Orig­i­nal source pub­li­ca­tion: Lopes, I. M. and F. de Sá-Soares (2012). Infor­ma­tion Secu­rity Poli­cies: A Con­tent Analy­sis. Pro­ceed­ings of the Pacific Asia Con­fer­ence on Infor­ma­tion Sys­tems 2012, Paper 146. Ho Chi Minh City (Viet­nam).
The final pub­li­ca­tion is avail­able here.

Infor­ma­tion Secu­rity Poli­cies: A Con­tent Analy­sis

Isabel Maria Lopes^a and Fil­ipe de Sá-Soares^b

^a Insti­tuto Politéc­nico de Bra­gança, Por­tu­gal
^b Uni­ver­sity of Minho, Cen­tre Algo­ritmi, Por­tu­gal

1. Introduction

With the advent of infor­ma­tion tech­nol­ogy (IT) and the mas­sive use of the Inter­net and its ser­vices, the num­ber of threats to which infor­ma­tion is sub­ject is increas­ingly higher and, con­se­quently, the need to pro­tect infor­ma­tion sys­tems (IS) is becom­ing impe­ri­ous. The coor­di­nated set of efforts to pro­tect infor­ma­tion sys­tem’s assets is com­monly referred to as infor­ma­tion secu­rity man­age­ment activ­ity.

In order to pro­tect infor­ma­tion, an orga­ni­za­tion imple­ments a set of mea­sures, also known as secu­rity con­trols, coun­ter­mea­sures, or safe­guards, which can take many forms, such as poli­cies, pro­ce­dures, guide­lines, prac­tices, and orga­ni­za­tional struc­tures [ISO/IEC 2009].

Among the con­trols that an orga­ni­za­tion may choose to imple­ment, the lit­er­a­ture high­lights the cen­tral role of the infor­ma­tion secu­rity pol­icy (ISP). From a tech­ni­cal per­spec­tive, in a view close to the com­puter secu­rity school of thought [Baskerville and Sipo­nen 2002], a secu­rity pol­icy can be under­stood as “the set of rules that are used by the sys­tem to man­age the access by sub­jects to objects in the sys­tem” [Bosch et al. 1993, p. 176]. From a less tech­ni­cal per­spec­tive, in a view close to the secu­rity man­age­ment school of thought [Baskerville and Sipo­nen 2002], a secu­rity pol­icy can be con­ceived as “a high-level state­ment of orga­ni­za­tional beliefs, goals, and objec­tives, and the gen­eral means for their attain­ment as related to the pro­tec­tion of orga­ni­za­tional assets” [Peltier 2002, p. 22].

Regard­less of how infor­ma­tion secu­rity poli­cies (here­after ISPs) are con­cep­tu­al­ized, there is a broad con­sen­sus in the lit­er­a­ture as to their impor­tance for the pro­tec­tion of infor­ma­tion as well as sys­tems and enti­ties who manip­u­late it. There are even authors who point out the ISP as the foun­da­tion of infor­ma­tion secu­rity, such as Hig­gins [1999, p. 217], who argues that “The secu­rity pol­icy is to the secu­rity envi­ron­ment like the law is to a legal sys­tem. (...) A pol­icy is the start of secu­rity man­age­ment.”; Schneier [2000, p. 308], by not­ing that “a dig­i­tal sys­tem with­out a secu­rity pol­icy is likely to have a hodge-podge of coun­ter­mea­sures. The pol­icy is what ties every­thing together.”; King et al. [2001, p. 13], when they observe that “An effec­tive infor­ma­tion secu­rity pol­icy is as nec­es­sary to a good infor­ma­tion secu­rity pro­gram as a solid foun­da­tion is to a house.”; Höne and Eloff [2002a, p. 409], when they state that “The infor­ma­tion secu­rity pol­icy is one of the most impor­tant doc­u­ments in an orga­ni­za­tion...”, and Shorten [2004, p. 917], by argu­ing that “the secu­rity pol­icy is the foun­da­tion on which all secu­rity is based.”

Given the cen­tral­ity of ISPs, it is not sur­pris­ing that the lit­er­a­ture con­tains sev­eral con­tri­bu­tions that aim to help orga­ni­za­tions for­mu­late, imple­ment and review secu­rity poli­cies. In addi­tion to rec­om­men­da­tions on the process of cre­at­ing and imple­ment­ing secu­rity poli­cies, the lit­er­a­ture includes stud­ies whose authors dis­cuss fac­tors that enable the suc­cess­ful employ­ment of secu­rity poli­cies, as well as var­i­ous guide­lines on the con­tent these doc­u­ments should present.

