Towards software for tailoring information security policies to organisations’ different target groups
Year: 2025
Type: article
Abstract: Designing accessible and relevant information security policies (ISPs) that support employees is crucial for improving organisations’ information security. When employees are required to deal with cumbersome ISPs, there is a risk of reduced motivation towards information security, and employees’ not following the rules in ISPs has been reported as a persistent issue. Existing research has suggested adopting a tailored approach to ISPs in order to enhance their relevance to employees. Tailoring is difficult and time consuming and information security managers lack information security management systems software (ISMSS) that can assist with this tailoring task. In this paper, we develop a design theory for ISMSS to support information security managers in tailoring ISPs to different employees. To achieve this, we employ design science research, drawing on prior studies concerning the tailoring of systems development methods. We evaluate the design theory through an expository instantiation, POLCO, and with information security managers, demonstrating both proof-of-concept and proof-of-value.
Source: Computers & Security
Authors: Elham Rostami, Fredrik Karlsson, Ella Kolkowska, Shang Gao
Institution: Örebro University
Language: English
Subfield: Information Systems
Field: Computer Science
Domain: Physical Sciences
Open Access status: hybrid
Estimated APC paid: $3,100
OpenAlex ID: W7083578919