Relationship between Corporate Governance and Information Security Governance Effectiveness in United States Corporations

Relationship between Corporate Governance and

Information Security Governance Effectiveness in

United States Corporations

Section 1: Foundation of the Study

Background of the Problem

Given the global business environment, information technology (IT) deployments

are indispensable for enabling information reliability, processing efficiency, and

communication expediency to acquire and maintain a competitive advantage (Masa’deh,

2013). Because information has measurable value (Hughes, Bon, & Rapp, 2013; Mishra

& Mohanty, 2014), data collection, processing, storage, and transmission by

organizational employees need appropriate safeguarding (Ahmad, Maynard, & Park,

2014). Safeguarding information mandates addressing information assets protection

(IAP) to ensure managerial due care and due diligence (Mohare & Lanjewar, 2012; R.

Davis, 2008).

Stemming from fiduciary responsibilities, an IT leader’s information systems

related due care is what drives appropriate information security due diligence activities

(Boyson, 2014; R. Davis, 2008; Whitman & Mattord, 2012). Instituting and sustaining

information safeguarding requires a comprehensive organizational program to address

cyber threats that can thwart organizational mission achievement (Ahmad et al., 2014;

Kushwaha, 2016; Mohare & Lanjewar, 2012). Though information security breaches can

emanate from external or internal actions (Crossler et al., 2013; Silic & Back, 2014),

enterprise IT leaders should ensure ethical behavior by every individual interacting with

the organization’s information systems through effectual information security governance

(ISG; Boyson, 2014). However, several significant information security breaches have

decreased corporate value appropriation (Clark & Harrell, 2013; Silic & Back, 2014).

Problem Statement

With cyber attackers targeting large corporations achieving a 93% success rate

during 2013 (Brewer, 2014), IT leaders needed to improve ISG practices (Silic & Back,

2014). Near the end of 2013, the average annualized cybercrime cost of globally surveyed

industry sectors was $7.22 million per organization (Brewer, 2014). The general business

problem is that many corporations are incurring financial losses due to information

security breaches. The specific business problem is that some IT leaders do not know the

relationship between strategic alignment, resource management, risk management, value

delivery, performance measurement implementations, and ISG effectiveness in United

States-based corporations.

Purpose Statement

The purpose of this quantitative correlational study was to examine the

relationship between strategic alignment, resource management, risk management, value

delivery, performance measurement implementations, and ISG effectiveness in United

States-based corporations. The targeted population consisted of strategic and tactical

leaders of the 500 largest for-profit United States headquartered corporations. The

predictor variables were strategic alignment, resource management, risk management,

value delivery, and performance measurement implementations. ISG effectiveness was

the criterion variable. The implications for positive social change include the potential to

understand the correlates of ISG effectiveness better, thus increasing the propensity for

consumer trust and reducing consumers’ costs.

Nature of the Study

I used a quantitative method for this study. Researchers use the quantitative

method to compare group differences or examine the relationship between variables

(Frels & Onwuegbuzie, 2013; Ross & Onwuegbuzie, 2014; Welford, Murphy, & Casey,

2012). The quantitative method was more appropriate than qualitative or mixed methods

because the focus of the study was to analyze numerical data and infer the results to a

larger population. A researcher’s qualitative or mixed methods analysis involves

considering words to understand the meaning of human actions (Masa’deh, Maqableh, &

Karajeh, 2014; Parylo, 2012; Turner, Balmer, & Coverdale, 2013; Welford et al., 2012).

I used a correlational research design. Correlational research enables clarifying or

discovering the relationships between variables (Turner et al., 2013). My intention was to

identify and examine factors potentially predicting effective ISG, by assessing the ISG

implementation extents within five IT Governance Institute (ITGI; 2008) ISG focus areas.

Experimental designs (true experiment and quasiexperiment approaches) were

inappropriate because I was not collecting data from more than one group, not performing

group comparisons among variables, and not seeking a cause-and-effect relationship

between variables.

Research Question

What is the relationship between strategic alignment, resource management, risk

management, value delivery, performance measurement implementations, and ISG

effectiveness in United States-based corporations?

Hypotheses

Null Hypothesis (H0): There is no significant relationship between strategic

alignment, resource management, risk management, value delivery, performance

measurement implementations, and ISG effectiveness in United States-based

corporations.

Alternative Hypothesis (H1): There is a significant relationship between strategic

alignment, resource management, risk management, value delivery, performance

measurement implementations, and ISG effectiveness in United States-based

corporations.

Theoretical Framework

To implement ISG focus areas effectively, practices for large organizations should

reflect corporate governance theoretical principles (De Haes, Grembergen, & Debreceny,

2013; Kearney & Kruger, 2013). Corporate governance by definition is the objectives,

strategies, policies, and processes for controlling and directing an enterprise (Kearney &

Kruger, 2013; Whitman & Mattord, 2012; Yaokumah, 2013). Corporate governance can

constitute a set of rules (Yaokumah & Brown, 2014) or voluntary as well as mandatory

actions (Stagliano & Sillup, 2014) governing the relationships between management and

stakeholders. Essential constructs underlying the theory are (a) strategic alignment, (b)

resource management, (c) risk management, (d) value delivery, and (e) performance

measurement (Yaokumah, 2013; Yaokumah & Brown, 2014). As applied to this study,

the corporate governance theory holds that I would expect the predictor variables

(corporate governance constructs) measured by the Yaokumah (2013) survey instruments

to forecast ISG effectiveness because ISG is a functional subset of corporate governance.

As shown in Figure 1, corporate governance theory is relevant in defining the

constructs that help evaluate ISG because corporate governance theory offers a lens for

understanding the organizational practices concerning the phenomenon (Yaokumah,

2013). Corporate governance theory application by manager-leaders can affect ISG

practices because management concepts address accountability, roles, interactions,

activities, and resource use of agents (Yaokumah, 2013). Scholars and practitioners apply

corporate governance theory to understand variations in policies, setting priorities among

goals, technological and social changes, and managerial hierarchies (Starbuck, 2014). A

contextual discussion will take place in the following literature review subsections

concerning ISG practices that support corporate governance theory and how corporate

governance theory relates to ISG effectiveness.

Figure 1. The ISG research theoretical lens. A graphical model of corporate governance

theory constructs as it applies to examining effectual ISG.

Operational Definitions

Corporate governance: Corporate governance is a system enabling firms to

strategically direct, integratively manage, and holistically control in an entrepreneurial

and ethical manner appropriate for each particular context (Hilb, 2012).

Effectual information security governance (effectual ISG): Effectual ISG is the

extent to which enterprise leaders ensure information security strategic alignment, value

delivery, risk management, performance measurement, and resource management to meet

stakeholder expectations (Yaokumah, 2014).

Information assets: Information assets are items of value that contain data (R.

Davis, 2012).

Information security: Information security is the protection of information and

information systems from unauthorized access, use, disclosure, disruption, modification,

or destruction (Da Veiga & Martins, 2015; R. Davis, 2012).

Information security governance (ISG): ISG is “a subset of enterprise governance

that provides strategic direction, ensures that objectives are achieved, manages risks

appropriately, uses organizational resources responsibly, and monitors the success or

failure of the enterprise security [program]” (ITGI, 2008, p. 18).

Performance measurement: Performance measurement involves quantifying,

monitoring, and reporting the performance of information security systems, processes,

and related activities to ensure achievement of organizational objectives (ITGI, 2008).

Resource management: Resource management represents the intention for optimal

investment in and the proper administration of information security resources by

manager-leaders (Mohare & Lanjewar, 2012; R. Davis, 2008; Yaokumah, 2013).

Risk management: Risk management reflects principles, approaches, and

processes using systematic application (Rasheed, ChangFeng, & Yaqub, 2015).

Strategic alignment: Strategic alignment centers on ensuring enterprise, IT, and

information security plan linkage; defining, maintaining, and validating the information

security value proposition; and information security operational congruence with business

and IT operations (R. Davis, 2008).

Value delivery: Value delivery represents executing the information security value

proposition throughout the delivery cycle and ensuring information security delivers

asseverated benefits against adopted enterprise strategies (R. Davis, 2008).

Assumptions, Limitations, and Delimitations

Assumptions

Assumptions represent unverified values, time, or space perceptions

(Bhattacherjee, 2012; Roy & Pacuit, 2013). Scholars and practitioners have abstracted

that information security is no longer primarily a technical issue requiring handling solely

by operational IT personnel but rather more of a governance concern (Julisch, 2013a;

Mohare & Lanjewar, 2012; Whitman & Mattord, 2012). Yaokumah (2013) recommended

addressing IAP at the governance level to mitigate organizational technology risks. I

accepted this assumption to be true and attempted to omit operational-level management

from data collection and analysis while investigating effectual ISG at the strategic and

tactical management levels.

Information security strategic planning involves some planning aspects common

to the entire organization (Whitman & Mattord, 2012). In particular, the information

security planning process should include ensuring the establishment of a mission, vision,

and values statement. Upon long-term goals and objectives creation and subsequent

strategic plans translation into tactical and operational plans, operationalization occurs

(Whitman & Mattord, 2012). Regarding strategic planning, I assumed management’s

business environment risk assessments would determine information security

implementation criticality in the United States.

Data collection occurred through the Internet for this doctoral study. Internetbased

survey use enables study participants to complete posed questions through computer

network access (Chang & Vowles, 2013). Internet-based survey use should only prevail if

the proposed study participants have access and understand the employed data collection

technologies (Yaokumah, 2013). I assumed the intended participants had access to and

familiarity with Internet.

Limitations

Limitations reflect potential study weaknesses (Bhattacherjee, 2012; Brutus,

Aguinis, & Wassmer, 2013; S. Singh, 2015). My survey response rate was extremely low

as a result of the sensitive nature of the ISG study. Previous survey-based research

evidence suggested that when collecting data of a sensitive nature, the researcher should

expect a very low response rate (Flores, Antonsen, & Ekstedt, 2014; Yaokumah, 2013).

The sample selection for the ISG study comprised broad population subcategories

(United States business sector types). As such, my research findings might be

generalizable to the target population IT leaders.

Delimitations

Delimitations are ambit restrictions in theory application (Bhattacherjee, 2012;

Denscombe, 2013). My study ambit was ISG deployments in the United States to assist

large corporation strategic- and tactical-level leaders in the enhancement of new and

existing information security programs. I focused the study on examining the level to

which IT leaders implement strategic alignment, resource management, risk management,

value delivery, and performance measurement in generating effectual ISG that prevents

and deters information security breaches.

I excluded for-profit small and medium enterprises (SMEs). However, for-profit

SMEs proportionately confront information security issues (Cholez & Girard, 2014;

Harris & Patten, 2014). Because most for-profit SMEs do not have the human and

financial resources to deploy ISG practices (Cholez & Girard, 2014; Harris & Patten,

2014), I did not include SMEs in the study. Nonetheless, for-profit SME managers who

plan to install or have implemented an ISG program may use my study findings for

understanding the correlates of ISG effectiveness and associated guidelines.

I excluded not-for-profit organizations. Because for-profit corporate

organizational formations occur to generate tangible and intangible wealth for

stakeholders while not-for-profit organizations occur to satisfy perceived societal needs

(R. Davis, 2008), nonprofit enterprises were not included in the study. Despite the

organizational formation difference, nonprofit manager-leaders who are planning

deployment or who have deployed an ISG program may use my study findings for

understanding the correlates of ISG effectiveness and associated guidelines.

I excluded operational-level management. Operational-level management

oversees the day-to-day information security related tasks in most organizations, and their

inclusion in the study might have brought some significant perspectives on the ISG

research findings (Yaokumah, 2013). However, operational-level management exclusion

from the study reflected an assumption that effectual ISG is a strategic and tactical

concern more than an operational issue (Yaokumah, 2013). As such, my random

participant sample only included strategic- and tactical-level managers.

Significance of the Study

Contribution to Business Practice

The contributions to business practice were an improvement in ISG practice areas

to protect information assets more effectively with a concomitant reduction in recovery

costs. Effectual ISG counteracts security threats through the deployment of controls

enabling ethical and legal managerial responsibilities fulfillment for IAP (R. Davis, 2008;

Tarafdar, D’Arcy, Turel, & Gupta, 2015). Scholars have specifically examined ISG

implementation maturity in developing countries (Yaokumah, 2014; Yaokumah &

Brown, 2014). However, the degree of ISG realization in developed countries has

remained an open question (Flores et al., 2014). The results of this study might help IT

leaders improve ISG practice areas to protect information assets more effectively with a

concomitant reduction in recovery costs.

Implications for Social Change

The implications for positive social change include potential increased trust and

reduced costs from electronic commerce (e-commerce) use. Information security

breaches can have a detrimental effect on stakeholder satisfaction when an incident result

in financial fraud, information tampering, or access denial (Arief, Adzmi, & Gross,

2015). Corporate IT leaders can improve trust for stakeholders in technology containing

personally identifiable information through effectual ISG (R. Davis, 2008). More secure

IT operations can benefit communities through enhanced governance quality that

consequently would increase trust and reduce costs from e-commerce use (Bahmanziari

& Odom, 2015; Ludin & Cheng, 2014; Starbuck, 2014; Yaokumah, 2014).

A Review of the Professional and Academic Literature

Similar to any other group formations, corporations reflect personal aims, values,

expectations, and sentiments that transform into a culture (Hu, Dinev, Hart, & Cooke,

2012). An enterprise’s environment represents all conditions surrounding and affecting

organizational endeavors (R. Davis, 2008). Most corporations operate in an environment

influenced by perceived stakeholder values as well as the firm’s mission, vision, and

values (Hu et al., 2012; R. Davis, 2008). Community and organizational ethics and

culture, applicable laws, regulations, and policies, as well as industry practices, affect

corporate personnel (Hu et al., 2012; R. Davis, 2008).

Managers who interact with the environment endeavor to maintain the corporate

culture while attempting to control external and internal forces affecting activities

committed to enterprise mission achievement (R. Davis, 2008; Steiger, Hammou, &

Galib, 2014). Management typically needs a governance framework that enables

organizational alignment, judicious resource allotment, adaptive risk assessments,

acceptable value delivery, and accurate performance measurements to address business

environment security issues (Mohare & Lanjewar, 2012; R. Davis, 2008). The purpose of

this quantitative correlational study was to examine the relationship between strategic

alignment, resource management, risk management, value delivery, performance

measurement, and ISG effectiveness in United States-based corporations. Considering the

above discussion led to the following central hypotheses:

H0: There is no significant relationship between strategic alignment, resource

management, risk management, value delivery, performance measurement

implementations, and ISG effectiveness in United States-based corporations.

