IDEAS home Printed from https://ideas.repec.org/a/spr/infsem/v21y2023i3d10.1007_s10257-023-00646-y.html
   My bibliography  Save this article

Information security objectives and the output legitimacy of ISO/IEC 27001: stakeholders’ perspective on expectations in private organizations in Sweden

Author

Listed:
  • Yasmin Kamil

    (Örebro University School of Business)

  • Sofia Lund

    (Örebro University School of Business)

  • M Sirajul Islam

    (Örebro University School of Business
    Alfaisal University)

Abstract

Organizations use the ISO/IEC 27001 standard to establish an information security management system (ISMS). This standard outlines specific security measures and requirements that organizations can implement to effectively manage their information assets. However, the effectiveness of the standard’s problem-solving capabilities has raised some questions. Consequently, there is a continuous development of new governance methods that demand fresh approaches to validate security operations and measures. In light of this, research is being conducted to examine the application and impact of ISO/IEC 27001, as well as to analyze the challenges and knowledge gaps through theoretical perspectives. By employing stakeholder theory, the focus shifts towards integrating business and social issues and exploring how non-business pressures can influence stakeholder motivations in implementing standards. Additionally, it investigates the impact of these standards on an organization’s reputation, performance, and operations. Therefore, the objective of this study is to investigate the output legitimacy of ISO/IEC 27001 from the perspective of stakeholder expectations. To accomplish this, an interview-based study was conducted, involving relevant stakeholders engaged in information security management within private organizations in Sweden. The findings reveal eight key information security objectives. The results indicate that the level of output legitimacy of the standard varies across these objectives, ranging from high to medium to low. To achieve a high level of output legitimacy for ISO/IEC 27001, stakeholders must understand that the standard is not solely a technical document. Furthermore, stakeholders need to possess the appropriate knowledge and skills in information security to effectively navigate their work while leveraging the support provided by the standard.

Suggested Citation

  • Yasmin Kamil & Sofia Lund & M Sirajul Islam, 2023. "Information security objectives and the output legitimacy of ISO/IEC 27001: stakeholders’ perspective on expectations in private organizations in Sweden," Information Systems and e-Business Management, Springer, vol. 21(3), pages 699-722, September.
    • Handle: RePEc:spr:infsem:v:21:y:2023:i:3:d:10.1007_s10257-023-00646-y
    DOI: 10.1007/s10257-023-00646-y
    as

    Download full text from publisher

    File URL: http://link.springer.com/10.1007/s10257-023-00646-y
    File Function: Abstract
    Download Restriction: Access to the full text of the articles in this series is restricted.
    File URL: https://libkey.io/10.1007/s10257-023-00646-y?utm_source=ideas
    LibKey link: if access is restricted and if your library uses this service, LibKey will redirect you to where you can use your library subscription to access this item
    ---><---

    As the access to this document is restricted, you may want to

    for a different version of it.

    References listed on IDEAS

    as
    1. Vivien A. Schmidt, 2013. "Democracy and Legitimacy in the European Union Revisited: Input, Output and ‘Throughput’," Political Studies, Political Studies Association, vol. 61(1), pages 2-22, March.
    2. Dr N K Sharma & Prabir Kumar Dash, 2012. "Effectiveness Of Iso 27001, As An Information Security Management System: An Analytical Study Of Financial Aspects," Far East Journal of Psychology and Business, Far East Research Centre, vol. 9(5), pages 57-71, December.
    3. Alan Richardson & Burkard Eberlein, 2011. "Legitimating Transnational Standard-Setting: The Case of the International Accounting Standards Board," Journal of Business Ethics, Springer, vol. 98(2), pages 217-245, January.
    4. Mena, Sébastien & Palazzo, Guido, 2012. "Input and Output Legitimacy of Multi-Stakeholder Initiatives," Business Ethics Quarterly, Cambridge University Press, vol. 22(3), pages 527-556, July.
    5. Antonio Santos-Olmo & Luis Enrique Sánchez & Ismael Caballero & Sara Camacho & Eduardo Fernandez-Medina, 2016. "The Importance of the Security Culture in SMEs as Regards the Correct Management of the Security of Their Assets," Future Internet, MDPI, vol. 8(3), pages 1-27, July.
    Full references (including those not matched with items on IDEAS)

