Implementing Information Security Management Systems - An Empirical Study of Critical Success Factors

This paper presents the findings of an empirical study of certification auditors’ and information security consultants’ experiences and insights concerning the implementation and certification of information security management systems. Using an action research strategy and a grounded theory research method, the study describes these particular experiences and insights primarily in terms of critical success factors vital to the implementation and certification processes. Two tentative theoretical frameworks, providing synthesized views of these factors, are put forth.