Mandatory Standards and Organizational Information Security

No abstract is available for this paper.

• Publication year

  2016

• Venue

  Information systems research

• Publication date

  2016-02-15

• Fields of study

  Business, Economics, Computer Science

• Identifiers
  DOI 10.1287/isre.2015.0607
• External record

  Open on Semantic Scholar

• Source metadata

  Semantic Scholar

• No claims are published for this paper.

• No concepts are published for this paper.

• The Nature of the Firm

  2013cited by this paper
• Information Security Outsourcing with System Interdependency and Mandatory Security Requirement

  2012influential reference
• Who Should be Responsible for Software Security? A Comparative Analysis of Liability Policies in Network Environments

  2011influential reference
• The Effect of Liability and Patch Release on Software Security: The Monopoly Case

  2011cited by this paper
• Heartland Payment Systems: lessons learned from a data breach

  2010influential reference
• Towards a Cooperative Defense Model Against Network Security Attacks

  2010cited by this paper
• Do Data Breaches Disclosure Laws Reduce Identity Theft?

  2010cited by this paper
• Encryption and Data Loss

  2010cited by this paper
• Configuration of and Interaction Between Information Security Technologies: The Case of Firewalls and Intrusion Detection Systems

  2009cited by this paper
• Uncertainty in the weakest-link security game

  2009cited by this paper
• How Ethics Can Enhance Organizational Privacy: Lessons from the ChoicePoint and TJX Data Breaches

  2009cited by this paper
• Management of Information Security

  2008cited by this paper
• Secure or insure?: a game-theoretic analysis of information security games

  2008cited by this paper
• Let the Pirates Patch? An Economic Analysis of Software Security Patch Restrictions

  2008cited by this paper
• Guide for Assessing the Security Controls in Federal Information Systems and Organizations: Building Effective Security Assessment Plans

  2008cited by this paper
• Predicted and Observed User Behavior in the Weakest-link Security Game

  2008cited by this paper
• PCI DSS: Payment card industry data security standards in context

  2008cited by this paper
• The Case for Flexible NIST Security Standards

  2007cited by this paper
• Information sharing among firms and cyber attacks

  2007cited by this paper
• Managing Enterprise Security Risk with NIST Standards

  2007cited by this paper
• Returns to information security investment: The effect of alternative information security breach functions on optimal investment and sensitivity to vulnerability

  2006cited by this paper
• Income, interdependence, and substitution effects affecting incentives for security investment

  2006cited by this paper
• The Value of Intrusion Detection Systems in Information Technology Security Architecture

  2005cited by this paper
• System Reliability and Free Riding

  2004cited by this paper
• Who is liable for bugs and security flaws in software?

  2004cited by this paper
• The economic cost of publicly announced information security breaches: empirical evidence from the stock market

  2003influential reference
• Two Views on Security Software Liability: Let the Legal System Decide

  2003cited by this paper
• Sharing Information on Computer Systems Security: An Economic Analysis

  2003cited by this paper
• How Much Security Is Enough to Stop a Thief?: The Economics of Outsider Theft via Computer Systems and Networks

  2003cited by this paper
• The economics of information security investment

  2002cited by this paper
• Rigidity, Discretion, and the Costs of Writing Contracts

  2002cited by this paper
• Incomplete Contracts and Strategic Ambiguity

  1998cited by this paper
• Legal Regimes, Audit Quality, and Investment

  1997cited by this paper
• Audit Standards and Auditor Liability: A Theoretical Model

  1996cited by this paper
• Auditing Standards, Legal Liability, and Auditor Wealth

  1993cited by this paper
• Threats to Information Systems: Today's Reality, Yesterday's Understanding

  1992cited by this paper
• Markets and Hierarchies: Analysis and Antitrust Implications.

  1977cited by this paper
• The Sciences of the Artificial

  1970cited by this paper

• Advancing risk management with cybersecurity intelligence: a design science approach

  2026cites this paper
• Protecting data intangibly: How does control culture influence data breach risks?

  2025cites this paper
• The “Solow paradox mystery” of information security standardization construction and labor investment efficiency: Empirical evidence based on ISO27001 certification

  2025cites this paper
• The economics of cyber risk: a survey of the literature

  2025cites this paper
• Security Investment Decisions for Healthcare Information Security Against Strategic Attacks

  2025cites this paper
• Security Investment and Pricing Decisions in Competitive Software Markets: Bug Bounty and In-House Strategies

  2025cites this paper
• Security prevails or affordability matters? The optimal ERP releasing strategy considering differentiated customer security perceptions

  2025cites this paper
• How to Make My Bug Bounty Cost-Effective? A Game-Theoretical Model

  2024cites this paper
• Research on Information Security Decision of Complementary Firms Considering Security Standard

  2024cites this paper
• Building cybersecurity resilience: integrating defense and recovery investment strategies in an expected resilience framework

