'Context, Content, Process' Approach to Align Information Security Investments with Overall Organizational Strategy
This work addresses the problem of aligning security investments with strategy for organizational decision-makers, but it appears incremental as it builds on existing models.
The authors tackled the challenge of selecting information security investment models by proposing a 'Context, Content, Process' framework to align investments with organizational strategy, resulting in a simplified approach for decision-makers.
Today business environment is highly dependent on complex technologies, and information is considered an important asset. Organizations are therefore required to protect their information infrastructure and follow an inclusive risk management approach. One way to achieve this is by aligning the information security investment decisions with respect to organizational strategy. A large number of information security investment models have are in the literature. These models are useful for optimal and cost-effective investments in information security. However, it is extremely challenging for a decision maker to select one or combination of several models to decide on investments in information security controls. We propose a framework to simplify the task of selecting information security investment model(s). The proposed framework follows the 'Context, Content, Process' approach, and this approach is useful in evaluation and prioritization of investments in information security controls in alignment with the overall organizational strategy.