{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,26]],"date-time":"2026-03-26T19:04:56Z","timestamp":1774551896846,"version":"3.50.1"},"reference-count":61,"publisher":"Emerald","issue":"2","license":[{"start":{"date-parts":[[2018,6,11]],"date-time":"2018-06-11T00:00:00Z","timestamp":1528675200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.emerald.com\/insight\/site-policies"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["ICS"],"published-print":{"date-parts":[[2018,6,11]]},"abstract":"<jats:sec><jats:title content-type=\"abstract-subheading\">Purpose<\/jats:title><jats:p>The purpose of this paper is to examine challenges multinational companies face during the diffusion of their information security policies. Parent companies use these policies as their discourse for legitimization of their practices in subsidiaries, which leads to value conflicts in subsidiaries. The authors postulate that, when properly crafted, information security policies can also be used to reduce the very conflicts they are creating.<\/jats:p><\/jats:sec><jats:sec><jats:title content-type=\"abstract-subheading\">Design\/methodology\/approach<\/jats:title><jats:p>The proposed framework is conceptualized based on the review of literatures on multinational companies, information security policies and value conflict.<\/jats:p><\/jats:sec><jats:sec><jats:title content-type=\"abstract-subheading\">Findings<\/jats:title><jats:p>The authors identified three factors that may lead to value conflict in subsidiary companies: cultural distance, institutional distance and stickiness of knowledge. They offer three recommendations based on organizational discourse, ambidexterity and resource allocation to reduce value conflict.<\/jats:p><\/jats:sec><jats:sec><jats:title content-type=\"abstract-subheading\">Research limitations\/implications<\/jats:title><jats:p>The authors postulate that information security policies are the sources of value conflict in subsidiary companies. Yet, when crafted properly, these policies can also offer solutions to minimize value conflict.<\/jats:p><\/jats:sec><jats:sec><jats:title content-type=\"abstract-subheading\">Practical implications<\/jats:title><jats:p>The proposed framework can be used to increase policy diffusion success, minimize value conflict and, in turn, decrease information security risk.<\/jats:p><\/jats:sec><jats:sec><jats:title content-type=\"abstract-subheading\">Originality\/value<\/jats:title><jats:p>The growing literature on information security policy literature is yet to examine the diffusion of policies within multinational companies. The authors argue that information security policies are the source of, and solution to, value conflict in multinational companies.<\/jats:p><\/jats:sec>","DOI":"10.1108\/ics-08-2017-0061","type":"journal-article","created":{"date-parts":[[2018,4,25]],"date-time":"2018-04-25T19:18:22Z","timestamp":1524683902000},"page":"230-245","source":"Crossref","is-referenced-by-count":6,"title":["Information security policies and value conflict in multinational companies"],"prefix":"10.1108","volume":"26","author":[{"given":"Alper","family":"Yayla","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Yu","family":"Lei","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"140","reference":[{"issue":"1","key":"key2020092812092694900_ref001","doi-asserted-by":"crossref","first-page":"3","DOI":"10.1016\/S0268-4012(96)00038-2","article-title":"Information systems strategies for multinational companies in Arab Gulf countries","volume":"17","year":"1997","journal-title":"International Journal of Information Management"},{"issue":"6","key":"key2020092812092694900_ref002","doi-asserted-by":"crossref","first-page":"765","DOI":"10.1057\/jibs.2011.13","article-title":"Selling, resistance and reconciliation: a critical discursive approach to subsidiary role evolution in MNEs","volume":"42","year":"2011","journal-title":"Journal of International Business Studies"},{"key":"key2020092812092694900_ref003","volume-title":"Writing Information Security Policies","year":"2002"},{"issue":"4","key":"key2020092812092694900_ref005","doi-asserted-by":"crossref","first-page":"837","DOI":"10.25300\/MISQ\/2015\/39.4.5","article-title":"What do users have to fear? Using fear appeals