H1: There is a significant relationship between strategic alignment, resource

management, risk management, value delivery, performance measurement

implementations, and ISG effectiveness in United States-based corporations.

Literature Review Synopsis

Corporate governance theory was an appropriate theoretical foundation to study

ISG (Hu et al., 2012; Whitman & Mattord, 2012; Yaokumah & Brown, 2014). The

method used for this research included the foundational governance theory capabilities in

providing holistic corporate ISG practices. The chosen theory was relevant in defining the

constructs that help evaluate ISG because corporate governance propositions furnish an

organizational view and understanding of the phenomenon (Yaokumah, 2013). Deriving

constructs from a previously established and proven theory also aids in measures

selection as well as furnishes a valid and comprehensive phenomenon understanding

(Yaokumah, 2013; Yaokumah & Brown, 2014).

Corporate governance scholars examined management practices, structures,

processes, and effectiveness from distinct theoretical perspectives (Yaokumah & Brown,

2014). Various combinations supporting organizational theories best describe effective

corporate governance (Htay, Salman, & Meera, 2013; Yaokumah, 2013). Scholars have

simultaneously employed institutional, resource-based, social network, and stakeholder

theories (e.g., Varsei, Soosay, Fahimnia, & Sarkis, 2014), as well as agency and

stewardship theories (e.g., Turel & Bart, 2014), to explain governance implications. Thus,

selected supporting conceptualizations have relevance in determining constructs that help

evaluate ISG effectiveness due to delineated organizational lens and phenomenon

cognitions (Yaokumah, 2013).

Scholarly researchers have referred to security program management as the ISG

focal point (Silic & Back, 2014). ISG studies typically investigate organizational

programs from any of four abstractions: strategy and information security policy,

governance structure, frameworks and standards, or information security advisory (Silic

& Back, 2014). Strategy and information security policy research has focused on

determining how organizations implement security design to protect their information

systems (Ahmad et al., 2014). Governance structure studies have centered on designed

tasks and deployed technology. Information security advisory studies offered suggestions

about the best course of action. Frameworks and standards addressed defining and

providing insights contextually related to security governance (Silic & Back, 2014).

These studies revealed abstractions considered by academia as relevant to realizing

effectual ISG.

Literature Review Sources

Researchers applied quantitative, qualitative, and mixed methods to explore,

describe, or explain information security related theories and practices (Silic & Back,

2014). I have included commentary from multiple sources, including journal articles,

throughout the literature review by comparing viewpoints while focusing on the purpose

of the study. Through scholarly bibliographic coupling (Pautasso, 2013), no more than

15% of the cited material was older than 5 years from the anticipated study completion

date. Therefore, considering the doctoral study completion date, the presented

information was recent, relevant, and credible. Table 1 summarizes the sources used in

this literature review.

Table 1

Summary of Research Sources in Literature Review

Reference type Total Less than 5

years

Total

percentage

Peer-reviewed journal articles 194 170 88

Doctoral dissertations/studies 6 5 83

Contemporary books 4 1 25

Total 204 176 86

Literature Review Organization and Strategy

A researcher gains insight into a selected topic when performing an initial

academic literature review several ways (Jaffe & Cowell, 2014). Nonetheless, the

academic literature search process is a primary study quality determinant (Jaffe &

Cowell, 2014). When writing a literature review, the goal is to reconstruct the relevant

accumulated knowledge in a particular subject domain (Schryen, 2013). A literature

search represents the first fundamental step in building the accumulated knowledge and

principally defines reconstruction in the subsequent literature analysis (Jaffe & Cowell,

2014; Wahl & Bull, 2013). My academic research for this doctoral study focused on

articles published in peer-reviewed journals, dissertations, and related doctoral studies as

well as subject-related books. The literature search strategy to obtain the best possible

periodical outcome used procedures suggested by Silic and Back (2014).

I applied a systematic literature review approach for online periodical

interrogation that consisted of a four-step process: journal, database, keywords, and

citation chaining (backward as well as forward) searches. My exploration of academic

journals included the leading periodicals in the field of information security dating back

to the early 2000s. My exploration of databases encompassed the leading digital libraries

providing access to the preeminent journals. As for keyword searches, my queries

commenced with the previously identified databases. My backward search entailed

reviewing article references generated from the keyword queries and a forward search

required examining additional sources that had cited the articles.

My literature review search for corporate ISG within the United States of America

encompassed defining various combinations of keywords. Given the topic, selected

descriptors in developing keywords included information systems (IS), information

technology (IT), as well as information and communication technology (ICT) acronyms

based on commonality of use. Thus, concerning defining keywords, my study search list

included IS security, IT security, and ICT security. Additionally, my selected search

phrases were corporate governance, information security governance, information

security, cybersecurity governance, cybersecurity, and information technology

governance.

As shown in Figure 2, I presented separate discussions on corporate governance

and ISG theories as well as practices within the doctoral study literature review.

Considering research performed by Yaokumah (2013, 2014) as well as Yaokumah and

Brown (2014), my literature review included relevant studies related to the relationship

between strategic alignment, value delivery, risk management, performance

measurement, resource management, and effectual ISG. Based on Yaokumah’s (2013)

and Yaokumah and Brown’s (2014) research, I also covered stakeholder theories, agency

theories, and resource-based theories explaining corporate governance in the literature

review. Moreover, subjects I referred to in this literature review included information

theories and decision theories linked to ISG.

Figure 2. Corporate ISG literature review organization.

Corporate Governance

Corporate governance is a significant factor influencing firm performance

(AlAzzam, Al-Qura'an, & Al-Mohameed, 2015; Alnaser, Shaban, & Al-Zubi, 2014;

Tseng, Wu, & Lin, 2013) that consequently leads to firm valuation (Mishra & Mohanty,

2014).

Corporate governance also lacks a singularly accepted theoretical foundation (Htay et al.,

2013; L'Huillier, 2014; Pande & Ansari, 2014; Sachdeva, 2014). However, most scholarly

researchers supported studies by following prominent theories to explain corporate

governance determinants (L'Huillier, 2014; Yaokumah & Brown, 2014).

Corporate governance savants examined governance structures, processes,

practices, and effectiveness using various theoretical lenses (Yaokumah & Brown, 2014).

These theoretical perspectives include stakeholder theory (e.g., Abraham, 2012; J.

Harrison & Wicks, 2013), agency theory (e.g., Heracleous & Lan, 2012; Raelin & Bondy,

2013), and resource-based theory (e.g., Turel & Bart, 2014). Notwithstanding other

theories are applicable in deriving constructs for an ISG study, the stakeholder, agency,

and resource-based theories have a significant potential influence on achieving effectual

ISG practices (Yaokumah & Brown, 2014).

Researchers presented stakeholder theory as recognizing constituencies other than

shareholders with legitimate concerns and claims regarding corporations (Heracleous &

Lan, 2012). Corporate governance theoretically furnishes internal and external control

mechanisms to protect stakeholders (Sachdeva, 2014). Miles (2012) explored whether the

lack of stakeholder theory consensus was conceptual confusion, or the stakeholder

concept was foundationally contestable. For this, Miles obtained research data through a

literature review. Miles uncovered significant evidence to classify the stakeholder

concept as both inherently contestable and essentially contested. Correspondingly, the

research benefits included demonstrating the stakeholder concept is a complex construct

(Miles, 2012).

Modern corporate governance has emphasized financial aspects of increasing

shareholder value and an integrated approach that considers the rights and interests of all

stakeholders (Hilb, 2012). Leadership, stewardship, ethics, security, vision, direction,

influence, and values are prominent corporate governance components enabling the flow

of stakeholder expectations (Flores et al., 2014; R. Davis, 2008). The integrated corporate

governance perspective focuses on stakeholder value protection as well as shareholder

value creation and enhancement (Heracleous & Lan, 2012; Hilb, 2012). Corporate

governance conceptualizations should reflect a dynamic and integrated approach

addressing financial, social, environmental, and economic concerns of all stakeholders

(Hilb, 2012). For-profit public corporation manager-leaders typically seek to optimize

stakeholder satisfaction to ensure continuity (J. Harrison & Wicks, 2013; Tashman &

Raelin, 2013). Nonetheless, scholars aligned strategic stakeholder theory with various

approaches, considering the theoretical objective and research design (Miles, 2012).

Governance helps satisfy stakeholder expectations concerning managerial

responsibilities (R. Davis, 2008). Implicit in expectations for effective governance are the

fiduciary relationship between stakeholders and executive management’s adherence to

stated values (R. Davis, 2008). Stakeholder identification (Gil-Lafuente & Paula, 2013)

and value analysis (J. Harrison & Wicks, 2013) help assess enterprise-level strategy and

organizational culture alignment. Derivatively, stakeholder and organizational values

alignment depend on the firm’s ability to pursue the defined mission effectively and

efficiently while strictly adhering to espoused organizational values. Alignment exists

and is maintainable considering the presented stakeholder values as long as an

organization can furnish products and services in a manner supporting acceptable value

creation (Chou, 2015; Di Gregorio, 2013) and value appropriation (Di Gregorio, 2013).

Deviation from the values alignment construct could result in stakeholder dissatisfaction

generating perceptions that competitors offer a stronger value proposition.

Agency theory can reflect a foundational shareholder primacy premise that owners

(principals) establish a relationship with manager-leaders (agents) through responsibilities

delegation (Heracleous & Lan, 2012; R. Davis, 2008; Yaokumah & Brown, 2014). A

tenet of this theoretical perspective is corporation shareholders are the principals who hire

the agents to perform activities (Heracleous & Lan, 2012; Tashman & Raelin, 2013;

Yaokumah & Brown, 2014). In other words, the shareholder primacy is a structure with

emphasis on shareholder ownership with manager-leaders viewed as stewards of

shareholders (Abraham, 2012). From this theoretical perspective, agents are expected to

make decisions and act in the best interest of principals (Heracleous & Lan, 2012; R.

Davis, 2008; Yaokumah & Brown, 2014). Under agency theory, boards of directors are a

means to address agency problems between managers and shareholders (Boshkoska,

2015; Feldman & Montgomery, 2015).

The board of directors can play a vital role as a corporate governance mechanism

(L. Guo, Smallman, & Radford, 2013; Misangyi & Acharya, 2014; Sachdeva, 2014).

Under the director primacy model, manager-leaders are subject to the expectations and

pressures of stakeholder constituents such as employees, suppliers, customers, and

government regulators as well as shareholders (Heracleous & Lan, 2012). The director

primacy model aligns with stewardship theory and stakeholder theory (Heracleous & Lan,

2012). Thus, manager-leaders assume the responsibilities of an organizational fiduciary

with a fiduciary duty (Heracleous & Lan, 2012; L'Huillier, 2014). Stewardship theory

assumes agents are trustworthy, with intrinsic motivation and oriented to serving the

collective rather than themselves (Glinkowska & Kaczmarek, 2015; Heracleous & Lan,

2012; Pande & Ansari, 2014). Consequently, manager-leaders must often deal with issues

that relate to organizational potency and viability while simultaneously balancing the

needs of various stakeholders (Heracleous & Lan, 2012). Accordingly, managerleaders

acquire enhanced utility when they develop a collaborative approach rather than when

they behave in a selfish and opportunistic manner (Pande & Ansari, 2014).

Researchers found not all agents adhere to making decisions in the best interest of

principals--the principal-agent agency problem (Boshkoska, 2015; Hilt, 2014; Tseng et

al., 2013). Perceptions exist that the principal-agent agency problem is a managerial

incentive issue arising when ownership is highly diffuse (Boshkoska, 2015; Heracleous &

Lan, 2012; Hilt, 2014). Other potential issues associated with corporate governance

include the principal-principal agency problem and the power of the state problem (Hilt,

2014). The principal-principal agency problem is the issue of controlling majority

shareholders from taking actions benefitting themselves at the expense of minority or

outside investors (Hilt, 2014; Mishra & Mohanty, 2014). The power of the state problem

arises from controlling the creation of corporations or expropriating existing enterprises

(Hilt, 2014; R. Davis, 2008).

Politics has been important in the evolution of corporations in the United States;

yet corporate governance evolution was nonlinear (Hilt, 2014). Deficits in the existing

corporate governance structures have contributed to the nonlinear corporate governance

evolution (Abraham, 2012). Lack of effective and efficient corporate governance can

create a business crisis (Kasum & Etudaiye-Muthar, 2014). The United States has

experienced significant episodes of corporate governance crises and governance ineptness

(Hilt, 2014). Governance crises have shown that there are serious issues with the

principal-agent relationship in particular industry sectors (Kasum & Etudaiye-Muthar,

2014). Numerous corporate governance failures have resulted from ethical commitment

lapses by manager-leaders in the form of fraud (Abraham, 2012).

Scholarly research has viewed corporate governance as a solution to agency

conflicts between management and shareholders (Kapooria, Sharma, & Kaul, 2014;

Pande & Ansari, 2014; Renders & Gaeremynck, 2012; Sachdeva, 2014; Siagian, Siregar,

& Rahadian, 2013). C. Chen, Lu, and Sougiannis (2012) revealed robust corporate

governance mitigates the positive association between the agency problem and the degree

of selling, general, and administrative cost asymmetry. In addressing the issues found in

corporate governance, United States legislators have responded by writing codes (Hilt,

2014; Mishra & Mohanty, 2014) affecting the organizational control environment (R.

Davis, 2008). The regulatory control environment has an influence on both fraudulent

workplace behaviors and counterproductive workplace behaviors (C. Chen et al., 2012).

Workplace behavioral standards and values communication typically are broadcast to a

corporation’s personnel through exemplary actions, policy statements, as well as conduct

codes (R. Davis, 2008).

The principal-principal agency problem affects corporate governance quality and

effectiveness (Renders & Gaeremynck, 2012). Renders and Gaeremynck (2012)

examined the effect of the principal-principal agency problem on the quality and

effectiveness of corporate governance structures. The authors’ sampled 1,064

observations in 14 European Union countries listed on the FTSEurofirst 300 index from

1999 to 2003 (Renders & Gaeremynck, 2012). Renders and Gaeremynck found the

constructed conflict index affects corporate governance quality and effectiveness. The

research benefits included applying a theoretical organizational governance framework to

a setting where the primary agency problem arises between majority and minority

shareholders (Renders & Gaeremynck, 2012).

