A role of information security committee based on competing values framework

Abstract

Nowadays it is getting important to establish enterprise information security system in a corporate governance dimension for managing various risk like reinforcement of compliance requirement and significant impact of IT. However there are lots of obstacles to implement enterprise-wide information security activities and top management commitment seems to be insufficient. Especially a committee which consisted of top management related to information security does not support information security programs sufficiently. Nevertheless the importance of information security governance has been studied extensively but rarely studied a role of information security committee. Provided that the point of information security governance is about top management commitment, information security committee can be a good solution to solve internal and external problems related to information security. The purpose of this research is to propose roles of information security committee using Quinn's Competing Values Framework(CVF) that provides analytic methodology. Finally, the result is discussed with specialists in the field of information security to accept their opinion. © 2015 Copyright held by the owner/author(s). Publication rights licensed to ACM.