{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,30]],"date-time":"2026-09-30T16:27:07Z","timestamp":1790785627506,"version":"4.1.0"},"reference-count":49,"publisher":"IGI Global Scientific Publishing","issue":"1","content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2011,1,1]]},"abstract":"<p>Governance of the information security function is critical to effective security. In this paper, the authors present a conceptual model for security governance from the perspective of decision rights allocation. Based on Da Veiga and Eloff\u2019s (2007) framework for security governance and two high-level information security documents published by the National Institute of Standards and Technology (NIST), the authors present seven domains of information security governance. For each of the governance domains, they propose a main decision type, using the taxonomy of information technology decisions defined by Weill and Ross (2004). This framework recommends the selection of decision rights allocation patterns that are proper to those decision types to ensure good security decisions. As a result, a balance can be achieved between decisional authority and responsibility for information security.<\/p>","DOI":"10.4018\/irmj.2011010103","type":"journal-article","created":{"date-parts":[[2011,2,15]],"date-time":"2011-02-15T15:26:53Z","timestamp":1297783613000},"page":"28-45","source":"Crossref","is-referenced-by-count":6,"title":["Governing Information Security"],"prefix":"10.4018","volume":"24","author":[{"given":"Yu \u2019Andy\u2019","family":"Wu","sequence":"first","affiliation":[{"name":"University of North Texas, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Carol Stoak","family":"Saunders","sequence":"additional","affiliation":[{"name":"University of Central Florida, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"2432","reference":[{"key":"irmj.2011010103-0","doi-asserted-by":"publisher","DOI":"10.1086\/262063"},{"key":"irmj.2011010103-1","author":"C.Alberts","year":"2003","journal-title":"Managing Information Security Risks: The OCTAVE Approach"},{"key":"irmj.2011010103-2","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2008.03.002"},{"key":"irmj.2011010103-3","doi-asserted-by":"publisher","DOI":"10.1057\/ejis.1996.7"},{"key":"irmj.2011010103-4","doi-asserted-by":"publisher","DOI":"10.1201\/9781439833032.ch43"},{"key":"irmj.2011010103-5","first-page":"243","article-title":"A generative development - Process pattern language","author":"J. O.Coplien","year":"1998","journal-title":"The Patterns Handbook: Techniques, Strategies, and Applications"},{"key":"irmj.2011010103-6","first-page":"311","article-title":"Software design patterns: Common questions and answers","author":"J. O.Coplien","year":"1998","journal-title":"The Patterns Handbook: Techniques, Strategies, and Applications"},{"key":"irmj.2011010103-7","doi-asserted-by":"publisher","DOI":"10.1080\/10580530701586136"},{"key":"irmj.2011010103-8","doi-asserted-by":"publisher","DOI":"10.1201\/9781439833032.ch47"},{"key":"irmj.2011010103-9","author":"M.Egan","year":"2005","journal-title":"The Executive Guide to Information Security: Threats, Challenges, and Solutions"},{"key":"irmj.2011010103-10","doi-asserted-by":"publisher","DOI":"10.1108\/00251740710753701"},{"key":"irmj.2011010103-11","doi-asserted-by":"publisher","DOI":"10.1201\/9781439833032.ch2"},{"key":"irmj.2011010103-12","unstructured":"Fonseca, B., & Nobel, C. (2005, September 19). Katrina's wrath: Gulf coast business take on daunting task of restoring IT operations after storm. eWeek, 22-24."},{"key":"irmj.2011010103-13","author":"W.Fumy","year":"2006","journal-title":"Enterprise Security"},{"key":"irmj.2011010103-14","author":"J. R.Galbraith","year":"1973","journal-title":"Designing Complex Organizations"},{"key":"irmj.2011010103-15","author":"J. R.Galbraith","year":"1993","journal-title":"Competing with Flexible Lateral Organizations"},{"key":"irmj.2011010103-16","unstructured":"Gibson, S. (2001, September 17). Terrorism puts nation and human spirit to extreme test. eWeek, 1."},{"key":"irmj.2011010103-17","unstructured":"Gibson, S. (2006, August 28). Lessaons learned. eWeek, 20-23."