Corporate governance reflects managerial power to exercise stewardship of the

firm's total resource portfolio with the objective of sustaining and enhancing shareholder

value and other stakeholders’ satisfaction while considering the corporate mission

(AlAzzam et al., 2015). Corporate business models address optimal resource deployments

(Bertels, Koen, & Elsum, 2015). Effectual corporate governance mechanisms ensure

preferable resource allocations and management (Mishra & Mohanty, 2014). Scholars

have employed resource-based theory to explain governance implications (e.g., Varsei et

al., 2014). The resource-based view of the enterprise and the resultant resource-based

theory furnish a valuable framework for explaining and predicting a corporation’s

foundational performance and competitive advantage (Kozlenkova, Samaha, & Palmatier,

2014). Resource-based theory suggests how valuable, rare and unique resources can

become for generating an organizational competitive advantage (Cui & Pan, 2015; Varsei

et al., 2014; Yaokumah & Brown, 2014).

Under the resource-based theory, resources refer to enterprise-controlled assets,

capabilities, competencies, processes and knowledge enabling deployment strategies, and

enhanced competitiveness (Tabares, Alvarez, & Urbano, 2015; Varsei et al., 2014).

Yaokumah and Brown (2014) suggested the resource-based view of organizational

resource-based theory focuses on the role of the board of directors in furnishing access to

resources needed by the enterprise. Whereas, Feldman and Montgomery (2015) advanced

the resource-based view focuses on the skills and expertise of directors as resources for

the enterprise.

Figure 3 depicts how corporate governance theories influence ISG domains

(Yaokumah & Brown, 2014). Contextually, three previously discussed corporate

governance theories map indirectly to ISG practice domains (Yaokumah & Brown,

2014). Specifically, the stakeholder theory maps to strategic alignment and value

delivery, the agency theory maps to risk management and performance measurement

while the resource-based theory maps to resource management (Yaokumah & Brown,

2014). After which, there is a one-to-one mapping correspondence between corporate

governance strategic alignment, value delivery, risk management, performance

measurement, resource management, and ISG practices.

Figure 3. Mapping of corporate governance theories to ISG domains. Adapted from “An

Empirical Examination of the Relationship Between Information Security/Business

Strategic Alignment and Information Security Governance Domain Areas,” by W.

Yaokumah and S. Brown, 2014, Journal of Business Systems, Governance & Ethics, 9(2),

permission (see Appendix A).

Strategic alignment. A manager-leader’s selected tactics misaligned with the

adopted corporate focal strategy can prevent performance objective realization

(Hardcopf, Goncalves, Linderman, & Bendoly, 2016). As part of corporate governance,

ISG is the most suitable path to gain control of security processes and guarantee

alignment with business strategies (Rebollo, Mellado, Fernández-Medina, & Mouratidis,

2015). ISG strategic alignment between corporate and information security functions and

strategies establishment occurs in an enterprise when strategic management ensures

information security strategies are congruent with organizational strategies (Yaokumah &

Brown, 2014). For effective strategic alignment, the corporate strategies should

encompass critical information security capabilities, future security requirements, people,

and information assets that are deployable to meet business needs (Yaokumah & Brown,

2014). Thus, effective strategic alignment must exhibit flexibility, commitment, and

adaptability attributes to meet changing business and security environments to avoid

organizational discontinuity (Yaokumah & Brown, 2014).

There are three strategy levels manager-leaders typically consider within an

organization related to alignment: corporate, business, and functional (Alsudiri,

AlKaraghouli, & Eldabi, 2013). The relationship between corporate governance, IT

governance (ITG), and ISG vary in academic literature (Williams, Hardy, & Holgate,

2013). Figure 4 depicts corporate, IT and information security functional strategic

alignment. A corporation’s information security and IT functions should align with the

organizational vision, mission, values, objectives and strategies for effective practices

(Alsudiri et al., 2013; R. Davis, 2011).

Figure 4. Functional corporate governance, ITG, and ISG strategic alignments. Adapted

from IT Auditing: Assuring Information Assets Protection (p. 54) by R. E. Davis, 2008,

(see Appendix A).

Nodal organizational connectivity imposes ISG alignment with enterprise-level

governance requirements (R. Davis, 2008; Yaokumah, 2013). Hierarchical node

connectivity establishment often transpires when standard attributes sharing occurs in

parent-child data relationships (Kearney & Kruger, 2013; R. Davis, 2011). In contrast,

vertical node equality defines similar data sharing perceptions (R. Davis, 2011).

Corporate executives provide the foundation for creating a legitimate governance

structure (Abraham, 2012) that permits sharing relationships. Information security nodal

connectivity enables developing and sustaining information systems strategically aligned

with the corporation’s goals and objectives (R. Davis, 2008). ISG strategic alignment

with ITG activities is also necessary for maintaining information security congruency

with corporate governance (Fenz, Heurix, Neubauer, & Pechstein, 2014; R. Davis, 2008).

ISG should reflect good corporate governance (Yaokumah & Brown, 2014). By

which, information security processes should portray good ISG. Inversely, where

consistently applied, ISG can improve corporate governance (R. Davis, 2011).

Monitoring and reporting enable information security alignment with business processes

and requirements that consequently strengthen the governance bidirectional enterprise

information security relationship (Kwon, Ulmer, & Wang, 2013; R. Davis, 2011).

Corporate IT leaders ensure strategic alignment when appropriate control deployments

occur under an effective ISG program (Mohare & Lanjewar, 2012; R. Davis, 2011).

Previous quantitative ISG survey research furnished the importance of

information security risk management, performance measurement, resource management,

and value delivery practices as organizational strategic alignment predictor variables

(Yaokumah, 2013; Yaokumah & Brown, 2014). Yaokumah (2013) as well as Yaokumah

and Brown (2014) surveyed 360 individuals within 112 Ghanaian organizations for

evaluating whether the integration of the domains generated ISG success. The Yaokumah

and Brown ISG research conferred effectual ISG realization can occur through sound

corporate governance theories while the Yaokumah ISG research presented ITG

structures, processes, and relational mechanisms applicable to generating effective ISG.

The ISG researchers’ demonstrated that organizational risk management, resource

management, performance measurement, and business value delivery practices positively

correlate to effective ISG strategic alignment (Yaokumah, 2013; Yaokumah & Brown,

2014).

Effectual ISG strategic alignment substantially enhances organizational risk

management, resource management, performance measurement, and value delivery

(Mohare & Lanjewar, 2012; Yaokumah & Brown, 2014). A cross-organizational

committee should exist to develop, implement, and monitor the corporate and ISG

strategic plans for objectives and goals synchronization (R. Davis, 2011). Once approval

of strategic plans occurs, manager-leaders must ensure direction transformation into the

right information security service and support deployments (Mohare & Lanjewar, 2012;

R. Davis, 2011). Activity alignment orientation and adaptability orientation are

complementary in strategy operationalization (Hodgkinson, Ravishankar, &

AitkenFischer, 2014). Where optimal value to customers is the adopted strategic

objective, information security realization can create a service advantage (R. Davis,

2011). Though, achieving the customer value objective through information security

realization is not riskless (Hashizume, Rosado, Fernández-Medina, & Fernandez, 2013;

R. Davis, 2011; Rebollo et al., 2015).

An ISG researcher qualitatively investigated how organizational information

systems personnel perceive the information security strategy issue. Ahmad et al. (2014)

primarily collected research data through a literature review and two focus groups (with

five participants per group) held in Korea. Ahmad et al. obtained considerable evidence

that showed security strategy is driven bottom-up rather than top-down by all study

participants representing organizations.

Stakeholder identification and salience theories assist in determining general

classes relevant to strategy development (Tashman & Raelin, 2013). However, Ahmad et

al. (2014) suggested there is a lack of knowledge and an ad-hoc approach to security

strategy development. As a potential explanation, Mohare and Lanjewar (2012) found no

ready organizational strategic roles and responsibilities framework or discussion after

conducting a literature review.

When ISG misalignment to corporate governance and ITG occurs; financial, legal,

reputational, and operational risks can escalate beyond demarcated tolerance levels (R.

Davis, 2008; Yaokumah, 2014). In fact, a functional corporation’s very existence might

depend on how well IT leaders safeguard information assets used in achieving the

adopted organizational mission (Bahl & Wali, 2014; D'Arcy, Herath, & Shoss, 2014; R.

Davis, 2008). ISG development and deployment represents how an enterprise’s

designated information security management team intends to accomplish the

organizational safeguarding mission (R. Davis, 2008; Whitman & Mattord, 2012).

Value delivery. The stakeholder perspective promotes a value-laden approach to

corporate governance as opposed to other views that are unilateral (Abraham, 2012).

Stakeholder value is derived from the relevance and quality of products as well as

services (J. Harrison & Wicks, 2013). Ascertaining the degree that manager-leaders

should give priority to competing stakeholder claims can occur through organizational-

and societal-level stakeholder power, legitimacy, and urgency assessments (Tashman &

Raelin, 2013). Given the identification of stakeholders and perceived salience, strategic

correlation occurs through satisfying what stakeholders’ value and determining valued

outcomes. Management practices ensure efficient and effective stakeholder value delivery

through good governance (Mishra & Mohanty, 2014). Investors prefer to deal with

corporations that have credible and good governance practices (Mishra & Mohanty,

2014).

Stakeholders and societies assert organizations have a responsibility to support

environmental and social sustainability efforts in a manner that is financially responsible

(Glavas & Mish, 2015). Managerial conceptual congruence nourished acceptance of the

triple bottom line (TBL; Glavas & Mish, 2015). Managers frequently used the TBL

approach to describe corporate social responsibility activities (Nalband & Kelabi, 2014).

The TBL approach places value on financial returns, human resources, and physical

environment considering fair business practices benefiting labor, the community, and the

greater common good (Sharma & Khanna, 2014).

Program management can reflect enterprise value creation that extends beyond

project portfolio performance (Rijke et al, 2014). Value creation and subsequent value

appropriation occur through efficient and effective value management. Creating value for

sustainable solutions is a means of increasing the organization’s value propositions and

remediating unsustainable business practices affecting social and ecological systems. The

stakeholder model aligns with sustainable development (Miles, 2012). However,

heterogeneity in defining stakeholders has created confusion and inadvertent failures to

address stakeholder expectations appropriately and providing optimal value delivery

(GilLafuente & Paula, 2013).

Creating optimized value for stakeholders is a responsibility of manager-leaders

(Tashman & Raelin, 2013). As commonly stated program success factors, effective value

delivery practices must engage all stakeholders and assign accountability for delivery of

expected capabilities as well as benefits realization (R. Davis, 2011; Rijke et al, 2014;

Yaokumah & Brown, 2014). ISG value delivery is a strategic alignment function of

information security strategies and business objectives (Mohare & Lanjewar, 2012;

Yaokumah & Brown, 2014). The general strategic alignment model explains the value

generated from alignment within a corporation (Flores et al., 2014). Efficient value

delivery defines and monitors key metrics and responds quickly to any changes or

deviations as well as provides continuous monitoring, evaluation, and improvement (R.

Davis, 2011; Rijke et al, 2014).

Primary information security value occurs if deployed information security assists

in meeting stated objectives of information systems (Pérez-Méndez & Machado-Cabezas,

2015; R. Davis, 2011). At the subcategory level, effective information security service

can create value (Liang-Chuan & Liang-Hong, 2015) that assists in overall ISG value

delivery. For most corporations, information security’s value is generated when requested

information is delivered within the expected timeframe and budget while satisfying

functionality requirements (R. Davis, 2011). Communicating identified data transparently

within a timeframe enabling personnel to carry out their duties is considered information

security value realization (R. Davis, 2011). However, nonfinancial barometers can

determine delivery value--such as information presentation usefulness (Hughes et al.,

2013).

Key management practices ensure effectual value delivery (R. Davis, 2011;

Yaokumah & Brown, 2014). As with links in a metal chain hoisting precious cargo,

manager-leaders must provide appropriate ISG tensile strength for the organizational

environment to achieve corporate objectives (R. Davis, 2011). Considering that acquiring

and maintaining ISG resources have costs, IAP must produce benefits from

implementation until retirement to justify expenditures (R. Davis, 2011). Unfortunately,

without adequate governance, too much tended to be promised by the organization and

contracted third party providers; while the IT end-user community assumed too much (R.

Davis, 2011). Where the expectation circumstance existed, there was the potential for

bilateral misunderstandings, resources mismanagement, poor performance, or outcomes

misalignment that invariably reduced ISG value delivery (R. Davis, 2011).

Enterprise-level business models reflect interrelated activity sets enabling value

creation, value delivery, and value appropriation (Lambert & Davidson, 2013). Business

operations rely on successful supply chain management to assist in satisfying product and

service demands (Saber, Bahraami, & Haery, 2014). Cyber security issues need

appropriate responses to achieve an acceptable cyber-resilience level for supply chains

(Boyes, 2015). Sindhuja (2014) explored the effect of information security initiatives on

supply chain performance. Resultantly, Sindhuja indicated information security initiatives

positively associated with supply chain operations that, in turn, positively influenced

supply chain performance. More recently, Boyes (2015) presented a model for securing

information across the supply chain. Using an alternative theoretical lens, Boyes explored

supply chain cyber-resilience issues considering the nature of threats and vulnerabilities

as well as the attributes of cyber security.

Arguably; IT systems, processes, activities, and tasks represent the key support

structure for effective information and communication configurations (R. Davis, 2011;

Sun & Bhattacherjee, 2014). Almost every corporate manager aspires to use technology

for integrating information, achieving process efficiencies, and transforming service

delivery into an effectiveness paragon (R. Davis, 2011). However, most corporate

managers have come to realize that emphasizing technologies and enterprise-centric

solutions will not produce the desired results; and a holistic approach is required (De

Haes et al., 2013; R. Davis, 2011). Effectual ISG value delivery practices recognize

different categories of investments that must be evaluated and managed asymmetrically

(Yaokumah & Brown, 2014).

Risk management. Extensive risk exposure can lead to failure in attaining

management’s established objectives for a corporation (Badara & Saidin, 2014). Risk

management integrates a systematic approach to identifying risk and defining the effect

on an enterprise’s ability to provide goods or services (Mohare & Lanjewar, 2012; R.

Davis, 2008). A corporation’s business risk management framework should be a strategic

axial enabled to accept diverse strategy spokes (R. Davis, 2011; Williams et al., 2013).

Business risk management should represent the proactive process by which a corporation

methodically addresses risks attached to activities with the objective of achieving

sustained benefit within each action and across the organizational portfolio (R. Davis,

2011).

An enterprise’s strategic mission as well as risk management system consideration

is necessary for achieving proper corporate performance and conformance equilibrium

(R. Davis, 2011). Corporations must establish a single control definition that serves all

organizational units to empower performance and conformance through enterprise-centric

risk management (R. Davis, 2011). Corporate risk management must also provide

standards against which organizational units can assess their control systems and

determine what improvements are necessary (Flores et al., 2014; R. Davis, 2011).

