characterize six job roles in data science that are in a request by organizations, described by topics classified in three major knowledge domains. An understanding of job roles in data science can help organizations in acquiring and cultivating job roles to leverage data science effectively. Collapse

Topics: software developer problem solving quality management cloud computing marketing management

Methods: cluster analysis topic model natural language processing literature study term frequency–inverse document frequency

Process reference frameworks as institutional arrangements for digital service innovation

2020 | International Journal of Information Management | Citations: 7

Authors: Iden, Jon; Eikebrokk, Tom Roar; Marrone, Mauricio

Abstract: Information systems (IS) service organizations are increasingly more concerned w ... Expand

Abstract: Information systems (IS) service organizations are increasingly more concerned with their ability to co-create digital services with customers in service ecosystems. Practitioners and researchers, however, lack understanding of which organization mechanisms effectively contribute to IS organizations’ innovation practices. Grounded in service-dominant logic, we hypothesized that process reference frameworks (PRFs), such as the IT Infrastructure Library (ITIL), act as institutional arrangements through their norms, rules, and practices, enhancing IS organizations’ ability to innovate digital services. Data collected from 159 IS organizations confirmed our hypotheses, showing that effects on digital service innovation are mediated by an organization’s digital service climate and co-creation practices. This study makes four major contributions. First, our results contribute to the literature on service-dominant logic and the role of institutional arrangements in facilitating service innovation in service ecosystems. Second, our study offers a novel understanding of PRFs’ role in value cocreation and digital service innovation. Third, by introducing the digital service climate from existing theoretical frameworks that might assist in conceptualizing the role of culture and shared meaning, our study contributes to further theorizing on the social factors that influence service ecosystem practices. Finally, our findings can motivate IT managers to consider using PRFs to develop capabilities for creating business value together with customers. Collapse

Topics: ITIL innovation management digital service business process innovation participatory design

Methods: design methodology survey statistical hypothesis test experiment theory development

Theories: service-dominant logic actor network theory

Benchmarking Methodology for Information Security Policy (BMISP): Artifact Development and Evaluation

2020 | Information Systems Frontiers | Citations: 3

Authors: Kang, Martin (Dae Youp); Hovav, Anat

Abstract: The benchmarking of information security policies has two challenges. Organizati ... Expand

Abstract: The benchmarking of information security policies has two challenges. Organizations are reluctant to share data regarding information security and no two organizations are identical. In this paper, we attempt to propose an artifact for a benchmarking method of information security policy, which can resolve the above challenges. We employ design science methodology, activity theory and international standards to design the artifact as a proof of concept. The artifact facilitates the implementation of efficient information security policies. Organizations can utilize the artifact to analyze and benchmark information security policies. We illustrate the completeness and reliability of the artifact through a case study using information security policies from six companies. Collapse

Topics: security policy data security extensible markup language digital rights management ITIL

Methods: design artifact case study data modeling design science meta design

Theories: activity theory

Development and evaluation of a software-mediated process assessment method for IT service management

2020 | Information & Management | Citations: 0

Authors: Shrestha, Anup; Cater-Steel, Aileen; Toleman, Mark; Behari, Suren; Rajaeian, Mohammad Mehdi

Abstract: IT service improvements can add immense value to organisations. To improve IT se ... Expand

Abstract: IT service improvements can add immense value to organisations. To improve IT service management (ITSM) processes, a software-mediated process assessment method is proposed with four phases: process identification, process assessment, process capability measurement and process improvement. The international standard for process assessment was applied to measure process capability. This method was trialled at two Australian organisations and positively evaluated in a US foreign exchange trading business. Our empirical evidence challenges the underlying assumption that higher levels of process capability depend on the achievement of lower level process attributes. We conclude that this method can be applied to transparently self-assess processes. Collapse

Topics: business process improvement decision support system usability system quality ITIL

Methods: survey design principle focus group group interview maturity model

Theories: SERVQUAL

Evolutional and Transformational Configuration Strategies: A Rasch Analysis of IT Providers’ Service Management Capability

2020 | Journal of the Association for Information Systems | Citations: 0

Authors: Wulf, Jochen; Winkler, Till

Abstract: While providers of information technology (IT) services widely rely on reference ... Expand

Abstract: While providers of information technology (IT) services widely rely on reference models for IT service management (ITSM) practices, little is known about the actual configurations of these practices, referring to the patterns in which service providers adopt these practices at different maturity stages. We analyze how practice configurations reflect a provider’s ITSM capability and how this capability contributes to provider performance. This study addresses two gaps in the ITSM literature. First, empirical approaches to measuring a capability that manifests in configurations of ITSM practices and potentially different nonlinear configuration strategies are missing. Second, no theory explaining the resulting performance differences of alternative configuration strategies exists. We analyzed data from 315 IT service providers on the configuration of practices described in the widely regarded ITIL (formerly IT Infrastructure Library) reference model for ITSM. With this data, we conducted a Rasch calibration—a psychometric method for modeling latent traits based on noninterval scaled data—to measure practice maturity thresholds and providers’ ITSM capability on the same scale. Further, we regressed this measure of ITSM capability on service provider performance. Our findings contribute to the ITSM literature by uncovering two strategies for configuring ITSM practices with distinct capability scales. Drawing on prior theory, we characterize these as evolutionary and transformational configuration strategies. Service providers in the transformational class obtain higher performance gains from building ITSM capability than those in the evolutionary class. This supports our key argument that underlying practice complementarities are a key source of performance gains. Collapse

Topics: ITIL business process innovation innovation management IT service management anonymity

Methods: reference modelling survey regression analysis method theory development survey design

Designing Process Guidance Systems

2019 | Journal of the Association for Information Systems | Citations: 7

Authors: Morana, Stefan; Kroenung, Julia; Maedche, Alexander; Schacht, Silvia

Abstract: Process knowledge is a vital prerequisite for employees to execute organizationa ... Expand

Abstract: Process knowledge is a vital prerequisite for employees to execute organizational processes successfully in the course of their daily work. However, the lack of process knowledge, especially concerning novice users, and the need for support pose a challenge to employers. Inspired by research on spatial knowledge and navigation, we conceptualize three process knowledge types addressing the needs of employees during their process execution. On the basis of these process knowledge types, we derive three theoretically grounded design principles for process guidance systems to support employees’ process execution. We instantiate the design principles and evaluate the resulting artifacts in a laboratory experiment and in a subsequent field study. The results demonstrate the positive effects of process guidance systems on users’ process knowledge and process execution performance. Our study contributes to research and practice by proposing a new conceptualization of process knowledge and a nascent design theory for process guidance systems that builds on theories of spatial knowledge and navigation, as well as decision support research. Collapse

Topics: decision support electronic mail business process management knowledge type anonymity

Methods: experiment field study survey laboratory experiment design artifact

Continual Process Improvement for ITIL Service Operations: A Lean Perspective

2019 | Information Systems Management | Citations: 0

Authors: Obwegeser, Nikolaus; Nielsen, Daniel T.; Spandet, Nicklas M.

Abstract: IT service management (ITSM) practitioners recognize the need for continuous imp ... Expand

Abstract: IT service management (ITSM) practitioners recognize the need for continuous improvement of IT services. Using a design science research approach, we develop a five – step process improvement framework for ITIL (Information Technology Infrastructure Library) service operations, based on the use of the Lean toolset. The proposed framework offers a structured approach for process improvement in practice and a basis for more systematic research. Collapse

Topics: ITIL business process improvement knowledge base anonymity IT manager

Methods: survey qualitative interview case study design science design artifact