IDEAS home Printed from https://ideas.repec.org/a/spr/infsem/v21y2023i3d10.1007_s10257-023-00646-y.html
   My bibliography  Save this article

Information security objectives and the output legitimacy of ISO/IEC 27001: stakeholders’ perspective on expectations in private organizations in Sweden

Author

Listed:
  • Yasmin Kamil

    (Örebro University School of Business)

  • Sofia Lund

    (Örebro University School of Business)

  • M Sirajul Islam

    (Örebro University School of Business
    Alfaisal University)

Abstract

Organizations use the ISO/IEC 27001 standard to establish an information security management system (ISMS). This standard outlines specific security measures and requirements that organizations can implement to effectively manage their information assets. However, the effectiveness of the standard’s problem-solving capabilities has raised some questions. Consequently, there is a continuous development of new governance methods that demand fresh approaches to validate security operations and measures. In light of this, research is being conducted to examine the application and impact of ISO/IEC 27001, as well as to analyze the challenges and knowledge gaps through theoretical perspectives. By employing stakeholder theory, the focus shifts towards integrating business and social issues and exploring how non-business pressures can influence stakeholder motivations in implementing standards. Additionally, it investigates the impact of these standards on an organization’s reputation, performance, and operations. Therefore, the objective of this study is to investigate the output legitimacy of ISO/IEC 27001 from the perspective of stakeholder expectations. To accomplish this, an interview-based study was conducted, involving relevant stakeholders engaged in information security management within private organizations in Sweden. The findings reveal eight key information security objectives. The results indicate that the level of output legitimacy of the standard varies across these objectives, ranging from high to medium to low. To achieve a high level of output legitimacy for ISO/IEC 27001, stakeholders must understand that the standard is not solely a technical document. Furthermore, stakeholders need to possess the appropriate knowledge and skills in information security to effectively navigate their work while leveraging the support provided by the standard.

Suggested Citation

  • Yasmin Kamil & Sofia Lund & M Sirajul Islam, 2023. "Information security objectives and the output legitimacy of ISO/IEC 27001: stakeholders’ perspective on expectations in private organizations in Sweden," Information Systems and e-Business Management, Springer, vol. 21(3), pages 699-722, September.
    • Handle: RePEc:spr:infsem:v:21:y:2023:i:3:d:10.1007_s10257-023-00646-y
    DOI: 10.1007/s10257-023-00646-y
    as

    Download full text from publisher

    File URL: http://link.springer.com/10.1007/s10257-023-00646-y
    File Function: Abstract
    Download Restriction: Access to the full text of the articles in this series is restricted.
    File URL: https://libkey.io/10.1007/s10257-023-00646-y?utm_source=ideas
    LibKey link: if access is restricted and if your library uses this service, LibKey will redirect you to where you can use your library subscription to access this item
    ---><---

    As the access to this document is restricted, you may want to search for a different version of it.

    References listed on IDEAS

    as
    1. Alan Richardson & Burkard Eberlein, 2011. "Legitimating Transnational Standard-Setting: The Case of the International Accounting Standards Board," Journal of Business Ethics, Springer, vol. 98(2), pages 217-245, January.
    2. Mena, Sébastien & Palazzo, Guido, 2012. "Input and Output Legitimacy of Multi-Stakeholder Initiatives," Business Ethics Quarterly, Cambridge University Press, vol. 22(3), pages 527-556, July.
    3. Vivien A. Schmidt, 2013. "Democracy and Legitimacy in the European Union Revisited: Input, Output and ‘Throughput’," Political Studies, Political Studies Association, vol. 61(1), pages 2-22, March.
    4. Antonio Santos-Olmo & Luis Enrique Sánchez & Ismael Caballero & Sara Camacho & Eduardo Fernandez-Medina, 2016. "The Importance of the Security Culture in SMEs as Regards the Correct Management of the Security of Their Assets," Future Internet, MDPI, vol. 8(3), pages 1-27, July.
    5. Dr N K Sharma & Prabir Kumar Dash, 2012. "Effectiveness Of Iso 27001, As An Information Security Management System: An Analytical Study Of Financial Aspects," Far East Journal of Psychology and Business, Far East Research Centre, vol. 9(5), pages 57-71, December.
    Full references (including those not matched with items on IDEAS)