Cascading from these requirements, enterprises that execute a strong balance between

performance and conformance through appropriate value delivery risk management have

the best long-term prospects for thriving in their particular regulatory environment (R.

Davis, 2011).

Risk management is not a platitude used to demonstrate effective leadership

(Boyson, 2014, R. Davis, 2008). Those responsible for governance within an enterprise

must provide guidance dedicated to appropriately handling risks their corporation

encounters (Boyson, 2014, R. Davis, 2008). In particular, the risks associated with

information and related technology necessitates comprehensive management based on a

carefully executed impact and likelihood assessment regarding projected adverse event

occurrences (Boyson, 2014, R. Davis, 2008). Determining information asset risk

magnitudes to ensure appropriate resource allocations addressing threats, opportunities,

and vulnerabilities impacting the organization is necessary for realizing effectual ISG (R.

Davis, 2008).

Business risk management necessitates information security risk awareness by

manager-leaders (Clark & Harrell, 2013; Mohare & Lanjewar, 2012; R. Davis, 2008).

Correspondingly, there is a need for a clear understanding of the corporation’s appetite

for information security risks and information security compliance requirements (Clark &

Harrell, 2013; Mohare & Lanjewar, 2012; R. Davis, 2008). There is also a need for

transparency regarding significant organizational information security risks and

embedding management responsibilities (Clark & Harrell, 2013; Mohare & Lanjewar,

2012; R. Davis, 2008, 2011). However, Stewart and Lacey (2012) found a lack of formal

methodologies in information security awareness for systematically identifying audience

communication requirements.

Common information system security controls reduce risk to information systems

and enterprises when correctly implemented (Barton, Tejay, Lane, & Terrell, 2016).

Deployed managerial business processes and IT risk assessments can assist in

determining IAP control intensity (Flores et al., 2014; R. Davis, 2008; Rubino & Vitolla,

2014). Based on the threats, opportunities, and vulnerabilities assessment reports; an

enterprise may require IAP remediation to ensure the adequacy of the IT security control

system (R. Davis, 2008; Yaokumah & Brown, 2014). Unfortunately, it usually is

prohibitively expensive to reduce IAP risks to a tolerable level for all potential IAP

failures simultaneously (Nazareth & Choi, 2015; R. Davis, 2008). In addressing this

accepted limitation, a risk grading system assists in information asset evaluation and

prioritization (Nazareth & Choi, 2015; R. Davis, 2008; Rubino & Vitolla, 2014).

Strategic alignment practices are an organizational risk management predictor

(Yaokumah & Brown, 2014). With organizational risk management alignment, ISG can

furnish a framework for evaluating investments in information safeguarding, adequate

resource coverage, as well as enable objectives achievement (R. Davis, 2008).

Information asset managerial due care dictates consistent information security resources

administration considering a corporation’s ability to deliver business results or value at an

affordable cost--within an acceptable risk level (R. Davis, 2008; Yaokumah & Brown,

2014). Ascertaining an appropriate resource risk level prerequisites organizational risk

analyses addressing foreseeable threats, opportunities, and vulnerabilities (Mohare &

Lanjewar, 2012; R. Davis, 2008). Contextually, risk management principles and practices

are critical drivers for ISG safeguarding activities (R. Davis, 2008).

Responsibility for appropriate safeguarding activities should span the

corporation’s total tangible and intangible resources (Magdaraog-Jr, 2014; R. Davis,

2008). Risk management should be a continuous effort addressing threats, opportunities,

and vulnerabilities (Mohare & Lanjewar, 2012; R. Davis, 2008). Employing software

integrity as the research foundation, Boyson (2014) found sampled supply chain

initiatives had apparent risk management effort clustering around internally oriented

system development and core supplier-oriented sourcing. In contrast, Ahmad et al. (2014)

revealed security managers largely ignored business security risks while Magdaraog-Jr

(2014) uncovered that most enterprise manager-leaders neglect resource security

significance of some information assets.

Scholars concluded a list of significant barriers that perceivably obstruct risk

management implementation or impede risk management proficiency in programs

(Rasheed et al., 2015). Monetary constraints, schedule requirements, unstable

organizational environment, lack of executive commitment towards risk, and a deficit of

risk-aware culture are the primary barriers impeding risk management deployment in

large-scale Pakistan Telecom programs (Rasheed et al., 2015). Regarding unstable

organizational environments, supply chain risk variability and uncertainty make

predicting disruptions challenging (Chopra & Sodhi, 2014; Kumar, Himes, & Kritzer,

2014).

Concerning contextual constraints, researchers also uncovered the considered risk

management approaches do not explicitly provide mechanisms to support decision

makers in choosing an appropriate risk versus cost trade-off (Deursen, Buchanan, & Duff,

2013; Fenz et al., 2014). However, earlier research by A. Kim, Lee, and Lee (2012) found

Hacking, Incident Protection Countermeasures; IT Planning and Operating; and IT

Internal Control usable as risk management measures regarding security

countermeasures. Information security efforts should reflect coordination through

assessed risks, relevant controls development and deployment, and implemented controls

effectiveness monitoring (Flores et al., 2014).

Internal and external control systems are governance requirement projections that

may have misconceived control elements; because control construction is dependent on

the architectural frame of reference (Magdaraog-Jr, 2014; R. Davis, 2008). Internal

control systems are also enterprise-centric and may embrace mistaken assumptions

regarding required control assurance levels to satisfy stakeholders (R. Davis, 2008).

Stemming from managerialism, configured control mechanisms may only minutely affect

market inefficiencies and resulting corporate governance issues (Raelin & Bondy, 2013).

Thus, employing risk management based controls may do little to enhance stakeholder

fiduciary confidence in the corporation’s personnel because manager-leaders typically

have the ability to override deployed controls (R. Davis, 2008).

Performance measurement. Strategic alignment occurs when proper deployment

monitoring ensures success under an adopted vision (R. Davis, 2011). The essence of a

monitoring system is feedback information on the results of actions by employees (R.

Davis, 2011; Rebollo et al., 2015). Performance feedback information regularly addresses

measurement, matching, and regulation of designed processes (R. Davis, 2011, Stewart &

Lacey, 2012). The controls can be good or bad; precise or imprecise, and formal or

informal (R. Davis, 2011). Nonetheless, control has two key aspects: performance

measurement against a standard and performance remediation (if necessary) considering

the measure (R. Davis, 2011). A successful control system is one that institutes

corrections before process deviations become acute (R. Davis, 2011).

Governance control requires effective performance management (Atoum, Otoom,

& Ali, 2014). Controls are the activities increasing certainty that organizational plans are

achieving the desired objective (R. Davis, 2011). Controls can facilitate information

security implementation efficacy through influencing employee behaviors (Atoum et al.,

2014). The dispersed nature of IT limits the effectiveness of many traditional controls (R.

Davis, 2011). Nonetheless, a corporation’s products and services performance can usually

be measured quantitatively or qualitatively (R. Davis, 2011). However, selecting the

appropriate measure of the monitored performance activity is crucial for effective

performance management (Flores et al., 2014; R. Davis, 2011).

Performance management control techniques include Management by Exception,

Management by Objectives, Assurance Reporting, Network Analysis, Balanced

Scorecard Analysis (De Haes et al., 2013; R. Davis, 2011), and Budget Analysis (R.

Davis, 2011; Shaaban & Conrad, 2013). Individuals measuring performance may or may

not participate in the monitored activity (R. Davis, 2011). Nonetheless, behavioral

considerations are important in selecting who performs the measurement (Crossler et al.,

2013; Flores et al., 2014; R. Davis, 2011). Furthermore, behavioral factors are important

in what is measured, and the standards utilized for comparative analysis (Crossler et al.,

2013; Flores et al., 2014; R. Davis, 2011). Measurements should reflect the corporation’s

strategy as well as provide critical data and information about key processes, systems,

and programs (Deursen et al., 2013; R. Davis, 2011). Through analysis of data generated

by deployed tracking processes, adopted measures or indicators may be adaptively

evaluated and changed to improve managerial goals support (Flores et al., 2014; R.

Davis, 2011).

Practice and research necessitate understanding the manager-leaders’ strategic

organizational intent as an essential prerequisite for deploying an appropriate and

efficient monitoring and evaluation system (Yaokumah & Brown, 2014) ensuring

effective change management. Utilizing a maturity model can aid management in

identifying risk issues (Boyson, 2014). Procedurally, a maturity model provides a

standard means to document and evaluate the state of controls (De Haes et al., 2013;

Looy, De Backer, Poels, & Snoeck, 2013). Collectively, corporate managers can

contribute to identifying risk issues as well as rate controls through a maturity model (De

Haes et al., 2013). Some information security manager-leaders suggested that if the

system is correctly configured and appropriately monitored by trained individuals, then

breach risk minimization will prevail (Lopez, 2012).

Computer technology deployments continue to advance toward a tiered

decentralized world of distributed platforms for entering, processing, and retrieving

information (R. Davis, 2008). Given the increasing complexity of IT systems and

networks, there is a mounting information security challenge for providers and users

(Bahl & Wali, 2014; R. Davis, 2008). Where a stringent mandatory security requirement

causes a shift to outsourcing, the greater the number of clients a selected managed

security service provider has generates a corresponding increase in system

interdependency risk (Sen & Borle, 2015). For an organization’s outsourced processes,

monitoring can detect contractual risk (R. Davis, 2011). For outsourced activities,

management should have processes to govern the relationship with and the performance

of third party providers (Boyson, 2014; R. Davis, 2011).

Resource management. Business organizations face constant pressure to achieve

and maintain a competitive advantage in the marketplace (Cegielski, Bourrie, & Hazen,

2013). The resource-based theory indicates that corporations should center on

deployment and combinations of particular inputs rather than avoidance of opportunities

(Chou, 2015). Of particular importance is dynamic capabilities viewed as strategic

options that give a firm a choice to pursue new directions when opportunities arise

(Cegielski et al., 2013). Practitioners, as well as researchers, hold the opinion that a

competitive advantage derived from using IT is often temporary (Cegielski et al., 2013).

Information systems scholars have also questioned how deployed and used IT can build a

competitive advantage (Bharadwaj, El Sawy, Pavlou, & Venkatraman, 2013; Drnevich &

Croson, 2013; Seddon, 2014).

Information systems are task configurations that perform data collection,

processing, and organization for conveyance to perceived users or storage. Information

systems deployments represent the entire organization, infrastructure, elements, and

people that collect, process, store, transmit, display, disseminate, and disposition

information (Schryen, 2013). The information systems resource-based perspective

focuses on understanding what resources are most likely to contribute a competitive

advantage (Pan, Pan, & Lim, 2015). Resource Orchestration enables integrating notions

of resource management and asset orchestration (Cui & Pan, 2015; N. Wang, Liang,

Zhong, Xue, & Xiao, 2012). Resource Orchestration provides a more precise

understanding of the manager-leaders’ role in structuring a resource portfolio, bundling

resources into capabilities and leveraging the capabilities to create value for customers

(Cui & Pan, 2015; N. Wang et al., 2012). Researchers have shown that managerial IT

oversight enhances value when using a resource-based lens (Turel & Bart, 2014).

The IT architecture refers to technology priorities, and choices allowing

applications, software, networks, hardware, and data management integration into a

cohesive platform (Masa’deh, 2013). Markus and Loebbecke (2013) argued that the

digital business strategies of orchestrators have consequences beyond the boundaries of

their ecosystems when ecosystems overlap. Commonly, a disruptive IT produces a

response from the industries serving the same market (Carlo, Gaskin, Lyytinen, & Rose,

2014; Catinean & Cândea, 2013; Cui & Pan, 2015). Cross-boundary industry disruptions

may, in turn, change value networks to multisided markets (Pagani, 2013). With the

increased global competitiveness, development of platforms for IT disruptive advantage

for organizational differentiation and sustainability is a top strategic issue for business

leaders (Berman & Marshall, 2014). Disruptive changes in IT platforms have resulted in

radical and pervasive innovations in software development organizations across three

innovation types: adopted base technologies, produced services, and selected processes

(Carlo et al., 2014).

There are four classifications of ISG resources: people, information, processes,

and infrastructure (De Haes et al., 2013; R. Davis, 2011). Organizational resources use

should occur judiciously and productively to achieve management’s business objectives

while simultaneously executing control objectives (De Haes et al., 2013; R. Davis, 2011).

Control techniques for resource management include relational mechanisms, structures,

and processes (Schobel & Denford, 2013). Where applied; the best path to right-sizing

ISG controls is provisioning diligent subordinates with justified resources needed to

achieve their specific ISG IAP goals (De Haes et al., 2013; R. Davis, 2011). However,

regardless of the control techniques and automated capabilities available, the best

possible means of control is selecting high-quality employees (R. Davis, 2011).

Hiring and retaining high-quality ISG personnel is critical to sustaining IT

departmental effectiveness and efficiency (Cavusoglu, Cavusoglu, Son, & Benbasa, 2013;

R. Davis, 2011). Without competent individuals to manage or manipulate IT resources,

even a superbly designed architecture can become ineffective and inefficient (Hashizume

et al., 2013; R. Davis, 2011) in preventing or deterring an information security breach.

Corporate human resource practices can assist in ISG resource quality assurance through

legal screening processes applied to assess ISG talent competency and ethics (K. Guo &

Yuan 2012; Price, 2014; R. Davis, 2011). For instance, ethics screening is necessary

because cloud administrators typically have unrestricted access to the cloud data

(Hashizume et al., 2013). As for deployed personnel, ISG manager-leaders can enhance

service quality by ensuring superior education and training (A. Singh, Picot, Kranz,

Gupta, & Ojha, 2013; Hashizume et al., 2013; R. Davis, 2011).

Behaviorally, information security responsibility delegation must and should

occur (Posey, Roberts, Lowry, & Hightower, 2014; R. Davis, 2008). Deterministically,

the appropriate amount of authority must also transfer responsibility (R. Davis, 2008).

However, a higher direct reporting position within the corporation cannot evade ultimate

accountability for delegated responsibility and authority (R. Davis, 2008). Authority

without accountability can promote corrupt practices (Pitesa & Thau, 2013). Employee

accountability affects responsibility for meeting standards (R. Davis, 2008).

Responsibility for a standard should directly correlate to an activity responsibility

because standards become ineffective measurement tools when accountability is lacking

(R. Davis, 2008). Therefore; accountability is necessary to ensure appropriately

administered authority within the assigned responsibilities context (R. Davis, 2008).

