¹Department of Information Management, National Taiwan University, Taiwan

Correspondence: Carol W. Hsu, Department of Information Management, National Taiwan University, No.1, Sec. 4, Roosevelt Road, Taipei City 106, Taiwan. Tel: +886 2 3366 1196; Fax: +886 2 3366 1199

Received 1 April 2008; Revised 16 August 2008; Re-revised 15 January 2009; Accepted 23 February 2009; Published online 31 March 2009.

Abstract

Although several studies have discussed the framework and value of information systems (IS) security standards and certification, there has been relatively little empirical research on how different groups of stakeholders in an organization interpret and behave during the implementation process. In an attempt to fill this research gap, this study employs a socio-cognitive perspective, namely the concept of frames analysis, to investigate how the managers and employees of a financial institution make sense of IS security certification, BS 7799 Part 2, and how these interpretations influence their actions. Using an interpretive case study approach, the findings show that the expectations of management have a strong impact on the implementation of the certification process. Moreover, the incongruence between the perceptions of managers and those of the certification team and other employees means that IS security management concepts may not be fully embedded in the organization's work practices and routines. This article argues that during the certification process, managers should place more emphasis on the identification of frame incongruence and undertake early intervention to align frames in order to achieve overall security effectiveness in the organization.