to engender threats and fear that motivate protective security behaviors","volume":"39","year":"2015","journal-title":"MIS Quarterly"},{"issue":"2","key":"key2020092812092694900_ref004","doi-asserted-by":"crossref","first-page":"151","DOI":"10.1057\/ejis.2009.8","article-title":"If someone is watching, I\u2019ll do what I\u2019m asked: mandatoriness, control, and information security","volume":"18","year":"2009","journal-title":"European Journal of Information Systems"},{"issue":"3","key":"key2020092812092694900_ref006","doi-asserted-by":"crossref","first-page":"523","DOI":"10.2307\/25750690","article-title":"Information security policy compliance: an empirical study of rationality-based beliefs and information security awareness","volume":"34","year":"2010","journal-title":"MIS Quarterly"},{"issue":"5","key":"key2020092812092694900_ref007","doi-asserted-by":"crossref","first-page":"994","DOI":"10.2307\/1556423","article-title":"Country institutional profiles: unlocking entrepreneurial phenomena","volume":"43","year":"2000","journal-title":"Academy of Management Journal"},{"issue":"4","key":"key2020092812092694900_ref008","doi-asserted-by":"crossref","first-page":"45","DOI":"10.1080\/1097198X.2003.10856360","article-title":"Public IT policies in less developed countries: a critical assessment of the literature and a reference framework","volume":"6","year":"2003","journal-title":"Journal of Global Information Technology Management"},{"issue":"6","key":"key2020092812092694900_ref009","first-page":"1","article-title":"Organizational information security policies: a review and research framework","volume":"26","year":"2017","journal-title":"European Journal of Information Systems"},{"key":"key2020092812092694900_ref010","doi-asserted-by":"crossref","first-page":"90","DOI":"10.1016\/j.cose.2012.09.010","article-title":"Future directions for behavioral information security research","volume":"32","year":"2013","journal-title":"Computers & Security"},{"issue":"2","key":"key2020092812092694900_ref011","doi-asserted-by":"crossref","first-page":"285","DOI":"10.2753\/MIS0742-1222310210","article-title":"Understanding employee responses to stressful information security requirements: a coping perspective","volume":"31","year":"2014","journal-title":"Journal of Management Information Systems"},{"key":"key2020092812092694900_ref012","volume-title":"Across the Digital Divide: A Cross-Country Analysis of the Determinants of IT Penetration","year":"2004"},{"issue":"7","key":"key2020092812092694900_ref013","doi-asserted-by":"crossref","first-page":"602","DOI":"10.1002\/asi.10044","article-title":"Socio-economic factors in the application of information and communication technologies in Nigerian print media","volume":"53","year":"2002","journal-title":"Journal of the American Society for Information Science and Technology"},{"issue":"2","key":"key2020092812092694900_ref014","doi-asserted-by":"crossref","first-page":"194","DOI":"10.1016\/j.ibusrev.2008.02.011","article-title":"Changing Chinese values: keeping up with paradoxes","volume":"17","year":"2008","journal-title":"International Business Review"},{"issue":"1","key":"key2020092812092694900_ref015","doi-asserted-by":"crossref","first-page":"8","DOI":"10.1109\/TEM.2002.808265","article-title":"Information systems research and Hofstede\u2019s culture\u2019s consequences: an uneasy and incomplete partnership","volume":"50","year":"2003","journal-title":"IEEE Transactions on Engineering Management"},{"issue":"2","key":"key2020092812092694900_ref016","doi-asserted-by":"crossref","first-page":"362","DOI":"10.5465\/amr.2008.31193235","article-title":"Resistance to change: resistance the rest of the story","volume":"33","year":"2008","journal-title":"Academy of Management Review"},{"issue":"2","key":"key2020092812092694900_ref017","doi-asserted-by":"crossref","first-page":"209","DOI":"10.2307\/20159573","article-title":"The antecedents, consequences, and mediating role of organizational ambidexterity","volume":"47","year":"2004","journal-title":"Academy of Management Journal"},{"issue":"12","key":"key2020092812092694900_ref018","first-page":"109","article-title":"Re-examining the influence of individual values on ethical decision making","volume":"16","year":"1997","journal-title":"From