Accountability for decision-making procedures offers a way to contain the

selfserving outcomes of power (Pitesa & Thau, 2013). As revealed by researchers,

organizational power stems from meanings, resources, process, and systems (Kolkowska

& Dhillon, 2013). Power granting to employees can occur through managerial authority,

information access, qualifications, competence, seniority, experience, reputation, or

respect (R. Davis, 2008). If information reliability is in question so is employee integrity

and corresponding controls (R. Davis, 2008). Making agents accountable for their

decision-making procedure is an effective self-serving decision restrictor under moral

hazard (Pitesa & Thau, 2013). Ultimate responsibility for conveying expectations rests

with the corporation’s manager-leaders (R. Davis, 2008). Conclusively, it is imperative

that the deployed ISG program ensure ethical employee behavior.

Information Security Governance

Just as corporate governance has been driven by the imperative to manage

organizational operations to meet stakeholder expectations for strategic alignment, value

delivery, risk management, performance measurement, and resource management, so

have ISG scholars focused on achieving similar information security accountabilities

(Yaokumah & Brown, 2014). Theories aid in conceptualizing objects and structures that

shape activities (Imenda, 2014; Scharff, 2013; Zachariadis, Scott, & Barrett, 2013).

Developed theoretical models can be generalizable and can explain cause-and-effect

relationships that enable predicting outcomes (K. Davis, 2016). Through metaanalytic

research, Silic and Back (2014) identified 164 different theories used in 684 publications

addressing information security. Silic and Back depict ISG as frameworks, standards, and

policy definitions; where appropriate strategy and security policy require contextual

deployment to protect effectually against potential risks.

Information and decision theories have convergence points when conjoined with

the binodal processes depicting organizational governance relationships (R. Davis, 2008).

Information theory practice domains include data processing systems design, organization

analysis, and advertising effectiveness; whereas decision theory practice areas encompass

organization, learning, cybernetics, and suboptimization disciplines (R. Davis, 2008). At

the application level, information theory techniques enable classification determination,

impact assessments, and technological evaluations (Hughes et al., 2013). Application-

level decision theory techniques can provide objectives determination, interaction

assessments, performance estimates, and organizational analysis (R. Davis, 2008).

Strategies and policies. ISG research encompasses strategy and policy subthemes

(Silic & Back, 2014). ISG planning allows forecasting future organizational direction and

relevant influences as well as deriving a better strategy for accomplishing objectives (R.

Davis, 2008). An extensive grasp of the corporation’s business environment, processes,

and organizational objectives enables effective information security strategies

development (Flores et al., 2014). Similar to enterprise strategic planning, the ISG

planning process translates strategy into measurable tactical and operational plans as well

as retranslating operational plans into policies, procedures, directives, standards, and rules

(R. Davis, 2008; Edwards, 2013). Ahmad et al. (2014) investigated how organizations

implemented security strategies to protect their information systems, and subsequently

found a significant proportion of the participating organizations used preventive strategies

to maintain the availability of technology services. As a preventive strategy, though

policies are necessary means to communicate expected behavior, determining the

effectiveness of adopted information security objectives is even more

critical.

Typically, safeguarding information assets translates into management ensuring

that resource acquisition, use, and disposal occurs (Boyson, 2014) through protection

mechanisms and separation-of-duties (R. Davis, 2008). These safeguarding activities

must follow policies and procedures as well as approvals because even small asset

misappropriations could cause significant losses to organizations (X. Zhao, Xue, &

Whinston, 2013). Safa et al. (2015) found a firm’s information security policy has a

positive effect on subjective norms towards performing the information security

conscious care behavior.

The effect of reward on information security policy compliance appears

inconclusive. On the one hand; Y. Chen, Ramamurthy, and Wen (2012) showed reward

plays an important part in influencing employee compliance intention. On the other hand;

Siponen, Mahmood, and Pahnila (2014) found reward does not have a significant

influence on employee compliance intention. Depending on a corporation’s technological

advancement, employer expectations transmission and reception can occur through

auditory, visual, as well as sensation activities enabling current or future processing for a

decisional application (R. Davis, 2008; Y. Chen, Ramamurthy, & Wen, 2012). The

communicated expectations list extends to acceptable business behaviors, financing

sources, as well as organizational structures (R. Davis, 2008).

Acceptable business behaviors. Governance policies are particular courses or

methods of action selected by management from alternatives to guide as well as

determine present and future decisions (R. Davis, 2008). By which, counterproductive

work behavior is an ISG policy subcategory. Categorically, counterproductive work

behavior is intentional conduct contrary to legitimate organizational interests

(ChernyakHai & Tziner, 2014; Claycomb, Huth, Flynn, McIntire, & Lewellen, 2012; H.

Zhao, Peng, & Sheard, 2013). Multilevel sanctions are designed and implemented to

prevent information security policy violations in the workplace (K. Guo & Yuan, 2012).

Regardless, scholarly information security authors have approached counterproductive

work behavior inquiry from different perspectives.

On the one hand, K. Guo and Yuan (2012) performed a quantitative study that

surveyed 2,793 Canadian organizational computer users to test a proposed mediation

model using four scenario-based questions. The scenarios used in the K. Guo and Yuan

study reflected security issues related to user authentication and access control, hardware,

software, and computer networking. The authors found personal self-sanctions and

workgroup sanctions influenced the effect of organizational sanctions regarding

employee security policy violation (K. Guo & Yuan, 2012). The researchers’ results also

revealed both personal self-sanctions and workgroup sanctions had significant negative

impact on employee intentions to violate security policies (K. Guo & Yuan, 2012).

However, organizational sanctions were nonsignificant when the personal self-sanctions

and workgroup sanctions were inclusive (K. Guo & Yuan, 2012).

On the other one hand; Claycomb, Huth, Flynn, McIntire, and Lewellen (2012)

presented data extracted from a large database of actual insider activity. The authors

obtained 15 actual cases of insider IT sabotage chosen from over 130 previously collected

cases of insider activity, covering the crimes of fraud, intellectual property theft, and

sabotage (Claycomb et al., 2012). The authors found seven of the insider cases studied

apparently became disgruntled more than 28 days before attacking (Claycomb et al.,

2012). However, nine carried out malicious act events less than a day before attacking

(Claycomb et al., 2012). The authors also found of 15 attacks, eight ended within a day

(Claycomb et al., 2012). Moreover, the authors found 12 detections occurred within a

week, and in 10 cases action was taken on the organization insider within a month

(Claycomb et al., 2012).

There are social, economic, and technological factors associated with the wrongful

use of IT (Chatterjee, Sarker, & Valacich, 2015). Comparatively, K. Guo and Yuan’s

(2012) derived assertions from a postpositivist perspective, whereas Claycomb et al.

(2012) extrapolated assertions from a social constructionist perspective. The studies have

well-presented data, yet alternative data views. In studying counterproductive work

behavior, K. Guo and Yuan’s suggested time is an important consumer behavior

determinant while Claycomb et al. considered discounting as a research affect factor.

Nonetheless, both datasets are linkable to technical, behavioral, and sociotechnical

counterproductive work behavior factors. K. Guo and Yuan communicated the practice

implications while Claycomb et al. conveyed the practice and research implications.

Financing sources. A cyber attack commonly denotes illegal activities conducted

using the Internet (Julisch, 2013a). Researchers have furnished insights concerning stock

market response to a publicly announced cyber attack on a publicly traded firm (Spanos

& Angelis, 2016). Das, Mukhopadhyay, and Anand (2012) examined the stock market

reactions to publicly declared cyber attacks on listed enterprises. For which, Das et al.

obtained data from newspaper and Internet declarations of 101 information security

breaches on firms listed in the United States or India stock exchanges. Resultantly, Das et

al. found the firm type, firm size, and attack damage potency was factors that individually

affected cumulative abnormal returns. The authors further found Denial of Service attacks

on e-commerce generated significantly negative cumulative abnormal returns (Das,

Mukhopadhyay, & Anand, 2012). Last, the authors’ research revealed information theft

attacks on financial institutions produced significantly negative cumulative abnormal

returns (Das et al., 2012).

Publicly held company manager-leaders should ensure compliance with all

regulatory disclosure requirements and guidance. However, United States Securities and

Exchange Commission (USSEC) registrants are prone to ignore or disregard the guidance

for additional information security disclosures in their regulatory filings (Stagliano &

Sillup, 2014). T. Wang, Kannan, and Ulmer (2013a) investigated how the nature of

security risk factors disclosure associated with future breach announcements. Wherefore;

T. Wang et al. (2013a) obtained data from financial reports and text-mining media

content containing a security breach announcement. Resultantly, the authors showed

disclosed security risk factors with action-oriented terms and phrases are less likely to

relate to future incidents (T. Wang et al., 2013a). The authors additionally found the

market reaction following the security breach announcement is different depending on the

nature of the disclosure (T. Wang et al., 2013a). Nonetheless, little had changed

concerning cybercrime risks disclosure over the 5 years before the published study by

Stagliano and Sillup (2014).

T. Wang, Ulmer, and Kannan (2013b) also investigated the relationship between

the textual contents of information security breach reports and the stock price. T. Wang et

al. (2013b) examined the trading volume reactions of the affected firm(s) around the

breach announcement day. For which, T. Wang et al. (2013b) obtained data from online

and offline newspaper article declarations of 89 information security breaches publicly

traded companies. Resultantly, the authors found general investors could estimate the

price and volume reactions to breach announcements based on the textual contents of the

reports (T. Wang et al., 2013b).

Organizational structures. Organizational structures are operational

segmentations, managerial layers, and constructed processes that determine how

employees accomplish work (Julisch, 2013b). Interior and exterior environmental factors

influence organizational structures (Hodgkinson et al., 2014; R. Davis, 2008; Sila, 2013).

Traditional organizational structures represent inherited, established, or conventional

business architectures (Steiger et al., 2014). Traditional organizations typically utilize the

Simple, Bureaucratic, Professional (Functional), or Divisional organizational structures

(Steiger et al., 2014). In contrast, where complexity, bureaucracy, and centralization are

excessively confining, the Adhocracy (Matrix) organizational structure supports the need

to innovate and operate situationally to overcome environmental circumstances (Steiger

et al., 2014). Less traditional corporations rely on informal organizational structures

through alliance building and boundary spanning management techniques (Foss &

Dobrajska, 2015; Steiger et al., 2014).

IT has influenced organizational formation structures (Guadalupe, Li, & Wulf,

2014). A corporation’s IT may support a myriad of users and can consist of a multitude of

individual elements connected to networks (Garba, Armarego, Murray, & Kenworthy,

2015; R. Davis, 2008). Programs or systems may perform a single task or multiple tasks

for a departmental process or the entire corporation in a centralized, decentralized, or

hybrid IT environment (R. Davis, 2008; Yaokumah, 2013). Researchers indicated

relevant knowledge and activities are the most salient factors for information systems

security in organizations (S. Kim, Yang, & Park, 2014). Within this context, knowledge

sharing and knowledge application are beneficial to employees (Findikli, Yozgat, &

Rofcanin, 2015). However, the effect of organizational structure has a slightly weaker

effect on the establishment of security knowledge sharing in organizations (Flores et al.,

2014).

Effective knowledge management supporting innovation management has become

an organizational necessity (Tseng et al., 2013). IT integration can facilitate knowledge

management using advanced IT applications to support interorganizational

communication and information processing for acquiring and sustaining a competitive

advantage (Liu, Ke, Wei, & Hua, 2013; Masa’deh, 2013). Processes to coordinate

implemented security knowledge sharing mechanisms have a significant direct influence

on the deployment of security knowledge sharing in organizations (Flores et al., 2014).

From a corporate governance lens, Kearney and Kruger (2013) showed how a security

incident could create opportunities for organizational learning. Ahmad, Maynard, and

Shank (2015) proposed a new double-loop model for incident learning to address

potential systemic corrective actions.

The knowledge barrier prevents efficient communication between information

security manager-leaders and business manager-leaders. Information security

managerleaders discerned that there is a knowledge impediment preventing efficient

communication between the two identified cohorts (Lopez, 2012). The business

managerleaders internalize the words, yet have no real understanding because of the lack

of technical information security knowledge (Lopez, 2012). Flores et al. (2014) found

business-based information security management had no significant direct effect on

security knowledge sharing. As a remedy to this knowledge sharing challenge, corporate

manager-leaders can apply Beer’s organizational cybernetics framework to ensure a

viable governance structure (Arif, 2016) for efficient communication between

information security manager-leaders and business manager-leaders.

Governance structure. Cybernetics control theory emphasizes the role of

organizational structure in information governance (Boyson, 2014). Information has been

considered a quasiphysical concept related to the degree of organization in a system

(Boyson, 2014). From a system perspective, there is a presumption that governance

structures are a process outcome (Misangyi & Acharya, 2014). Structures deployed by an

organizational governance system allocate rights and responsibilities within the

structures, and necessitates assurance that manager-leaders are operating effectively and

expectantly within the defined structures (A. Singh et al., 2013; Too & Weaver, 2014).

The role of manager-leaders is to administrate within the defined governance system

framework (Too & Weaver, 2014). Thus, ISG reflects the system through which an

organization directs and controls information security activities (Kushwaha, 2016;

Williams et al., 2013).

Although corporations exist for various reasons, the broadcasting of information

security breaches across industries is increasing public and private demands to

institutionalize ISG with program oversight (Srivastava & Kumar, 2015). Organizational

information and communication have employee responsibility and reporting structures

(Mohare & Lanjewar, 2012). Formal organizational structures often reflect constructs

associated with laws, regulations, policies, directives, procedures, standards, and rules

(Flores et al., 2014; Kearney & Kruger, 2013; R. Davis, 2008). Informal organizational

structures mirror the interlocking social makeup governing how people work together in

practice (Flores et al., 2014). Guadalupe, Li, and Wulf (2014) suggested executive team

structure is a pivotal organizational design choice.

Information security manager-leaders should have the opportunity to learn and

discuss practical ITG implementations, effective risk identification strategies, and

integration of accepted frameworks to ensure appropriately aligned IT and business

processes. Regardless, at the corporate environment detail level, organizational structures

are impacted by designed tasks and deployed technology (Guadalupe et al., 2014). Thus,

information security is both structural and technical (Boyson, 2014).

IT permits collecting and processing large data volumes as well as inspires

innovation (Soava, 2014). IT that links information systems have made

intraorganizational communication almost seamless depending on product-specificity

(Guadalupe et al., 2014). Within a corporation’s organizational structure, providing

acceptable service delivery necessitates the installation of an effective support system

(Boyes, 2015; Cegielski et al., 2013). Employed dynamic capabilities enable maintaining

competitiveness (Cui & Pan, 2015) through combining, enhancing, protecting, and

reconfiguring the corporation’s resources and abilities (Pan et al., 2015). Within the

deployed IT support system, information security service delivery and support may range

from operational protection deployment to crisis response training (R. Davis, 2008).

