Frame misalignment: Interpreting the implementation of information systems security certification in an organization

European Journal of Information Systems

Volumn 18, Issue 2, 2009, Pages 140-150

  Hsu, Carol W ^a  

^a NATIONAL TAIWAN UNIVERSITY   (Taiwan)

Author keywords

Institutionalization; Interpretive research; IS security; IS security standard; Security certification; Technological frames

Indexed keywords

EID: 67650137166     PISSN: 0960085X     EISSN: 14769344     Source Type: Journal    
DOI: 10.1057/ejis.2009.7     Document Type: Article

References (52)

1. ANG S and CUMMINGS L (1997) Strategic response to institutional influences on information systems outsourcing. Organization Science 8(3), 235-256.
2. BACKHOUSE J, HSU Cand SILVA L (2006) Circuits of power in creating de jure standards: shaping an international information systems security standard. MIS Quarterly 30(special issue), 413-438.
3. BANDURA A (1986) Social Foundations of Thought and Action: A Socio- cognitive Theory. Prentice-Hall, Englewood Cliffs, NJ.
4. BARRETT M (1999) Challenges of EDI adoption for electronic training in the London insurance market. European Journal of Information System 8(1), 1-15.
5. BECK Nand WALGENBACH P (2005) Technical efficiency or adaptation to institutionalized expectations? The adoption of ISO 9000 standards in the German mechanical engineering industry. Organization Studies 26(6), 841-866.
6. BOIRAL O (2003) ISO 9000: outside the iron cage. Organization Science 14(6), 720-737.
7. DAFT RL and WEICK K (1984) Toward a model of organizations as interpretive systems. Academy of Management Review 9(2), 284-295.
8. DARKE P, SANKS Gand BROADBENT M (1998) Successfully completing case study research: combining rigour, relevance and pragmatism. Information Systems Journal 8(4), 273-289.
9. DAVIDSON E (2006) A technological frames perspective on information technology and organizational change. The Journal of Applied Behavioural Science 42(1), 23-39.
10. DHILLON G and BACKHOUSE J (2001) Current directions in IS security research: towards socio-organizational perspectives. Information Systems Journal 11(2), 127-153.
11. DHILLON Gand TORKZADEH G (2006) Value-focused assessment of information system security in organizations. Information Systems Journal 16(3), 293-314.
12. DIMAGGIO PJ and POWELL WW (1983) The iron cage revisited: institutional isomorphism and collective rationality in organizational fields. American Sociological Review 48(2), 147-160.
13. DTI and PWC (2006) Information security breaches survey 2006 - Technical report.
14. GIOIA DA, THOMAS JB, CLARK SM and CHITTIPEDDI K (1994) Symbolism and strategic change in academia: the dynamics of sensemaking and influence. Organization Science 5(3), 363-383.
15. GORDON L, LOEB M, LUCYSHYN Wand RICHARDSON R(2006) CSI/FBI Computer Crime and Security Survey. Computer Security Institute, San Francisco.
16. GULER I, GUILLEN Mand MACPHERSON J (2002) Global competition institutions, and the diffusion of organizational practices: the international spread of ISO 9000 quality certificates. Administrative Science Quarterly 47(2), 207-233.
17. HAWORTH D and PIETRON L (2006) Sarbanes-Oxley: achieving compliance by starting with ISO 17799. Information Systems Management 23(1), 73-87.
18. HU Q, HART Pand COOKE D (2006) The role of external influences on organizational information security practices: an institutional perspective. In Proceedings of the 39th Hawaii International Conference on System Sciences p 1-10, Hawaii.
19. KEARVELL-WHITE B. (1996) National (U.K.) computer security survey. Information Management & Computer Security 4(3), 3-17.
20. KLEIN Hand MYERS M (1999) A set of principles for conducting and evaluating interpretive field studies in information systems. MIS Quarterly 23(1), 67-94.
21. LIN Aand CORNFORD T (2000) Framing implementation management. In Proceedings of the Twenty-First International Conference on Information Systems p 197-205, Brisbane, Australia.
22. LIN Aand SILVA L (2005) The social and political construction of technological frames. European Journal of Information Systems 14(1), 49-59.
23. MARKUS L, STEINFIELD Cand WIGARD R (2006) Industry-wide information systems standardization as collective action: the case of the U.S. residential mortgage industry. MIS Quarterly 30(special issue), 439-465.
24. MCLOUGHLIN I, BADHAM Rand COUCHMAN P (2000) Rethinking political process in technological change: socio-technical configurations and frames. Technology Analysis & Strategic Management 12(1), 17-37.
25. MINSKY M (1975) A framework for representing knowledge. In The Psychology of Computer Vision (WINSTON P, Ed), pp 211-277, McGraw- Hill, New York.