the Universities to the Marketplace: The Business Ethics Journey"},{"issue":"4","key":"key2020092812092694900_ref019","doi-asserted-by":"crossref","first-page":"266","DOI":"10.1108\/IMCS-08-2012-0043","article-title":"Social action theory for understanding information security non-compliance in hospitals: the importance of user rationale","volume":"21","year":"2013","journal-title":"Information Management & Computer Security"},{"issue":"4","key":"key2020092812092694900_ref020","doi-asserted-by":"crossref","first-page":"373","DOI":"10.1016\/j.jsis.2011.06.001","article-title":"Value conflicts for information security management","volume":"20","year":"2011","journal-title":"Journal of Strategic Information Systems"},{"key":"key2020092812092694900_ref021","doi-asserted-by":"crossref","first-page":"175","DOI":"10.4135\/9781848608122.n8","article-title":"Interpretivist approaches to organizational discourse","volume-title":"The Sage Handbook of Organizational Discourse","year":"2004"},{"key":"key2020092812092694900_ref022","volume-title":"Cultures and Organizations: Software of the Mind","year":"1997"},{"key":"key2020092812092694900_ref023","volume-title":"Culture\u2019s Consequences: International Differences in Work Related Values","year":"2001","edition":"2nd"},{"key":"key2020092812092694900_ref024","unstructured":"Hofstede, G. (2017), \u201cHofstede insights\u201d, available at: www.hofstede-insights.com"},{"key":"key2020092812092694900_ref025","first-page":"401","article-title":"National culture and organization culture","volume-title":"Handbook of Organizational Culture and Climate","year":"2000"},{"issue":"3","key":"key2020092812092694900_ref026","doi-asserted-by":"crossref","first-page":"278","DOI":"10.1057\/ejis.2014.33","article-title":"A legitimacy challenge of a cross-cultural interorganizational information system","volume":"24","year":"2015","journal-title":"European Journal of Information Systems"},{"issue":"2","key":"key2020092812092694900_ref05a","doi-asserted-by":"crossref","first-page":"153","DOI":"10.1016\/j.jsis.2007.05.004","article-title":"The role of external and internal influences on information systems security \u2013 a neo-institutional perspective","volume":"16","year":"2007","journal-title":"The Journal of Strategic Information Systems"},{"issue":"6","key":"key2020092812092694900_ref027","doi-asserted-by":"crossref","first-page":"508","DOI":"10.1057\/palgrave.jibs.8400107","article-title":"Stickiness and the adaptation of organizational practices in cross-border knowledge transfers","volume":"35","year":"2004","journal-title":"Journal of International Business Studies"},{"key":"key2020092812092694900_ref028","article-title":"Developing security policies","volume-title":"Computer Security Handbook","year":"2002","edition":"4th"},{"key":"key2020092812092694900_ref029","unstructured":"Kaufmann, D., Kraay, A. and Mastruzzi, M. (2010), \u201cThe worldwide governance indicators: methodology and analytical issues\u201d, World Bank Policy Research Working Paper No. 5430."},{"issue":"1","key":"key2020092812092694900_ref030","doi-asserted-by":"crossref","first-page":"59","DOI":"10.2307\/25148668","article-title":"Antecedents of knowledge transfer from consultants to clients in enterprise system implementations","volume":"29","year":"2005","journal-title":"MIS Quarterly"},{"issue":"3","key":"key2020092812092694900_ref031","doi-asserted-by":"crossref","first-page":"411","DOI":"10.1057\/palgrave.jibs.8490394","article-title":"The effect of national culture on the choice of entry mode","volume":"19","year":"1988","journal-title":"Journal of International Business Studies"},{"key":"key2020092812092694900_ref032","first-page":"3310","article-title":"Value sensitive approach to IS security \u2013 a socio-organizational perspective","year":"2005"},{"key":"key2020092812092694900_ref033","first-page":"2765","article-title":"Security subcultures in an organization \u2013 exploring value conflicts","volume-title":"19th European Conference on Information Systems","year":"2011"},{"key":"key2020092812092694900_ref034","doi-asserted-by":"crossref","first-page":"3","DOI":"10.1016\/j.cose.2012.07.001","article-title":"Organizational power and information security rule compliance","volume":"33","year":"2013","journal-title":"Computers & Security"},{"issue":"2","key":"key2020092812092694900_ref035","doi-asserted-by":"crossref","first-page":"308","DOI":"10.5465\/amr.1999.1893938","article-title":"Transnational transfer of strategic organizational practices: a contextual perspective","volume":"24","year":"1999","journal-title":"Academy of Management Review"},{"issue":"1","key":"key2020092812092694900_ref036","doi-asserted-by":"crossref","first-page":"215","DOI":"10.2307\/3069293","article-title":"Adoption of an organizational practice by subsidiaries of multiniational corporations: institutional and relational effects","volume":"45","year":"2002","journal-title":"Academy of Management Journal"},{"issue":"2","key":"key2020092812092694900_ref037","doi-asserted-by":"crossref","first-page":"297","DOI":"10.5465\/amr.2003.9416356","article-title":"Social capital in multinational corporations and a micro-macro model of its formulation","volume":"28","year":"2003","journal-title":"Academy of Management Review"},{"issue":"1","key":"key2020092812092694900_ref038","doi-asserted-by":"crossref","first-page":"64","DOI":"10.5465\/amr.1999.1580441","article-title":"Organizational legitimacy under conditions of complexity: the case of the multinational enterprise","volume":"24","year":"1999","journal-title":"Academy of Management Review"},{"issue":"1","key":"key2020092812092694900_ref039","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1111\/j.1744-6570.1996.tb01790.x","article-title":"Person-organization fit: an integrative review of its conceptualizations, measurement, and implications","volume":"49","year":"1996","journal-title":"Personnel Psychology"},{"issue":"10","key":"key2020092812092694900_ref040","doi-asserted-by":"crossref","first-page":"805","DOI":"10.1007\/BF00383780","article-title":"Value congruence: the interplay of individual and organizational value systems","volume":"8","year":"1989","journal-title":"Journal of Business Ethics"},{"issue":"6","key":"key2020092812092694900_ref041","doi-asserted-by":"crossref","first-page":"500","DOI":"10.1108\/01437720410560415","article-title":"The cross-national transfer of HRM practices in MNCs: an integrative research model","volume":"25","year":"2004","journal-title":"International Journal of Manpower"},{"issue":"6","key":"key2020092812092694900_ref042","doi-asserted-by":"crossref","first-page":"586","DOI":"10.1057\/palgrave.jibs.8400056","article-title":"MNC knowledge transfer, subsidiary absorptive capacity, and HRM","volume":"34","year":"2003","journal-title":"Journal of International Business Studies"},{"issue":"12","key":"key2020092812092694900_ref043","doi-asserted-by":"crossref","first-page":"1403","DOI":"10.1177\/001872602128782204","article-title":"Being different: how normative and cognitive aspects of institutional environments influence technology transfer","volume":"55","year":"2002","journal-title":"Human Relations"},{"issue":"5","key":"key2020092812092694900_ref044","doi-asserted-by":"crossref","first-page":"341","DOI":"10.1007\/BF00882023","article-title":"Values congruence and difference between the interplay of personal and organizational value systems","volume":"12","year":"1993","journal-title":"Journal of Business Ethics"},{"issue":"2","key":"key2020092812092694900_ref045","doi-asserted-by":"crossref","first-page":"206","DOI":"10.1057\/s41303-016-0023-0","article-title":"Conflicts and complements between Eastern cultures and agile methods: an empirical investigation","volume":"26","year":"2017","journal-title":"European Journal of Information Systems"},{"issue":"4","key":"key2020092812092694900_ref046","doi-asserted-by":"crossref","first-page":"229","DOI":"10.1016\/0378-7206(89)90046-3","article-title":"The organizational and cultural context of system implementation: case experience from Latin America","volume":"17","year":"1989","journal-title":"Information & Management"},{"key":"key2020092812092694900_ref047","volume-title":"The Nature of Human Values","year":"1973"},{"issue":"2","key":"key2020092812092694900_ref048","doi-asserted-by":"crossref","first-page":"340","DOI":"10.5465\/amr.1991.4278953","article-title":"Organizational environments and the multinational enterprise","volume":"16","year":"1991","journal-title":"Academy of Management