Concurrently, innovations may manifest in different forms that require managerial

attention (Cegielski et al., 2013).

Technological innovation adoption can raise security threats (Chou, 2015) and

presents challenges to manager-leaders that demand a shift in mindset, culture, or

operational procedures (Catinean & Cândea, 2013). As technological innovations extend

social impact, correspondingly ethical issues expand for corporate employees (Stahl,

Eden, Jirotka, & Coeckelbergh, 2014). In response, a managerial moral assessment

concerning what is sound and unsound about new devices (or methods that may emerge;

Stahl et al., 2014), and what is appropriate and inappropriate IT options use become

imperative (Stahl, Timmermans, & Flick, 2016).

Required information protection changes and maintenance can also occur through

various problems encountered by users (Safa, Solms, & Furnell, 2016) or deliberate

attacks on the established information security architecture (Safa et al., 2015). Assessing

changes in and maintenance of existing systems are critical information security service

elements contributing to value delivery (R. Davis, 2008). When assessing IT security

risks, sustained employee, as well as consumer integrity and ethics, define technology

safety (R. Davis, 2008). An essential value delivery practice for minimizing projection

versus perception risks is service-level management appropriateness (R. Davis, 2011).

For example, Ludin and Cheng (2014) surveyed 200 Malaysian young adults for online

shopping and found only electronic service quality affected customer satisfaction.

Designing and maintaining appropriate risk management requires comparative

assessments of implemented general and application IT controls (Herath & Herath, 2014;

R. Davis, 2008). As general and application security categories, significant risks to an

organization implementing and using IT are deficient logical access controls (A. Kim,

Lee, & Lee, 2012) and weak network infrastructure security (Cowley, Greitzer, &

Woods, 2015). Inappropriate environmental controls, misaligned risk responses, and

inadequate physical access controls are also significant risks to an organization

implementing and using IT (A. Kim et al., 2012). Last, inadequate confidential

information lifecycle protection is a major risk to an organization implementing and using

IT (Da Veiga & Martins, 2015; Fenz et al., 2014).

Stakeholders are a critical factor in the success or failure of computer software

(Babar, Ghazali, Jawawi, & Zaheer, 2015). Bahl and Wali (2014) investigated the effect

of ISG on information security service quality delivered to customers. The researchers

also examined the perceptions of software services provider employees regarding ISG

(Bahl & Wali, 2014). Bahl and Wali assumed that ISG as part of corporate governance

drove information security service quality. In this quantitative study, the authors found

ISG in an IT outsourcing firm providing software services has a highly significant and

predictable effect on information security service quality (Bahl & Wali, 2014). The

authors further concluded there is a positive relationship collectively between ISG and

elements of information security service quality (Bahl & Wali, 2014).

ISG frequently includes resilient security regarding the corporate IT infrastructure

and information systems supporting critical functions or business processes (Ahmad et

al., 2014). An ISG program should manage IT safeguarding (R. Davis, 2008).

Information security programs are a significant risk management element that presents

the means for preserving information assets (R. Davis, 2008). Programmatically, ISG

should control risks as an anticipated deployment advantage. With corporate risk

management alignment, ISG can provide a structure for assessing investments in data

safeguarding, adequate resource coverage, as well as allow objectives achievement

(Nazareth & Choi, 2015). IT risks can affect tangible and intangible assets, including a

firm’s: image, reputation, financial instruments, consumer confidence, proprietary

information, and competitive advantage (R. Davis, 2008; Tabares et al., 2015).

Corporations can lower risks to information through effective information systems

security (Barlow, Warkentin, Ormond, & Dennis, 2013; Barton et al., 2016).

Logical access controls are the manual and electronic policies, procedures, and

organizational structures deployed to safeguard symbolic objects (R. Davis, 2008).

Operationally adopted logical controls can ensure that only designated users with

approved authorization have access to intangible assets (R. Davis, 2008). Authorization

controls provide the ability to verify credentials granted permission to access resources

(Baltatzis, Ilioudis, & Pangalos, 2012; R. Davis, 2008). Thus, derivatively, IT

authorization empowers designation and subsequently allowed actions administration for

a given information asset (Baltatzis et al., 2012; R. Davis, 2008).

Network infrastructure facilities are the areas where IT hardware and software

reside and require access controls (R. Davis, 2008). Consistent with logical access

controls, users of the corporation’s information processing facilities should receive

authentication and authorization through a formal policy and method (R. Davis, 2008).

Physical security involves reducing technological vulnerabilities, usually by limiting

access to the buildings and rooms housing information assets, or by installing mechanical

locks on devices (R. Davis, 2008).

Organizational manager-leaders recognize the criticality of ISG as an integrative

program for achieving ITG and corporate governance success (Yaokumah, 2014). Crucial

to successful ISG program structures and processes is communication amongst all parties

based on constructive relationships, common language utilization and the shared

commitment to resolving information security related issues (R. Davis, 2008). Reflective

of characteristic organizational requirements; ISG information and communication

dissemination usually occurs at different organizational strata (Ahmad, Maynard, &

Shank, 2015; R. Davis, 2008; Williams et al., 2013). Resulting procedures are

operationally tailored, with processes linking to systems, and systems interfacing with

various programs receiving objectives from the firm’s oversight committee through

established reporting lines (R. Davis, 2008). As a corporate oversight committee

subcommittee, Audit Committee members should ensure relevant and quality cyber

security information receipt, and diffusion for devising appropriate IT risk management

strategies (Lanz, 2014).

ISG advisories. Research and practice-oriented literature offer considerable

information security advice (Ahmad et al., 2014). ISG conformance and performance

objectives were found institutionally contingent by scholars (Williams et al., 2013).

Consequently, deployed information security programs can be enterprise-centric as well

as comprehensive (Edwards, 2013; Mohare & Lanjewar, 2012; R. Davis, 2008).

Corporate manager-leaders should enhance strategic alignment attributes to achieve

effectual ISG (Yaokumah & Brown, 2014).

IT leaders usually plan, coordinate and recommend organizational information

assets deployments (R. Davis, 2008). Correspondingly, responsibility for planning IT

protection against unauthorized use and abuse should reside with the corporation's chief

information security officer (Mohare & Lanjewar, 2012; R. Davis, 2008). This

responsibility may include designing methods for preventing system attacks by external

as well as internal hackers and crackers that activate or exploit undesirable security

events (R. Davis, 2008). IT security manager-leader duties also typically include

establishing departmental policies, procedures, and standards for information assets;

based on the organizational structure (R. Davis, 2008).

IT opportunities, as well as threats, need evaluation, organization, and

management to reduce potential enterprise risks using available resources (Barrett, 2016;

Fenz et al., 2014; R. Davis, 2008). Effectual IAP technologies are valuable defense

mechanisms for combating inappropriate and malicious behavior (Claycomb et al., 2012).

Therefore, chief information security officers should assign responsibility for identifying

and evaluating deployed configuration management tools to ensure the corporate network

infrastructure maintains data integrity and availability (Boyes, 2015).

Stakeholders derive value from organizational justice cognitions, affiliation utility,

and opportunity cost perceptions (J. Harrison & Wicks, 2013). Extending agency theory

to diverse settings using a deductive approach is achievable through formally recognizing

and incorporating the institutional context encompassing the principal-agent relations into

agency-based models (Wiseman, Cuevas-Rodríguez, & Gomez-Mejia, 2012). Combined,

Stakeholder-Agency Theory explains why manager-leaders might overlook or ignore

stakeholder interests (Tashman & Raelin, 2013). As a particular, Stakeholder-Agency

Theory scholars have argued that market frictions can cause fragmentary contracting that

can misalign managerial abstractions of whom and what is significant to a corporation

(Tashman & Raelin, 2013). For instance, top management team may commit financial

resources to deploy an enterprise-wide ISG program that will ensure appropriate IAP, yet

abstains from using safeguards or other ISG program aspects (Garba et al., 2015;

Kushwaha, 2016).

Deeply embedded in employment social and physical context are security issues

(Carlson, 2014; R. Davis, 2008). Motives for information systems security

counterproductive work behavior can reflect employee organizational justice perceptions

(Willison & Warkentin, 2013). For which, organizations should focus on information

systems security awareness and moral beliefs (Vance & Siponen, 2012). Security

awareness is a process that interacts with the organizational context and with other

security management processes and elements (Tsohou, Karyda, Kokolakis, &

Kiountouzis, 2012). Monitoring of policies, user activities, network accesses, and

information security protocols can furnish opportunities to enrich training (Price, 2014).

Moreover, training improvements may occur through securing an emotional connection

or making the content especially pertinent (Price, 2014). Combined, adequate conduct

codes and training are beneficial in influencing employee conceptions of appropriate

behaviors (Vance & Siponen, 2012).

Organizational information security policies have a positive effect on subjective

norms towards information security conscious care behavior performance (Safa et al.,

2015). Nonetheless, it would serve corporations well to examine how much of their

employees’ time is spent on organizational tasks (Posey et al., 2014). High user

workloads create a conflict between assigned organizational tasks and information

security responsibilities (Posey et al., 2014). Employees who feel overburdened are more

likely to have lapses in information security vigilance (Posey et al., 2014).

According to decision theories under uncertainty, people choose an alternative

that brings the highest utility or prospect (Lee & Lee, 2012). Choice utility or prospect

consists of possible choice consequences, where each consequence has a weighted

subjective probability and utility (or value) for the decision maker (Lee & Lee, 2012). As

subcategorical decision theories, subjective expected utility theory and prospect theory

build on the same basic structure of possible outcomes and probabilities as well as

provision similar platforms (Lee & Lee, 2012).

On the other hand, subjective expected utility theory and prospect theory differ

from each other in model formulation and assumptions at the detail level (Lee & Lee,

2012). Subjective expected utility theory is a canonical decision theory that suggests a

normative decision model based on perfect rationality (Lee & Lee, 2012). The prospect

theory is a descriptive attempt to explain seemingly nonrational decisions that diverge

from canonical model predictions (Lee & Lee, 2012). Vance and Siponen (2012) found

perceived benefits had a substantial influence on employee noncompliance with

information system policies. Moreover, Ifinedo (2014) showed how social-organizational

and psychological factors might encourage or accentuate employee compliance with

information system security policies.

Employee decisions are essential to the achieving ISG goals (R. Davis, 2008).

Goal congruence influences the decision quality (R. Davis, 2008). If decision quality is

essential and if subordinates do not share the same ISG goals, manager-leaders face

losing control over expected activities (R. Davis, 2008) that may have detrimental

organizational effects. Hence, employee goal incongruence potentially suboptimizes ISG

decision quality (R. Davis, 2008). Therefore, manager-leaders must ensure employees

accept and comply with ISG goals (R. Davis, 2008). For which, manager-leaders should

acquire an in-depth understanding of the corporation’s business environment, processes,

and organizational objectives to enable provisioning information security services

congruent with organizational needs (Flores et al., 2014). Deep knowledge acquisition by

manager-leaders also permits effective coordination of information security activities

(Flores et al., 2014).

Manager-leaders should place considerable attention on risk management

(Magdaraog-Jr, 2014). Hierarchically, an organization’s control environment is an

important factor affecting IAP risk management (Mohare & Lanjewar, 2012; R. Davis,

2008). Risk management practitioners are aware of control system limitations in an

unethical control environment (R. Davis, 2008). Therefore, after completing the control

evaluation process, IAP control risk, as well as inherent risk, should be distinctively

delineated from residual risk to assist ethical manager-leaders in understanding

quantitative and qualitative control limitations (Nazareth & Choi, 2015; R. Davis, 2008).

Additionally, Kwon, Ulmer, and Wang (2013) indicated organizations need to assign

proper political influence concerning information security risks.

Stakeholders have placed pressure on corporate manager-leaders to engage in risk

management activities in supply chains (Cantor, Blackhurst, Pan, & Crum, 2014). In

response, supply chain managers should examine the technologies involved in network

configurations to assess vulnerabilities (Boyes, 2015). Organizational managers should

also refrain from performing or authorizing knowledge sharing across the supply chain

unless they are confident about protection mechanisms (Manzouri, Rahman, Nasimi, &

Arshad, 2013). Manzouri, Rahman, Nasimi, and Arshad (2013) presented a model for

securing information across the supply chain. Data collection occurred through a

literature review, investigating recent IT and conducting focus group interviews with

supply chain management and IT professionals (Manzouri et al., 2013). Resultantly, the

authors proposed Active Directory Federation Service as the best method to secure

information across the supply chain partners (Manzouri et al., 2013).

Internet-based technologies have brought organizational and customer advantages

(Safa et al., 2016). With an ever-increasing number of organizations and individuals

Internet-reliant for exchanging confidential and sensitive information, appropriate

message security is a technological management concern (Chatterjee et al., 2015; R.

Davis, 2008; Wlosinski, 2016). Researchers found security was significant for

ecommerce system quality (Homsud & Chaveesuk, 2014). Serviceable standard

ecommerce models include business-to-business (B2B) and business-to-consumer (B2C)

architectures (R. Davis, 2008; Z. Wang, Huang, & Tan, 2013). Delineated, B2B is

ecommerce between discernibly distinct organizations (R. Davis, 2008) and reflect open

standards (Sila, 2013). B2B links enable the exchange of products, services, or messages

between organizations (R. Davis, 2008; Sila, 2013). However, B2B e-commerce is more

vulnerable to security breaches when compared to legacy systems (Sila, 2013).

Electronic data interchange (EDI) methodologies are the forerunners and pillars of

Internet integrated B2B relationships (R. Davis, 2008). An analysis of business

wholesalers suggested that B2B e-commerce still relies on proprietary EDI systems (Sila,

2013). Depending on activity frequency and application, EDI control risk can become

material (R. Davis, 2008). Lack of direction, reliance on third parties, and system

dependencies potentially expose a corporation to additional legal, security, and

operational risks with an EDI system (R. Davis, 2008).

Customer loyalty determines B2C long-term success (Homsud & Chaveesuk,

2014). Regarding B2C models, Lee and Lee (2012) examined the responses of online

customers to a publicized information security incident. Lee and Lee developed and

tested a model of retreative behaviors triggered by a publicized information security

incident. The authors found an information security incident can cause a measurable

negative influence on customer behaviors although the effect seems mainly limited to that

particular website (Lee & Lee, 2012). The authors further found perceived damage, and

availability of alternative shopping sources can significantly increase retreative behaviors

of victimized customers (Lee & Lee, 2012). Last, the authors’ research revealed

perceived relative usefulness and ease-of-use of the website show limited effects in

reducing such behaviors (Lee & Lee, 2012).

