Critical Success Factors in implementing information security governance (Case study: Iranian Central Oil Fields Company)

The oil industry, as one of the main industries of the country, has always faced cyber attacks and security threats. Therefore, the integration of information security in corporate governance is essential and a governance challenge. The integration of information security and corporate governance is called information security governance. In this research, we identified "critical success factors" in the implementation of information security by using metasynthesis method and studying sources related to information security. Because before any planning and policy making in the field of information security governance, it is necessary to pay attention to this category. In the following, we classified these factors based on the focus areas of information security governance, which include strategic alignment with business strategies; risk management; resource management; performance measurement ; value delivery. The output will be an approach for the successful and effective implementation of information security governance, especially in the oil industry.