Exploring information security compliance in corporate IT governance

Article type: Research Article

Authors: Tarn, J. Michael^{a; *} | Raymond, Heath^b | Razi, Muhammad^a | Han, Bernard T.^a

Affiliations: [a] Department of Business Information Systems, Haworth College of Business, Western Michigan University, Kalamazoo, MI, USA | [b] Keane Inc., Grand Rapids, MI, USA

Correspondence: [*] Corresponding author: J. Michael Tarn, Department of Business Information Systems, Haworth College of Business, Western Michigan University, 1903 W. Michigan Ave., MS 5412, Kalamazoo, MI 49008-5412, USA. Tel.: +1 269 387 5428; Fax: +1 269 387 5710; E-mail: mike.tarn@wmich.edu.

Abstract: This article first reviews the major IT governance frameworks and then discusses the case study of a multinational enterprise. A problem and gap analysis employing an information security management systems (ISMS) compliance approach is performed via the establishment and evaluation of the company's statement of applicability (SOA) according to ISO 27001. The article concludes with recommendations for how the company can address the gaps in its ISMS and achieve security compliance in its IT governance.

Keywords: Information security management, IT governance, security, compliance

DOI: 10.3233/HSM-2009-0698

Journal: Human Systems Management, vol. 28, no. 3, pp. 131-140, 2009