Managing the introduction of information security awareness programmes in organisations

2015 | European Journal of Information Systems | Citations: 30

Authors: Tsohou, Aggeliki; Karyda, Maria; Kokolakis, Spyros; Kiountouzis, Evangelos

Abstract: Several studies explore information security awareness focusing on individual an ... Expand

Abstract: Several studies explore information security awareness focusing on individual and/or organisational aspects. This paper argues that security awareness processes are associated with interrelated changes that occur at the organisational, the technological and the individual level. We introduce an integrated analytical framework that has been developed through action research in a public sector organisation, comprising actor-network theory (ANT), structuration theory and contextualism. We develop and use this framework to analyse and manage changes introduced by the implementation of a security awareness programme in the research setting. The paper illustrates the limitations of each theory (ANT, structuration theory and contextualism) to study multi-level changes when used individually, demonstrates the synergies of the three theories, and proposes how they can be used to study and manage awareness-related changes at the individual, organisational and technological level. Collapse

Topics: data security electronic mail security policy cybersecurity awareness organization structure

Methods: action research survey qualitative interview theory development mixed method

Theories: structuration theory actor network theory