    Most related items

    These are the items that most often cite the same works as this one and are cited by the same works as this one.
    1. Sébastien Mena & Daniel Waeger, 2014. "Activism for Corporate Responsibility: Conceptualizing Private Regulation Opportunity Structures," Journal of Management Studies, Wiley Blackwell, vol. 51(7), pages 1091-1117, November.
    2. Christoph Engel & Luigi Mittone & Azzurra Morreale, 2024. "Outcomes or participation? Experimentally testing competing sources of legitimacy for taxation," Economic Inquiry, Western Economic Association International, vol. 62(2), pages 563-583, April.
    3. Isuru Koswatte & Chandrika Fernando, 2022. "Policy Development for Crisis Management in the Context of Sri Lanka," Managing Global Transitions, University of Primorska, Faculty of Management Koper, vol. 20(3 (Fall)), pages 295-327.
    4. John R. Moodie & Viktor Salenius & Michael Kull, 2022. "From impact assessments towards proactive citizen engagement in EU cohesion policy," Regional Science Policy & Practice, Wiley Blackwell, vol. 14(5), pages 1113-1132, October.
    5. Thereza RS de Aguiar, 2018. "Turning accounting for emissions rights inside out as well as upside down," Environment and Planning C, , vol. 36(1), pages 139-159, February.
    6. Sharifah R.S. DAWOOD, 2023. "The Use Of Quadruple Helix Model In Smart Cities Development: Evidence From Bandar Cassia Township In Penang, Malaysia," Theoretical and Empirical Researches in Urban Management, Research Centre in Public Administration and Public Services, Bucharest, Romania, vol. 18(2), pages 78-100, May.
    7. Niedziałkowski, Krzysztof & Shkaruba, Anton, 2018. "Governance and legitimacy of the Forest Stewardship Council certification in the national contexts – A comparative study of Belarus and Poland," Forest Policy and Economics, Elsevier, vol. 97(C), pages 180-188.
    8. Julia Rotter & Peppi-Emilia Airike & Cecilia Mark-Herbert, 2014. "Exploring Political Corporate Social Responsibility in Global Supply Chains," Journal of Business Ethics, Springer, vol. 125(4), pages 581-599, December.
    9. Xiaoli Zhao & Pavel Castka & Cory Searcy, 2020. "ISO Standards: A Platform for Achieving Sustainable Development Goal 2," Sustainability, MDPI, vol. 12(22), pages 1-19, November.
    10. S. Susela Devi & R. Helen Samujh, 2015. "The Political Economy of Convergence: The Case of IFRS for SMEs," Australian Accounting Review, CPA Australia, vol. 25(2), pages 124-138, June.
    11. Onna Malou van den Broek, 2024. "How Political Actors Co‐Construct CSR and its Effect on Firms' Political Access: A Discursive Institutionalist View," Journal of Management Studies, Wiley Blackwell, vol. 61(2), pages 595-626, March.
    12. Christoph Klika, 2015. "The Implementation of the REACH Authorisation Procedure on Chemical Substances of Concern: What Kind of Legitimacy?," Politics and Governance, Cogitatio Press, vol. 3(1), pages 128-138.
    13. Vincent Caby & Lise Frehen, 2021. "How to Produce and Measure Throughput Legitimacy? Lessons from a Systematic Literature Review," Politics and Governance, Cogitatio Press, vol. 9(1), pages 226-236.
    14. Francesco De Luca & Jenice Prather-Kinsey, 2018. "Legitimacy theory may explain the failure of global adoption of IFRS: the case of Europe and the U.S," Journal of Management & Governance, Springer;Accademia Italiana di Economia Aziendale (AIDEA), vol. 22(3), pages 501-534, September.
    15. Angelika Zimmermann & Nora Albers & Jasper O. Kenter, 2022. "Deliberating Our Frames: How Members of Multi-Stakeholder Initiatives Use Shared Frames to Tackle Within-Frame Conflicts Over Sustainability Issues," Journal of Business Ethics, Springer, vol. 178(3), pages 757-782, July.
    16. Lechler, Marie, 2019. "Employment shocks and anti-EU sentiment," European Journal of Political Economy, Elsevier, vol. 59(C), pages 266-295.
    17. Mikkel Kruuse & Kasper Reming Tangbæk & Kristjan Jespersen & Caleb Gallemore, 2019. "Navigating Input and Output Legitimacy in Multi-Stakeholder Initiatives: Institutional Stewards at Work," Sustainability, MDPI, vol. 11(23), pages 1-27, November.
    18. Venkatesh, V.G. & Zhang, Abraham & Deakins, Eric & Mani, Venkatesh, 2021. "Antecedents of social sustainability noncompliance in the Indian apparel sector," International Journal of Production Economics, Elsevier, vol. 234(C).
    19. Domenico Dentoni & Verena Bitzer & Greetje Schouten, 2018. "Harnessing Wicked Problems in Multi-stakeholder Partnerships," Journal of Business Ethics, Springer, vol. 150(2), pages 333-356, June.
    20. Durocher, Sylvain & Picard, Claire-France & Dugal, Léa, 2024. "Giving sense to and making sense of OCI: When each component makes sense, but the whole does not," CRITICAL PERSPECTIVES ON ACCOUNTING, Elsevier, vol. 99(C).

    More about this item

    Keywords

    ;
    ;
    ;
    ;
    ;
    ;

    Statistics

    Access and download statistics

    Corrections

    All material on this site has been provided by the respective publishers and authors. You can help correct errors and omissions. When requesting a correction, please mention this item's handle: RePEc:spr:infsem:v:21:y:2023:i:3:d:10.1007_s10257-023-00646-y. See general information about how to correct material in RePEc.

    If you have authored this item and are not yet registered with RePEc, we encourage you to do it here. This allows to link your profile to this item. It also allows you to accept potential citations to this item that we are uncertain about.

    If CitEc recognized a bibliographic reference but did not link an item in RePEc to it, you can help with this form .

    If you know of missing items citing this one, you can help us creating those links by adding the relevant references in the same way as above, for each refering item. If you are a registered author of this item, you may also want to check the "citations" tab in your RePEc Author Service profile, as there may be some citations waiting for confirmation.

    For technical questions regarding this item, or to correct its authors, title, abstract, bibliographic or download information, contact: Sonal Shukla or Springer Nature Abstracting and Indexing (email available below). General contact details of provider: http://www.springer.com .

    Please note that corrections may take a couple of weeks to filter through the various RePEc services.

    IDEAS is a RePEc service. RePEc uses bibliographic data supplied by the respective publishers.