26. MYERS Mand NEWMAN M (2007) The qualitative interview in IS research: examining the craft. Information and Organization 17(1), 2-26.
27. ORLIKOWSKI W (1993) Learning from notes: organizational issues in groupware implementation. Information Society 9(3), 237-250.
28. ORLIKOWSKI W (2000) Using technology and constituting structures: a practice lens for studying technology in organizations. Organization Science 11(4), 404-428.
29. ORLIKOWSKI Wand GASH D (1994) Technological frames: making sense of information technology in organizations. ACM Transactions on Information Systems 12(2), 174-207.
30. PINCH TJ and BIJKER WE (1987) The social construction of facts and artefacts: or how the sociology of science and the sociological of technology might benefit each other. in The Social Construction of Technology Systems (BIJKER WE, HUGHES Tand PINCH TJ, Eds), pp 17-50, MIT Press, Cambridge, MA.
31. SHANNON W, ANDERSSON J, DALY Dand JOHNSON M (1999) Why firms seek ISO 9000 certification regulatory compliance or competitive advantage? Production and Operation Management 8(1), 28-43.
32. SIPONEN M (2000) A conceptual foundation for organizational information security awareness. Information Management & Computer Security 8(1), 31-41.
33. SIPONEN M (2003) Information security management standards: problems and solutions. in Proceedings of the Seventh Pacific Asia Conference on Information Systems p 1550-1561, Adelaide, Australia.
34. SIPONEN M (2005) An analysis of the traditional IS security approaches: implications for research and practice. European Journal of Information Systems 14(3), 303-315.
35. SIPONEN M (2006) Information security standards focus on the existence of process, not its content? Communications of the ACM 49(8), 97-100.
36. SIPONEN M and IIVARI J (2006) Six design theories for IS security policies and guidelines. Journal of Association for Information Systems 7(7), 445-472.
37. SIPONEN Mand WILLISON R (2007) A critical assessment of IS security research between 1990-2004. in Proceedings of Fifteenth European Conference on Information Systems p 1551-1559, St. Gallen, Switzerland.
38. TASHI I and GHERNAOUTI-HELIE S (2007) ISO security standards as a leverage on IT security management. In Proceedings of the Thirteenth Americas Conference on Information Systems p 63, Keystone, USA.
39. TEJAY G (2005) Making sense of information systems security standards. in Proceedings of Eleventh Americas Conference on Information Systems p 3344-3348, Omaha, NE, USA.
40. TERLAAK A (2007) Order without law? The role of certified management standards in shaping socially desired firm behaviors. Academy of Management Review 32(3), 968-985.
41. TERLAAK Aand KING A (2006) The effect of certification with the ISO 9000 quality management standard: a signaling approach. Journal of Economic Behaviour & Organization 60(4), 579-602.
42. THOMSON Mand VON SOLMS R (1998) Information security awareness: educating your users effectively. Information Management & Computer Security 6(4), 167-173.
43. TINGLING Pand PARENT M (2002) Mimetic isomorphism & technology evaluation: does limitation transcend judgement? Journal of Association for Information Systems 3(1), 113-143.
44. VON SOLMS R (1998) Information security management (3): the code of practice for information security management. Information Management & Computer Security 6(5), 224-225.
45. VON SOLMS R (1999) Information security management: why standards are important. Informaton Management & Computer Security 7(1), 50-57.
46. VROOM Cand VON SOLMS R (2004) Towards information security behavioral compliance. Computer & Security 23(3), 191-198.
47. WALSHAM G (1995) Interpretive case studies in IS research: nature and method. European Journal of Information Systems 4(2), 74-81.
48. WALSHAM G (2006) Doing interpretive research. European Journal of Information Systems 15(3), 320-330.
49. WESTPHAL J, GULATI Rand SHORTELL S (1997) Customization or conformity? An institutional and network perspective on the content and consequences of TQM adoption. Administrative Science Quarterly 42(2), 366-394.
50. WIANDER T (2007) Positive and negative findings of the ISO/IEC 17799 framework. In Proceedings of the Eighteenth Australasian Conference on Information Systems p 622-663, Toowoomba.
51. WIANDER T (2008) Implementing the ISO/IEC 17799 standard in practice - experiences on audit phases. In Proceedings of the Australasian Information Security Conference, Wollongong, Australia.
52. YIN R (1994) Case Study Research Design and Methods. SAGE Publications, Thousand Oaks.