    Most related items

    These are the items that most often cite the same works as this one and are cited by the same works as this one.
    1. Sébastien Mena & Daniel Waeger, 2014. "Activism for Corporate Responsibility: Conceptualizing Private Regulation Opportunity Structures," Journal of Management Studies, Wiley Blackwell, vol. 51(7), pages 1091-1117, November.
    2. Richard Hyman & Rebecca Gumbrell-McCormick, 2020. "(How) can international trade union organisations be democratic?," Transfer: European Review of Labour and Research, , vol. 26(3), pages 253-272, August.
    3. Thomas Maak & Nicola M. Pless & Christian Voegtlin, 2016. "Business Statesman or Shareholder Advocate? CEO Responsible Leadership Styles and the Micro-Foundations of Political CSR," Journal of Management Studies, Wiley Blackwell, vol. 53(3), pages 463-493, May.
    4. Christoph Engel & Luigi Mittone & Azzurra Morreale, 2024. "Outcomes or participation? Experimentally testing competing sources of legitimacy for taxation," Economic Inquiry, Western Economic Association International, vol. 62(2), pages 563-583, April.
    5. Alexander Kentikelenis & Erik Voeten, 2021. "Legitimacy challenges to the liberal world order: Evidence from United Nations speeches, 1970–2018," The Review of International Organizations, Springer, vol. 16(4), pages 721-754, October.
    6. Isuru Koswatte & Chandrika Fernando, 2022. "Policy Development for Crisis Management in the Context of Sri Lanka," Managing Global Transitions, University of Primorska, Faculty of Management Koper, vol. 20(3 (Fall)), pages 295-327.
    7. John R. Moodie & Viktor Salenius & Michael Kull, 2022. "From impact assessments towards proactive citizen engagement in EU cohesion policy," Regional Science Policy & Practice, Wiley Blackwell, vol. 14(5), pages 1113-1132, October.
    8. Carina I. Hausladen & Regula Hänggli Fricker & Dirk Helbing & Renato Kunz & Junling Wang & Evangelos Pournaras, 2024. "How voting rules impact legitimacy," Palgrave Communications, Palgrave Macmillan, vol. 11(1), pages 1-10, December.
    9. Marlous Blankesteijn & Bart Bossink, 2020. "Assessing the Legitimacy of Technological Innovation in the Public Sphere: Recovering Raw Materials from Waste Water," Sustainability, MDPI, vol. 12(22), pages 1-16, November.
    10. Thereza RS de Aguiar, 2018. "Turning accounting for emissions rights inside out as well as upside down," Environment and Planning C, , vol. 36(1), pages 139-159, February.
    11. Vivek Pandey & Natalia Vidal & Rajat Panwar & Lubna Nafees, 2019. "Characterization of Sustainability Leaders and Laggards in the Global Food Industry," Sustainability, MDPI, vol. 11(18), pages 1-14, September.
    12. Sharifah R.S. DAWOOD, 2023. "The Use Of Quadruple Helix Model In Smart Cities Development: Evidence From Bandar Cassia Township In Penang, Malaysia," Theoretical and Empirical Researches in Urban Management, Research Centre in Public Administration and Public Services, Bucharest, Romania, vol. 18(2), pages 78-100, May.
    13. Nikitas Konstantinidis & Konstantinos Matakos & Hande Mutlu-Eren, 2019. "“Take back control”? The effects of supranational integration on party-system polarization," The Review of International Organizations, Springer, vol. 14(2), pages 297-333, June.
    14. Niedziałkowski, Krzysztof & Shkaruba, Anton, 2018. "Governance and legitimacy of the Forest Stewardship Council certification in the national contexts – A comparative study of Belarus and Poland," Forest Policy and Economics, Elsevier, vol. 97(C), pages 180-188.
    15. Julia Rotter & Peppi-Emilia Airike & Cecilia Mark-Herbert, 2014. "Exploring Political Corporate Social Responsibility in Global Supply Chains," Journal of Business Ethics, Springer, vol. 125(4), pages 581-599, December.
    16. Scherer, Andreas, 2013. "Legitimacy Strategies in a Globalized World: Organizing for Complex and Heterogeneous Environments," Papers 566, World Trade Institute.
    17. Kohler, Hervé & Pochet, Christine & Le Manh, Anne, 2021. "Auditors as intermediaries in the endogenization of an accounting standard: The case of IFRS 15 within the telecom industry," Accounting, Organizations and Society, Elsevier, vol. 91(C).
    18. Hugh Breakey, 2021. "Harnessing Multidimensional Legitimacy for Codes of Ethics: A Staged Approach," Journal of Business Ethics, Springer, vol. 170(2), pages 359-373, May.
    19. Xiaoli Zhao & Pavel Castka & Cory Searcy, 2020. "ISO Standards: A Platform for Achieving Sustainable Development Goal 2," Sustainability, MDPI, vol. 12(22), pages 1-19, November.
    20. S. Susela Devi & R. Helen Samujh, 2015. "The Political Economy of Convergence: The Case of IFRS for SMEs," Australian Accounting Review, CPA Australia, vol. 25(2), pages 124-138, June.

    Corrections

    All material on this site has been provided by the respective publishers and authors. You can help correct errors and omissions. When requesting a correction, please mention this item's handle: RePEc:spr:infsem:v:21:y:2023:i:3:d:10.1007_s10257-023-00646-y. See general information about how to correct material in RePEc.

    If you have authored this item and are not yet registered with RePEc, we encourage you to do it here. This allows to link your profile to this item. It also allows you to accept potential citations to this item that we are uncertain about.

    If CitEc recognized a bibliographic reference but did not link an item in RePEc to it, you can help with this form .

    If you know of missing items citing this one, you can help us creating those links by adding the relevant references in the same way as above, for each refering item. If you are a registered author of this item, you may also want to check the "citations" tab in your RePEc Author Service profile, as there may be some citations waiting for confirmation.

    For technical questions regarding this item, or to correct its authors, title, abstract, bibliographic or download information, contact: Sonal Shukla or Springer Nature Abstracting and Indexing (email available below). General contact details of provider: http://www.springer.com .

    Please note that corrections may take a couple of weeks to filter through the various RePEc services.

    IDEAS is a RePEc service. RePEc uses bibliographic data supplied by the respective publishers.