企业信息安全制度化部署过程的行动研究

Action Research on the Institutionalization Implementation of Enterprises'Information Security

企业信息安全制度的宗旨是控制内部信息安全风险的发生。本研究通过在NG集团开展一个周期的行动研究发现,在高层管理重视但信息安全知识匮乏、中层管理缺乏信息安全部署热情、基层员工抵触信息安全行为的情境下,来自企业外部研究人员的行动参与和实践指导可以通过完善信息安全治理结构、搭建严密信息安全制度化架构、推进业务流程和信息安全的结合来推动信息安全制度的"落地"。本研究可为企业信息安全制度的实施提供理论依据和实践指南,也可为组织信息安全研究领域应用行动研究来探讨其他管理实践问题提供方法示范。

The purpose of enterprises’ information security institution is to control internal information security risk. Using a cycle of action research in NG Group, this study indicates that the implantation of information security institution would benefit from external researchers’ action involvement and practice guidance in the specific context where senior management values information security but lacks knowledge, middle management lacks operational enthusiasm, and employees complain information security policy. The means which can prompt the implementation of information security institution include improving information security governance structure, building strict institutional architecture, and combining work flow and information security. This study can provide a theoretical basis and practical guidance for information security institutionalization, and can offer a useful methodological reference （i.e., action research） for future research in question.