  2024cites this paper
• When Your Thing Won’t Behave: Security Governance in the Internet of Things

  2024cites this paper
• Information security decisions of security‐interdependent firms in the presence of consumer sensitivity

  2024cites this paper
• Information Security Research in the Information Systems Discipline: A Thematic Review and Future Research Directions

  2024cites this paper
• The liability of foreignness and operational security: evidence from emerging markets

  2024cites this paper
• A cybersecurity risk quantification and classification framework for informed risk mitigation decisions

  2023cites this paper
• Information security investment for complementary and substitutable firms: The role of technology similarity

  2023cites this paper
• Managing Partial Outsourcing on Information Security under Security Standard Constraint—Based on Asymmetric Externality

  2023cites this paper
• A Model to Measure Cyber Security Maturity at the National Level

  2023cites this paper
• Evaluating compliance for organizational information security and business continuity: three strata of ventriloqual agency

  2023cites this paper
• Security defense against long-term and stealthy cyberattacks

  2022cites this paper
• Information Security Strategies for Information-Sharing Firms Considering a Strategic Hacker

  2022cites this paper
• Antecedents and consequences of data breaches: A systematic review

  2022cites this paper
• SaaS or not: optimal versioning strategy of releasing enterprise software

  2022cites this paper
• A Data Driven Approach to Board Cybersecurity Governance

  2022cites this paper
• An economic analysis of information security decisions with mandatory security standards in resource sharing environments

  2022cites this paper
• Research on enterprise knowledge service based on semantic reasoning and data fusion

  2021cites this paper
• A game-theoretical model of firm security reactions responding to a strategic hacker in a competitive industry

  2021cites this paper
• The Digital Undertow: How the Corollary Effects of Digital Transformation Affect Industry Standards

  2021cites this paper
• The Impact of Executives' IT Expertise on Reported Data Security Breaches

  2021cites this paper
• Centralized Information Technology Decision Making and Cybersecurity Breaches: Evidence from U.S. Higher Education Institutions

  2020cites this paper
• Cloud Services vs. On-Premises Software: Competition Under Security Risk and Product Customization

  2020cites this paper
• Information Systems Security Leadership: An Empirical Study of Behavioral Influences of Leaders on Employees’ Security Compliance

  2020cites this paper
• A comprehensive model of information security factors for decision-makers

  2020cites this paper
• Einhaltung von Informationssicherheitsvorschriften durch MitarbeiterInnen: Faktoren und Maßnahmen

  2020influential citation
• Managing Information System Security Under Continuous and Abrupt Deterioration

  2020cites this paper
• SoK: linking information security metrics to management success factors

  2020cites this paper
• Cloud Service Model’s Role in Provider and User Security Investment Incentives

  2020cites this paper
• An exploratory examination of organizational insiders' descriptive and normative perceptions of cyber-relevant rights and responsibilities

  2020cites this paper
• Centralized IT Decision Making and Cybersecurity Breaches: Evidence from U.S. Higher Education Institutions

  2020cites this paper
• Risk and the Five Hard Problems of Cybersecurity

  2019cites this paper
• Organizational cloud security and control: a proactive approach

  2019cites this paper
• Conceptualizing the Role of IS Security Compliance in Projects of Digital Transformation: Tensions and Shifts Between Prevention and Response Modes

  2019cites this paper
• Automation of harmonization, analysis and evaluation of information security requirements

  2019cites this paper
• Factors Affecting Employee Intentions to Comply With Password Policies

  2019cites this paper
• Information Security Research Challenges in the Process of Digitizing Business: A Review Based on the Information Security Model of IBM

  2019cites this paper
• Bilateral Liability-Based Contracts in Information Security Outsourcing

  2019cites this paper
• The Changing Tides of Investments and Strategies and Their Impacts on Security Breaches

  2019cites this paper
• Comparison of information security decisions under different security and business environments

  2018cites this paper
• Security Circumvention: To Educate or To Enforce?

  2018cites this paper
• SNS Use, Risk, and Executive Behavior

  2018cites this paper
• A Resource View of Information Security Incident Response

  2018cites this paper
• Circumventing Circumvention: An Economic Analysis of the Role of Education and Enforcement

  2018cites this paper
• security and privacy research lies

  2017cites this paper
• Decisions making in information security outsourcing: Impact of complementary and substitutable firms

  2017cites this paper
• Why security and privacy research lies at the centre of the information systems (IS) artefact: proposing a bold research agenda

  2017cites this paper
• The Work‐Averse Cyberattacker Model: Theory and Evidence from Two Million Attack Signatures

  2017cites this paper
• Security Standardization for Social Welfare in the Presence of Unverifiable Control

  2017cites this paper
• Considerations on the selection and prioritization of information security solutions

  2016cites this paper
• Cloud Services vs. On-Premises Software: Competition Under Security Risk and Product Customization

  2016cites this paper