Information security addresses safeguarding activities throughout information life

cycles as well as asset use within the established protection perimeter (R. Davis, 2008).

The primary objective of setting a security perimeter is provisioning an ambit for

enterprise-centric policies and protection (Konieczny, Trias, & Taylor, 2015).

Management typically designates an IAP perimeter to manage network IT security risks

programmatically (Konieczny et al., 2015). For IT-based networking, the main

improvements in protection mechanisms were e-mail user identity authentication and

email confidentiality as well as privacy transforming (Babrahem, Alharbi, Alshiky,

Alqurashi, & Kar, 2015). However, with the advent of linked information enclaves,

erecting layered protective barriers preserving IT configurations can introduce a tactical

security quagmire (Konieczny et al., 2015; H. Zhao et al., 2013). To reduce network

confounding, researchers have suggested employing usability heuristics (Jaferian,

Hawkey, Sotirakopoulos, & Velez-Rojas, 2014) and changing the IT architecture model

(Konieczny et al., 2015).

Corporate manager-leaders have a cogent incentive to identify and redress any

gaps that exist between their firm’s current access control and legal obligations.

Accessing information assets without permission is a criminally prosecutable offense (R.

Davis, 2008; Sen & Borle, 2015) as well as civilly litigable in the United States

(Romanosky, Hoffman, & Acquisti, 2014). Nonetheless, a high access control level can

decrease security flexibility (Thomson, 2012) and network performance (Hayajneh,

Mohd, Itradat, & Quttoum, 2013). To prevent, detect, or correct potential security gaps,

corporate IT leaders should voluntarily introduce formal IT related control selfassessment

procedures that assure adherence to legal obligations and organizational edicts (R. Davis,

2008).

Executives are leading the drive for bring your own device (Thomson, 2012), and

bring your own technology adoption in enterprises to achieve a competitive advantage.

Bring your own device and technology (BYODT) to the workplace trend has resulted in

security challenges (Olalere, Abdullah, Mahmod, & Abdullah, 2015). Governance is

critical to successful BYODT practices (Thomson, 2012). Governance includes

furnishing policy controls for BYODT management (Priyadarshi, 2013; Tokuyoshi,

2013). Manager-leaders are typically pursuing BYODT related policies for three reasons:

better and more costs savings, intuitive tool knowledge, and productivity gains

(Priyadarshi, 2013). However, there are security dangers that should give pause to

adopting BYODT work policies (Li & Clark, 2013; Priyadarshi, 2013; Tokuyoshi, 2013).

Specifically, resizing and integrating all organizational security requirements into a

personal device to protect work related information may present configuration challenges

(Li & Clark, 2013; Meng, Liu, Zhang, Pokluda, & Boutaba, 2015; Tokuyoshi, 2013).

Security performance measurement also becomes challenging in the cloud

computing environments (Avram, 2014; Herath & Herath, 2014; Kalloniatis, Mouratidis,

& Islam, 2013). A performance evaluation decision model allows organizations to choose

whether conducting an IT security audit is worthwhile (Herath & Herath, 2014). If

deemed beneficial, a question arises as to what additional factors need consideration

when engaging third-party assurance reporting (Herath & Herath, 2014) such as data

leakage during and after an audit as well as audit efficacy. Considering confidentiality, C.

Wang, Chow, Wang, Ren, and Lou (2013) conducted security and performance analytics

using experiment outcomes to demonstrate the proposed schemes furnish verifiable

protection and are highly efficient in a cloud computing environment. Resultantly, the

authors’ authenticator and random masking experiments generated evidence that a third

party auditor (TPA) would not obtain any stored data content knowledge on a cloud

server (C. Wang, Chow, Wang, Ren, & Lou, 2013). Additionally, regarding efficacy, the

experiments produced data that the TPA can perform various auditing tasks in a batch

manner for better efficiency (C. Wang et al., 2013).

Scholars suggested storage, virtualization, and networks are the biggest security

concerns in Cloud Computing (Hashizume et al., 2013). Complementary to the scholars’

assessment, Rai, Sahoo, and Mehfuz (2015) revealed through performing a systematic

literature review that a technical challenge when adopting Cloud Computing includes the

security architecture. As a potential technological remedy, Pfaff and Ries (2014)

emphasized using standards-based Web Single Sign-on protocols that provision

authentication requests with expressiveness and token security versatility. Subsequently,

Samanthula, Elmehdwi, Howser, and Madria (2015) suggested homomorphic encryption

and proxy re-encryption schemes can prevent the leakage of unauthorized data when a

revoked user rejoins the system. Consequently, IT leaders should deploy a comprehensive

risk assessment framework for information security to assist in the design of appropriate

employee IAP policies, procedures, standards, and rules.

Frameworks and standards. Frameworks can capture skewed model

distributions (Pagani, 2013). Frameworks can also serve as a tool for IT leaders to build

effective ISG programs (R. Davis, 2008). IT controls immersion should be transparent

throughout a corporation’s adopted ISG framework (R. Davis, 2008). As a prosecution

avoidance mechanism, deploying an exceptional ISG framework addressing every IT

resource can significantly reduce legal risks (R. Davis, 2008). ISG studies of standards, as

well as frameworks, address defining and providing contextual insights (Silic & Back,

2014).

Frameworks. Several researchers have introduced platform security frameworks.

Khalil, Khreishah, and Azeem (2014) proposed a cloud security framework that presented

the various defense lines and identified the dependency levels among them. Samanthula

et al. (2015) proposed a scheme to achieve fine-grained data sharing and access control

over the enterprise’s outsourced data in the cloud. Watfa, Khan, and Radmehr (2014)

developed and tested a proposed strategy framework for cloud single sign-on solutions

considering IT, business, and organizational domains.

Security related situations ensnaring deployed information systems have

additionally recast the way corporate employees conduct business with consumers as well

as other stakeholders (Srivastava & Kumar, 2015). Sindhuja (2014) developed and tested

an integrated information security framework that considers intra-organizational and

interorganizational activities as well as processes to strengthen the supply chain.

Similarly, Boyson (2014) developed and tested a Cyber Supply Chain Framework that

assists in determining risk governance, system integration, and operations initiative

coverage.

Properly framed, ISG supports stakeholder expectations regarding management’s

fiduciary responsibilities (R. Davis, 2008). IT application and user access multiplicity

increase the possibility of unauthorized events occurring during authorized IT sessions

(R. Davis, 2008). Information security manager-leaders can deploy a variety of

techniques to protect organizational information. Protection mechanisms are an essential

element to appropriate security (Sen & Borle, 2015). Baltatzis, Ilioudis, and Pangalos

(2012) developed and tested a proposed access control framework using a role

engineering method for collaborating organizations. Meng, Liu, Zhang, Pokluda, and

Boutaba (2015) also developed and tested a proposed collaborative framework that

enables node coordination for performing specific actions to enhance system or network

security.

Information security manager-leaders do not have the same degree of experience

with organizational information security breaches. Some information security

managerleaders have not experienced any information security breach. Other information

security manager-leaders have experienced several information security breaches.

Corporate IT leaders should establish an appropriate environment for information security

knowledge sharing (Safa & Solms, 2016). Researchers introduced frameworks that permit

securityincident managers with different trusted domains to share alarms and

countermeasures (Aguirre & Alonso, 2012). Tsohou et al. (2012) introduced a framework

that enables security awareness activities and interactions analysis with various

organizational processes and events. Similarly, Aguirre and Alonso (2012) developed and

tested a framed approach for improving the usability of security information and event

managers.

There is a perception that lack of focus and support causes information security

breaches. Organizations need a balanced approach to various technical, human and

organizational information security management challenges (A. Singh et al., 2013).

Primary punishment severity, reward significance, and control certainty effects are all

serious managerial actions with information security framework deployment (Kolkowska

& Dhillon, 2013; Y. Chen et al., 2012). Atoum et al. (2014) proposed a holistic cyber

security implementation framework to implement cyber security strategies. Williams et

al. (2013) presented a more multifaceted information protection view incorporating a

tiered technical and social features set that form and are established by governance

adaptations. Kushwaha (2016) proposed a framework for development and deployment of

an information security management system aligned with defined good governance

practices.

Organizational culture influences attitudes toward, and implementation of,

information security (D'Arcy & Greene, 2014; Edwards, 2013). The discernment of

information security manager-leaders is that organizational cultures are negative because

the information security culture is unacceptable as an operational element (Lopez, 2012).

Information security manager-leaders recognize that there is a need to improve

organizational information security. Information security manager-leaders saw the

necessity for improvement regarding how information security affects operations (Lopez,

2012). AlHogail (2015) devised a framework enabling effective information security

culture development for protecting organizational information assets.

As a cultural dimension, information security manager-leaders recognize that

there are some issues making communication with business manager-leaders difficult

(Lopez, 2012). Information security manager-leaders and business manager-leaders have

divergent views and goals making communication more demanding. There is a need for

information security manager-leaders and business manager-leaders to work together to

accomplish information security goals (Lopez, 2012). Davis (2008) constructed a practice

framework that abstracted managerial aspects permitting governance information and

communication alignment.

Standards. Ratiocinative information security standards must be designed and

implemented (Järveläinen, 2012). Evaluating the current information security state

requires comparison to accepted standards for performance measurement (R. Davis,

2008). Standards can reflect specific goals or objectives for comparison against

performance (R. Davis, 2011). IT leaders need to consider the importance of compliance

with standards for achieving effectual ISG (Lopez, 2012; Price, 2014). Effectiveness

evaluation requires measurement against established information security standards, yet

audits and standards play different roles in interorganizational IT relationships

(Järveläinen, 2012). Performance measurement point selection is critical to an effective

standard deployment (R. Davis, 2011). IT leaders should establish standards as baselines

for measuring quantity, weight, extent, value, or quality (R. Davis, 2011).

The ISO/IEC 27000 series empower information security managers with a method

for classifying and base-lining security, compliant with internationally accepted standards

(R. Davis, 2008; Sheikhpour & Modiri, 2012). Contextually, ISO/IEC 27001 provides

development and operation normative requirements regarding deployable and deployed

information security management systems (Sheikhpour & Modiri, 2012). Clauses

structure requirements for management systems that include objectives targeted by

information security controls (Sheikhpour & Modiri, 2012). The ISO/IEC 27001: 2015

version focuses on measuring and evaluating the organization’s information security

management system activities and performance. Therefore, ISO/IEC 27001 reflects a

security best practices set that permits benchmarking processes that enable governing a

corporation’s information security environment.

Effectual ISG. Information is data interpretation presented in a form that

furnishes value to a recipient (Da Veiga & Martins, 2015). Global telecommunications

services revenue was predicted to grow from $2.1 trillion USD in 2012 to $2.7 trillion

USD in 2017 at a combined average growth rate of 5.3% (Atoum et al., 2014).

Cyberattack proliferation threatens the confidentiality, integrity, and availability of IT

networks and e-commerce (Chatterjee et al., 2015). Corporate manager-leaders

worldwide are devoting significant financial resources to ensure enterprise information

security (Flores et al., 2014). For organizations in the United States, the 2014 average

total estimated cost per data breach was $5.9 million (Sen & Borle, 2015). Given cyber

attackers targeting large corporations achieved a 93% success rate during 2013 (Brewer,

2014), effectual security solutions are imperative to achieve trust relationships with

stakeholders.

Previous quantitative survey research benchmarked interindustry sector ISG

implementations and identified areas that might require improvement in developing

countries (Yaokumah, 2014). Yaokumah (2014) surveyed 360 individuals within 112

Ghanaian organizations for evaluating the ISG deployment status. The researcher found,

as a whole, the surveyed industry classifications have partially implemented ISG. The

Yaokumah ISG research revealed all surveyed Ghanaian industry sectors made marginal

efforts in aligning information security to business strategy, and performance

measurement was the least implemented ITGI ISG focus area. The research results also

revealed the ISG implementations differ significantly among the industry classifications

surveyed.

Robust corporate information security is a critical exceptional management model

factor (Stagliano & Sillup, 2014). Effectual ISG realization can occur through the

application of sound corporate governance theories (Yaokumah & Brown, 2014).

Effective ISG sustains policies, processes, personnel, and structures implemented by the

corporation’s oversight committee to inform, direct, manage, and monitor information

security activities towards objectives achievement (R. Davis, 2008). Strategic design

development typically occurs in sequential order--whether or not manager-leaders have a

formal or informal strategic planning system (R. Davis, 2011). Regarding design

operationalization, ITGI ISG practice effectiveness is evident in organizationally framed

domain outcomes (Yaokumah, 2014). Corporate IT leaders must evaluate and ensure the

quality of implemented protection mechanisms to achieve exceptional ISG performance

(Wu, Straub, & Liang, 2015).

Implicit in an aligned definition for effective ISG with corporate governance is

information security management’s fiduciary relationship with other stakeholders

(Yaokumah, 2013). The fiduciary relationship exists because there is typically an

inequality in knowledge or training (Brakewood & Poldrack, 2013) between information

security management and other stakeholders. Consequently, other stakeholders entrust

information security management to act in their best interest. Information security

management’s strategic alignment operationalization includes connection, congruence,

and participation abstractions (Schobel & Denford, 2013). Organizational information

asset valuation connection may only represent items that have the required criteria of

aiding in achieving a corporate business objective (R. Davis, 2008). However, based on

the interdependency theory, an organizational information asset unrelated to objective

achievement may compromise corporate business objective realization (R. Davis, 2008;

X. Zhao et al., 2013).

After deploying safeguarding mechanisms, critical business and ISG strategy

alignments must occur for subsequent improved firm performance (Wu et al., 2015). To

obtain an understanding of the processes and to facilitate analysis for ensuring ISG

service delivery alignment with the corporation’s strategic drive, each phase needs a

congruence appraisal to available resources (R. Davis, 2011). Through this assessment,

ISG effectiveness can reflect the proper perspective for achieving defined corporate

objectives (R. Davis, 2011). With effective ISG deployment, once ethical managerleaders

have adopted a strategic objective, courses of action by subordinates should reflect

attempts to achieve the desired end (R. Davis, 2011) through prevention and promotion

mindsets (Neubert, Wu, & Roberts, 2013). Therefore, ISG effectiveness induces doing

the right thing.

