National information security policy and its implementation: A case study in Taiwan

Authors:
Cheng-Yuan Ku;Yi-Wen Chang;David C. Yen
Affiliations:
Department of Information Management, National Chung Cheng University, Chia-Yi County, Taiwan, ROC;Department of Information Management, National Chung Cheng University, Chia-Yi County, Taiwan, ROC;Department of DSC and MIS, Miami University, Oxford, OH 45056, USA
Venue:
Telecommunications Policy
Year:
2009

Citing 8
Cited 0

The case research strategy in studies of information systems

MIS Quarterly
Security concerns of system users: a study of perceptions of the adequacy of security

Information and Management
Coping with systems risk: security planning models for management decision making

MIS Quarterly
Computer security—an end state?

Communications of the ACM
An Information Systems Security Risk Assessment Model Under the Dempster-Shafer Theory of Belief Functions

Journal of Management Information Systems
Determinants of success for application service provider: An empirical test in small businesses

International Journal of Human-Computer Studies
Information security considerations in IS/IT outsourcing projects: a descriptive case study of two sectors

International Journal of Information Management: The Journal for Information Professionals
An integrative study of information systems security effectiveness

International Journal of Information Management: The Journal for Information Professionals

Quantified Score

Hi-index	0.00

Visualization

Abstract

Cyberspace is no longer safe. From business organizations to countries, the requirements of information security and assurance have become one of the most important functions to ensure continued operations. The goal of this study is twofold. First, we introduce the information security policy of the Taiwanese government and its current status. Then we present a successful example of governmental institute that self-adopted the information security management system (ISMS), British Standard 7799 (ISO27001). The results of this research indicate that past successful experiences, availability of documents, cost constraints, organization learning and organizational culture are important motivations of self-implementation of ISMS. Past experience of other standards, level of documentation and standardization, degree of understanding the clauses, procedures of risk management, top management support, culture of organization, existing auditing infrastructure, awareness of information security, education and compatibility with the existing procedures are the key factors of successful self-implementation of ISMS.