Implementation of information security management systems based on the ISOIEC 27001 standard in different cultures

Abstract

In this thesis, we investigate the potential relationship between national cultural, political and economic characteristics regarding the adoption of ISO 27001, in terms of the average number of certificates issued (2006{2014). ISO 27001 is the most adopted international ISMS (Information Security Management System) standard, which provides IT governance by protecting sensitive data in a structured way. Although ISO 27001 is a generic standard for all organisations and countries, some countries have yet to adopt ISO 27001 extensively. The relationship between culture (mind-set and behaviour) and the adoption of an ISMS standard such as ISO 27001 has not been investigated yet. Based on our qualitative analysis, we observe a relationship between national cultural characteristics of a country and the number of issued ISO 27001 certificates. In our quantitative analysis, we separate countries into two groups based on the average number of the total ISO 27001 certificates that were issued worldwide (2006{2014). A common comparison approach may not be helpful for investigating the relationship between the adoption of ISO 27001 and the national cultural, political and economic characteristics of several countries from different continents. For countries with more than the average number of the ISO 27001 certificates issued worldwide (2006{2014), we observe a relationship between the regulation density (regulation of credit, labour, and business), GDP (Gross Domestic Product; a monetary measure of a country's economy and economic performance that equalises the purchasing power of different currencies divided by population), and the average degree of comfortableness with uncertainty of people in a country on one side, and the adoption of ISO 27001 on the other side. For countries with less than the average number of the ISO 27001 certificates issued worldwide (2006{2014), we observe a relationship between the average degree of individualism of people in a country, the GDP, and the relation to authority and the expected level of hierarchical order of people in a country on one side, and the adoption of ISO 27001 on the other side. The correlation does not imply causality in this thesis.