Review"},{"issue":"3","key":"key2020092812092694900_ref049","doi-asserted-by":"crossref","first-page":"550","DOI":"10.1037\/0022-3514.53.3.550","article-title":"Toward a universal psychological structure of human values","volume":"53","year":"1987","journal-title":"Journal of Personality and Social Psychology"},{"key":"key2020092812092694900_ref050","volume-title":"Institutions and Organizations","year":"1995"},{"issue":"1","key":"key2020092812092694900_ref03a","doi-asserted-by":"crossref","first-page":"31","DOI":"10.1108\/09685220010371394","article-title":"A conceptual foundation for organizational information security awareness","volume":"8","year":"2000","journal-title":"Information Management & Computer Security"},{"issue":"1","key":"key2020092812092694900_ref051","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1016\/S0378-7206(97)00026-8","article-title":"Testing the technology acceptance model across cultures: a three country study","volume":"33","year":"1997","journal-title":"Information and Management"},{"issue":"2","key":"key2020092812092694900_ref052","first-page":"27","article-title":"Exploring internal stickiness: impediments to the transfer of best practice within the firm","volume":"17","year":"1996","journal-title":"Strategic Management Journal"},{"issue":"4","key":"key2020092812092694900_ref053","doi-asserted-by":"crossref","first-page":"819","DOI":"10.1037\/0022-3514.50.4.819","article-title":"A value pluralism model of ideological reasoning","volume":"50","year":"1986","journal-title":"Journal of Personality and Social Psychology"},{"key":"key2020092812092694900_ref054","unstructured":"The World Bank (2017), \u201cWorld Development Indicators\u201d, available at: https:\/\/datacatalog.worldbank.org\/dataset\/world-development-indicators"},{"issue":"4","key":"key2020092812092694900_ref055","doi-asserted-by":"crossref","first-page":"167","DOI":"10.1108\/09685229810227649","article-title":"Information security awareness: educating our users effectively","volume":"6","year":"1998","journal-title":"Information Management & Computer Security"},{"issue":"6","key":"key2020092812092694900_ref056","doi-asserted-by":"crossref","first-page":"789","DOI":"10.1177\/0170840606061071","article-title":"Pulp and paper fiction: on the discursive legitimation of global industrial restructuring","volume":"27","year":"2006","journal-title":"Organization Studies"},{"issue":"1","key":"key2020092812092694900_ref057","doi-asserted-by":"crossref","first-page":"21","DOI":"10.4018\/joeuc.2012010102","article-title":"IS security policy violations: a rational choice perspective","volume":"24","year":"2012","journal-title":"Journal of Organizational and End User Computing"},{"issue":"3","key":"key2020092812092694900_ref058","doi-asserted-by":"crossref","first-page":"473","DOI":"10.1016\/S0001-8791(02)00036-2","article-title":"A meta-analysis of relations between person-organization fit and work attitudes","volume":"63","year":"2003","journal-title":"Journal of Vocational Behavior"},{"key":"key2020092812092694900_ref038a","doi-asserted-by":"crossref","first-page":"53","DOI":"10.1007\/978-1-349-22557-6_3","article-title":"Institutionalization theory and the multinational corporation","volume-title":"Organization Theory and the Multinational Corporation","year":"1993"}],"container-title":["Information &amp; Computer Security"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.emerald.com\/insight\/content\/doi\/10.1108\/ICS-08-2017-0061\/full\/xml","content-type":"application\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/www.emerald.com\/insight\/content\/doi\/10.1108\/ICS-08-2017-0061\/full\/html","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,7,25]],"date-time":"2025-07-25T01:23:08Z","timestamp":1753406588000},"score":1,"resource":{"primary":{"URL":"http:\/\/www.emerald.com\/ics\/article\/26\/2\/230-245\/189376"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2018,6,11]]},"references-count":61,"journal-issue":{"issue":"2","published-print":{"date-parts":[[2018,6,11]]}},"alternative-id":["10.1108\/ICS-08-2017-0061"],"URL":"https:\/\/doi.org\/10.1108\/ics-08-2017-0061","relation":{},"ISSN":["2056-4961"],"issn-type":[{"value":"2056-4961","type":"print"}],"subject":[],"published":{"date-parts":[[2018,6,11]]}}}