},{"key":"irmj.2011010103-18","first-page":"26","article-title":"Return on information security investments: Myths vs. reality.","volume":"11","author":"L. A.Gordon","year":"2002","journal-title":"Strategic Finance"},{"key":"irmj.2011010103-19","doi-asserted-by":"publisher","DOI":"10.1145\/1107458.1107465"},{"key":"irmj.2011010103-20","doi-asserted-by":"publisher","DOI":"10.1145\/1323688.1323699"},{"key":"irmj.2011010103-21","doi-asserted-by":"publisher","DOI":"10.1201\/9781439833032.ch45"},{"key":"irmj.2011010103-22","author":"S. D.Hansche","year":"2004","journal-title":"Official (ISC)2 Guide to the CISSP Exam"},{"key":"irmj.2011010103-23","first-page":"131","article-title":"Organizational patterns at AG Communication Systems","author":"N.Janoff","year":"1998","journal-title":"The Patterns Handbook: Techniques, Strategies, and Applications"},{"key":"irmj.2011010103-24","doi-asserted-by":"publisher","DOI":"10.1145\/1435417.1435446"},{"key":"irmj.2011010103-25","author":"S.Kairab","year":"2005","journal-title":"A Practical Guide to Security Assessments"},{"key":"irmj.2011010103-26","doi-asserted-by":"publisher","DOI":"10.1016\/S0925-5273(02)00286-4"},{"key":"irmj.2011010103-27","author":"G. L.Kovacich","year":"2003","journal-title":"The Information Systems Security Officer's Guide: Establishing and Managing an Information Protection Program"},{"key":"irmj.2011010103-28","doi-asserted-by":"crossref","DOI":"10.1109\/9780471784340","author":"V.LeVeque","year":"2006","journal-title":"Information Security: A Strategic Approach"},{"issue":"1","key":"irmj.2011010103-29","doi-asserted-by":"crossref","first-page":"109","DOI":"10.2307\/41166021","article-title":"Achieving and sustaining business-IT alignment.","volume":"42","author":"J.Luftman","year":"1999","journal-title":"California Management Review"},{"key":"irmj.2011010103-30","author":"E.Maiwald","year":"2002","journal-title":"Security Planning and Disaster Recovery"},{"issue":"2","key":"irmj.2011010103-31","first-page":"3","article-title":"Diagnosing organizational decision making through responsibility charting.","volume":"24","author":"J. E.McCann","year":"1983","journal-title":"Sloan Management Review"},{"key":"irmj.2011010103-32","author":"M.Osborne","year":"2006","journal-title":"How to Cheat at Managing Information Security"},{"key":"irmj.2011010103-33","doi-asserted-by":"publisher","DOI":"10.1201\/9780203488737"},{"key":"irmj.2011010103-34","doi-asserted-by":"publisher","DOI":"10.1201\/9781439833032.ch8"},{"key":"irmj.2011010103-35","author":"R.Richardson","year":"2008","journal-title":"CSI Computer Crime and Security Survey"},{"key":"irmj.2011010103-36","doi-asserted-by":"publisher","DOI":"10.1287\/isre.11.2.105.11780"},{"key":"irmj.2011010103-37","author":"M.Schumacher","year":"2006","journal-title":"Security Patterns"},{"key":"irmj.2011010103-38","doi-asserted-by":"crossref","DOI":"10.1037\/13978-000","author":"H. A.Simon","year":"1960","journal-title":"The New Science of Management Decision"},{"key":"irmj.2011010103-39","author":"S.Snedaker","year":"2006","journal-title":"IT Security Project Management Handbook"},{"key":"irmj.2011010103-40","author":"J. K.Tudor","year":"2001","journal-title":"Information Security Architecture"},{"key":"irmj.2011010103-41","doi-asserted-by":"publisher","DOI":"10.1016\/S0167-4048(03)00311-0"},{"key":"irmj.2011010103-42","doi-asserted-by":"publisher","DOI":"10.2307\/258177"},{"issue":"4","key":"irmj.2011010103-43","first-page":"356","article-title":"Information security governance - Compliance management vs operational management.","volume":"21","author":"B.Von Solms","year":"2005","journal-title":"Computers & Security"},{"key":"irmj.2011010103-44","doi-asserted-by":"crossref","unstructured":"Weber, K., Otto, B., & \u00d6sterle, H. (2009). One size does not fit all - A contigency approach to data governance. ACM Journal of Data and Information Quality, 1(1), 4:1-4:27.","DOI":"10.1145\/1515693.1515696"},{"issue":"1","key":"irmj.2011010103-45","first-page":"1","article-title":"Don't jut lead, govern: How top-performing firms govern IT.","volume":"3","author":"P.Weill","year":"2004","journal-title":"MIS Quarterly Executive"},{"key":"irmj.2011010103-46","author":"P.Weill","year":"2004","journal-title":"IT Governance: How Top Performers Manage IT Decision Rights for Superior Results"},{"issue":"1","key":"irmj.2011010103-47","first-page":"17","article-title":"What IT infrastructural capabilities are needed to implement e-business models.","volume":"1","author":"P.Weill","year":"2002","journal-title":"MISQ Executive"},{"key":"irmj.2011010103-48","author":"J.Wylder","year":"2004","journal-title":"Strategic Information Security"}],"container-title":["Information Resources Management Journal"],"original-title":[],"language":"ng","link":[{"URL":"https:\/\/www.igi-global.com\/viewtitle.aspx?TitleId=49643","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,6,1]],"date-time":"2022-06-01T10:14:38Z","timestamp":1654078478000},"score":1,"resource":{"primary":{"URL":"https:\/\/services.igi-global.com\/resolvedoi\/resolve.aspx?doi=10.4018\/irmj.2011010103"}},"subtitle":["Governance Domains and Decision Rights Allocation Patterns"],"short-title":[],"issued":{"date-parts":[[2011,1,1]]},"references-count":49,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2011,1]]}},"URL":"https:\/\/doi.org\/10.4018\/irmj.2011010103","relation":{},"ISSN":["1040-1628","1533-7979"],"issn-type":[{"value":"1040-1628","type":"print"},{"value":"1533-7979","type":"electronic"}],"subject":[],"published":{"date-parts":[[2011,1,1]]}}}