Employee engagement affects business operations, performance, and the ability to

differentiate from competitors (Brajer-Marczak, 2014). When corporate employees

develop a reputation for ensuring information confidentiality, integrity, and availability;

customers tend to exhibit electronic loyalty (Choi & Nazareth, 2014). Customers aid a

corporation in achieving value appropriation sustainability through electronic loyalty

(Price, 2014; Safa & Ismail, 2013). Manager-leaders who acquire reliable e-commerce

value appropriation can more accurately forecast organizational product and service

growth (Price, 2014). Consumer demand induced by enhanced e-commerce security can

subsequently benefit society because of the need for additional labor to support

organizational growth (Kaganer, Carmel, Hirschheim, & Olsen, 2013; Seferiadis,

Cummings, Zweekhorst, & Bunders, 2015).

Exercising effective corporate governance throughout an enterprise requires the

top-level oversight committee and management team have an unambiguous

understanding regarding what to expect from programs, systems, and processes (R.

Davis, 2008). Corporate manager-leaders should continually seek confirmation that

information security is delivering reliable services supporting the organization’s strategic

design for accomplishing adopted objectives (R. Davis, 2011). Without effectual ISG

deployment, often the information security unit is not involved in the decision-making

and approval-authorization process (R. Davis, 2011). Correspondingly, problems arise as

to who enforces standards, how manager-leaders assure their intentions are carried out

and how much autonomy users should have (R. Davis, 2011).

Empirical evidence exists that IT executive’s involvement in the top management

team relates negatively to the possibility of information security breaches (Kwon et al.,

2013). Effectual ISG necessitates information security manager-leader participation in the

decision-making process (R. Davis, 2011). Implementation decisions must reflect the

proper authority delegation to individuals responsible for acquiring, implementing,

utilizing, maintaining, as well as retiring information security systems (R. Davis, 2011).

Accordingly, an appropriate corporate control environment enhances ISG effectiveness.

Performance monitoring is enabled to ensure strategic alignment is earnestly pursued by

employees (R. Davis, 2011).

In viewing agency within an institutional framework; sufficient universality,

abstraction, and parsimony acquisition occur to aid in better understanding how, when,

and why moral hazard arises (Wiseman et al., 2012). An incentive framework for

corporate executives using contributions to IT can leverage the decision-making process

(Abraham, 2012). Kwon et al. (2013) investigated how the compensation of IT executives

relates to the risk of an information security breach. Kwon et al. found the amount of

behavior-based compensation and the pay differences of outcome-based compensation

between IT and nonIT executives associate negatively with the likelihood of information

security breaches. Kwon et al. suggested positions in the top management team need an

appropriately designed incentive scheme to motivate manager-leaders in line with

organizational goals for information security.

Strategic Alignment Variable Measurement

As a data collection tool for this study, the Yaokumah (2013) strategic alignment

survey instrument allows participants to record ISG domain implementation perceptions.

Yaokumah constructed the research strategic alignment instrument from the Australian

Trusted Information Sharing Network literature. Instrument development occurred to

measure the alignment level between ISG with business objectives and ISG effectiveness

(Yaokumah, 2013). The strategic alignment variable instrument had 13 statements that

used a 5-point Likert-like scale that gauged participant responses (Yaokumah, 2013). The

5-point Likert-like scale was as follows: 1 - not implemented (NS), 2 - planning stages

(PS), 3 - partially implemented (PI), 4 - close to completion (CC), and 5 - fully

implemented (FI; Yaokumah, 2013).

Similarly, Yaokumah (2014) developed survey items concerning strategic

alignment based on an Educause instrument that was slightly modified to include

variables defined by ITGI and the control objectives for information and related

technology (COBIT) framework. The instrument was designed to compare ISG strategic

alignment, risk management, value delivery, resource management, performance

measurement implementations among industry sectors (Yaokumah, 2014). The five

variables were measured on a 5-point Likert-like scale to gauge the responses of

participants (Yaokumah, 2014). The 5-point Likert-like scale was this: 1 - NS, 2 - PS, 3 -

PI, 4 - CC, and 5 - FI (Yaokumah, 2014).

In contrast, Yaokumah and Brown (2014) generated survey items concerning

strategic alignment based on ISG literature. The instrument was developed to evaluate

separately the relationship between ISG strategic alignment with business objectives and

ISG risk management, value delivery, resource management, as well as performance

measurement (Yaokumah & Brown, 2014). The five variables consisted of 50 items and

were measured on a 5-point Likert-like scale to gauge the responses of participants

(Yaokumah & Brown, 2014). The 5-point Likert-like scale was as follows: 1 - NS, 2 - PS,

3 - PI, 4 - CC, and 5 - FI (Yaokumah & Brown, 2014).

Value Delivery Variable Measurement

As a data collection tool for this study, the Yaokumah (2013) value delivery

survey instrument allows participants to record ISG domain implementation perceptions.

Yaokumah derived the research value delivery instrument from the ITGI. The ITGI is an

independent nonprofit research organization that guides the global business community

regarding information and technology related issues (Yaokumah, 2013). Yaokumah

developed the value delivery metric to measure the level that organizational ISG

investments deliver business value. The variable instrument consisted of five questions

and measurement on a 5-point Likert-like scale that gauged participant responses

regarding the degree of value delivery (Yaokumah, 2013). The 5-point Likert-like scale

was this: 1 - NS, 2 - PS, 3 - PI, 4 - CC, and 5 - FI (Yaokumah, 2013).

Similarly, Yaokumah (2014) developed survey items concerning value delivery

based on an Educause instrument that was slightly modified to include variables defined

by ITGI and the COBIT framework. The instrument was designed to compare ISG

strategic alignment, risk management, value delivery, resource management, performance

measurement implementations among industry sectors (Yaokumah, 2014). The five

variables were measured on a 5-point Likert-like scale to gauge the responses of

participants (Yaokumah, 2014). The 5-point Likert-like scale was as follows: 1 - NS, 2 -

PS, 3 - PI, 4 - CC, and 5 - FI (Yaokumah, 2014).

In contrast, Yaokumah and Brown (2014) generated survey items concerning

value delivery based on ISG literature. The instrument was developed to evaluate

separately the relationship between ISG strategic alignment with business objectives and

ISG risk management, value delivery, resource management, as well as performance

measurement (Yaokumah & Brown, 2014). The five variables consisted of 50 items and

were measured on a 5-point Likert-like scale to gauge the responses of participants

(Yaokumah & Brown, 2014). The 5-point Likert-like scale was as follows: 1 - NS, 2 - PS,

3 - PI, 4 - CC, and 5 - FI (Yaokumah & Brown, 2014).

Risk Management Variable Measurement

As a data collection tool for this study, the Yaokumah (2013) risk management

survey instrument allows participants to record ISG domain implementation perceptions.

Yaokumah adapted the research risk management instruments documented by Educause

and the Corporate Governance Task Force. The Corporate Governance Task Force was

formed to develop ISG frameworks, promote ISG practices at the strategic management

level, and drive effectual information security program deployments (Yaokumah, 2013).

Educause and the Corporate Governance Task Force extracted survey items from the

International Organization for Standardization/International Electrotechnical Commission

(ISO/IEC) 17799 and the Federal Information Security Management Act (Yaokumah,

2013). The variable instrument consisted of nine questions and measurement on a 5-point

Likert-like scale that gauged participant responses regarding risk management

(Yaokumah, 2013). The 5-point Likert-like scale was as follows: 1 - NS, 2 - PS, 3 - PI, 4

- CC, and 5 - FI (Yaokumah, 2013).

Similarly, Yaokumah (2014) developed survey items concerning risk management

based on an Educause instrument that was slightly modified to include variables defined

by ITGI and the COBIT framework. The instrument was designed to compare ISG

strategic alignment, risk management, value delivery, resource management, performance

measurement implementations among industry sectors (Yaokumah, 2014). The five

variables were measured on a 5-point Likert-like scale to gauge the responses of

participants (Yaokumah, 2014). The 5-point Likert-like scale was as follows: 1 - NS, 2 -

PS, 3 - PI, 4 - CC, and 5 - FI (Yaokumah, 2014).

In contrast, Yaokumah and Brown (2014) adopted survey items concerning risk

management from an Educause instrument. The instrument was used to evaluate

separately the relationship between ISG strategic alignment with business objectives and

ISG risk management, value delivery, resource management, as well as performance

measurement (Yaokumah & Brown, 2014). The five variables consisted of 50 items and

were measured on a 5-point Likert-like scale to gauge the responses of participants

(Yaokumah & Brown, 2014). The 5-point Likert-like scale was as follows: 1 - NS, 2 - PS,

3 - PI, 4 - CC, and 5 - FI (Yaokumah & Brown, 2014).

Performance Measurement Variable Measurement

As a data collection tool for this study, the Yaokumah (2013) performance

measurement survey instrument allows participants to record ISG domain implementation

perceptions. Yaokumah adapted the research performance measurement instruments

documented by Educause and the Corporate Governance Task Force. The Corporate

Governance Task Force was formed to develop ISG frameworks, promote ISG practices

at the strategic management level, and drive effectual information security program

deployments (Yaokumah, 2013). Educause and the Corporate Governance Task Force

extracted survey items from the ISO/IEC 17799 and the Federal Information Security

Management Act (Yaokumah, 2013). The variable instrument consisted of four questions

and measurement on a 5-point Likert-like scale that gauged participant responses

regarding performance management (Yaokumah, 2013). The 5-point Likertlike scale was

as follows: 1 - NS, 2 - PS, 3 - PI, 4 - CC, and 5 - FI (Yaokumah, 2013).

Similarly, Yaokumah (2014) developed survey items concerning performance

measurement based on an Educause instrument that was slightly modified to include

variables defined by ITGI and the COBIT framework. The instrument was designed to

compare ISG strategic alignment, risk management, value delivery, resource

management, performance measurement implementations among industry sectors

(Yaokumah, 2014). The five variables were measured on a 5-point Likert-like scale to

gauge the responses of participants (Yaokumah, 2014). The 5-point Likert-like scale was

as follows: 1 - NS, 2 - PS, 3 - PI, 4 - CC, and 5 - FI (Yaokumah, 2014).

In contrast, Yaokumah and Brown (2014) adopted survey items concerning

performance measurement from an Educause instrument. The instrument was used to

evaluate separately the relationship between ISG strategic alignment with business

objectives and ISG risk management, value delivery, resource management, as well as

performance measurement (Yaokumah & Brown, 2014). The five variables consisted of

50 items and were measured on a 5-point Likert-like scale to gauge the responses of

participants (Yaokumah & Brown, 2014). The 5-point Likert-like scale was as follows: 1

- NS, 2 - PS, 3 - PI, 4 - CC, and 5 - FI (Yaokumah & Brown, 2014).

Resource Management Variable Measurement

As a data collection tool for this study, the Yaokumah (2013) resource

management survey instrument allows participants to record ISG domain implementation

perceptions. Yaokumah adapted the research resource management instruments

documented by Educause and the Corporate Governance Task Force. The Corporate

Governance Task Force was formed to develop ISG frameworks, promote ISG practices

at the strategic management level, and drive the deployment of effectual information

security programs (Yaokumah, 2013). Educause and the Corporate Governance Task

Force extracted survey items from the ISO/IEC 17799 and the Federal Information

Security Management Act (Yaokumah, 2013). The variable instrument consisted of 19

questions and measurement on a 5-point Likert-like scale that gauged participant

responses regarding resource management (Yaokumah, 2013). The 5-point Likert-like

scale was as follows: 1 - NS, 2 - PS, 3 - PI, 4 - CC, and 5 - FI (Yaokumah, 2013).

Similarly, Yaokumah (2014) developed survey items concerning resource

management based on an Educause instrument that was slightly modified to include

variables defined by ITGI and the COBIT framework. The instrument was designed to

compare ISG strategic alignment, risk management, value delivery, resource

management, performance measurement implementations among industry sectors

(Yaokumah, 2014). The five variables were measured on a 5-point Likert-like scale to

gauge the responses of participants (Yaokumah, 2014). The 5-point Likert-like scale was

as follows: 1 - NS, 2 - PS, 3 - PI, 4 - CC, and 5 - FI (Yaokumah, 2014).

In contrast, Yaokumah and Brown (2014) adopted survey items concerning

resource management from an Educause instrument. The instrument was used to evaluate

separately the relationship between ISG strategic alignment with business objectives and

ISG risk management, value delivery, resource management, as well as performance

measurement (Yaokumah & Brown, 2014). The five variables consisted of 50 items and

were measured on a 5-point Likert-like scale to gauge the responses of participants

(Yaokumah & Brown, 2014). The 5-point Likert-like scale was as follows: 1 - NS, 2 - PS,

3 - PI, 4 - CC, and 5 - FI (Yaokumah & Brown, 2014).

ISG Effectiveness Variable Measurement

As a data collection tool for this study, the Yaokumah (2013) ISG effectiveness

survey instrument allows participants to record ISG domain implementation perceptions.

Yaokumah derived the ISG effectiveness instrument from practice literature documented

by Westby and Allen. ISG effectiveness was the criterion variable (Yaokumah, 2013).

Instrument development occurred to measure the relationship between ISG risk

management, value delivery, resource management, performance measurement

implementations, and ISG effectiveness (Yaokumah, 2013). The variable instrument

consisted of six statements and measurement on a 5-point Likert-like scale that gauged

participant responses regarding ISG effectiveness (Yaokumah, 2013). The ISG

effectiveness research survey instrument used a 5-point Likert-like scale that ranged from

1 strongly disagree (SD), 2 - disagree (D), 3 - not sure (NS), 4 - agree (A), and 5 -

strongly agree (SA; Yaokumah, 2013).

Transition

The purpose of this quantitative correlational study was to examine the

relationship between strategic alignment, resource management, risk management, value

delivery, performance measurement implementations, and ISG effectiveness in United

States-based corporations. Section 1 of this ISG study contains foundational research

information. The section also encompasses a meritorious presentation for conducting the

selected doctoral research domain. Topics I covered included the background of the

study, the problem and purpose statement, the nature of the study, the research question,

hypotheses; theoretical framework; operational definitions, study assumptions,

limitations, and delimitations; the significance of the study, and the literature review.

My ISG study addressed a population of the 500 largest for-profit United States

headquartered corporations using a corporate governance theory lens. The study sample

consisted of 454 strategic and tactical manager-leaders from the 500 largest for-profit

corporations headquartered within the United States geographic boundaries. The results

of my study may benefit businesses by assisting manager-leaders with improving ISG

practice areas for protecting information assets more effectively, and contribute to social

change through increased trust of IT. The study outcomes might add to the literature by

contributing to the body of knowledge related to ISG. In Section 2, I cover the purpose

statement, the role of the researcher, as well as the strategy used to select participants,

collect, validate, organize, and analyze data. In Section 3, I cover the presentation of

research outcomes, the business and social implications of the study, recommendation for

action, and recommendations for further research.

Section 2: The Project