Despite the sig­nif­i­cant num­ber of stud­ies on the topic of ISPs, until mid-2000s the lit­er­a­ture revealed a lim­ited num­ber of empir­i­cal stud­ies on this secu­rity mea­sure. Indeed, some authors had pointed to lim­i­ta­tions on the research per­formed, such as the inex­is­tence of a coher­ent the­ory about infor­ma­tion secu­rity poli­cies [Hong et al. 2003] and the inex­is­tence or low expres­sion of empir­i­cal stud­ies focus­ing on the adop­tion, con­tent and imple­men­ta­tion of infor­ma­tion secu­rity poli­cies [Ful­ford and Doherty 2003, Knapp et al. 2006]. Since the time when these obser­va­tions were made, sev­eral stud­ies have arisen on ISPs of empir­i­cal nature, such as Karyda et al. [2005] and a sig­nif­i­cant group of stud­ies focus­ing on employee com­pli­ance with ISPs, among which are Boss et al. [2009], Bul­gurcu et al. [2010], Herath and Rao [2009], John­ston and Warkentin [2010], Myyry et al. [2009], Sipo­nen and Vance [2010], and Warkentin et al. [2011]. The major­ity of the works in this last set of stud­ies pro­moted sur­veys that addressed the inten­tions and behav­iors of employ­ees, exam­in­ing fac­tors which facil­i­tate or inhibit com­pli­ance with ISPs. These works, how­ever, did not con­sider the spe­cific ISPs doc­u­ments held by orga­ni­za­tions nor the con­nec­tion between the word­ing in those doc­u­ments and employ­ees’ behav­iors or inten­tions to pro­tect infor­ma­tion sys­tems assets.

We argue that IS secu­rity lit­er­a­ture may be enriched by inquir­ing on what orga­ni­za­tions do in terms of ISPs, the rea­sons for their choices, the dif­fi­cul­ties they face dur­ing their for­mu­la­tion and imple­men­ta­tion and on how they even­tu­ally over­come those dif­fi­cul­ties. Armed with empir­i­cal data on the use of ISPs by orga­ni­za­tions, we may be able to make bet­ter rec­om­men­da­tions for prac­tice, to check if there is a gap between what the lit­er­a­ture advo­cates and what orga­ni­za­tions actu­ally mate­ri­al­ize and to rea­son about the rela­tion­ship between ISPs doc­u­ments and user com­pli­ance.

This work seeks to con­trib­ute to that pur­pose. Since it is not fea­si­ble, nor even con­ceiv­able, to address the whole the­matic spec­trum of ISPs, we decided to focus the work on the con­tent of poli­cies. The aim of the study is to char­ac­ter­ize the doc­u­ments that have been for­mally adopted by orga­ni­za­tions as ISPs, cen­ter­ing the analy­sis on their con­tent.

The paper is struc­tured as fol­lows. After this intro­duc­tion, we review the lit­er­a­ture on the con­tent of ISPs. Then, the research ques­tions are pre­sented and the research strat­egy is described. After­wards, we present the main results of the study and dis­cuss them. The paper ends by draw­ing con­clu­sions and sug­gest­ing future work.

2. Literature Review

A pol­icy can be under­stood as a “guide­line or a set of direc­tives which rule a per­son or an entity’s action” [ACL 2001, p. 2897]. The nature of the poli­cies as guide­lines devel­oped in the present to delimit future actions is stressed by Gilbert [2003, p. 3], not­ing that poli­cies are “the cho­sen rules and pro­ce­dures which will dic­tate future actions.”

Gen­er­ally, poli­cies are embod­ied in writ­ten doc­u­ments. The for­mal­iza­tion of poli­cies is rec­og­nized by Guel [2007, p. 3], who con­ceives a pol­icy as “a for­mal, brief, and high-level state­ment or plan that embraces an orga­ni­za­tion’s goals, objec­tives, and accept­able pro­ce­dures for a spe­cific sub­ject area.”

A lit­er­a­ture review on infor­ma­tion secu­rity poli­cies enabled the iden­ti­fi­ca­tion of three fun­da­men­tal classes of mean­ing attached to this secu­rity con­trol.

The first class expresses a highly tech­ni­cal nature, where poli­cies are viewed as tools for defin­ing the tech­ni­cal secu­rity require­ments that a given prod­uct or sys­tem should com­ply with (e.g., access con­trol rules to IS resources). This is the case of the pre­vi­ous def­i­n­i­tion pro­vided by Bosch et al. [1993] or the under­stand­ing of Pfleeger [1997, p. 271], to whom a pol­icy is a “state­ment of the secu­rity we expect the sys­tem to enforce. An oper­at­ing sys­tem (or any other piece of trusted sys­tem) can be trusted only in rela­tion to a secu­rity pol­icy, that is, to the secu­rity needs the sys­tem is expected to sat­isfy.”

The sec­ond class points to the strate­gic nature of infor­ma­tion secu­rity in orga­ni­za­tions, where poli­cies are con­ceived as doc­u­ments that encap­su­late infor­ma­tion secu­rity man­age­ment deci­sions, par­tic­u­larly in what con­cerns the objec­tives that guide the efforts to pro­tect IS. This is the case of the pre­vi­ous def­i­n­i­tion pro­vided by Peltier [2002] or the under­stand­ing of Karyda et al. [2003, p. 147], who con­sider a secu­rity pol­icy “to be a high-level state­ment of the goals and objec­tives with regard to secu­rity, as well as the descrip­tion of the gen­eral means for their attain­ment.”

The third class of mean­ing con­veys a behav­ioral nature, where poli­cies are defined as guide­lines or guides for action by orga­ni­za­tional actors in the domain of infor­ma­tion secu­rity. As illus­tra­tions of this class of mean­ing we have the under­stand­ing advanced by King et al. [2001, p. 304] to whom an “orga­ni­za­tion’s secu­rity pol­icy, in essence, defines the details of what is per­mit­ted and what is denied within that orga­ni­za­tion’s com­puter sys­tems and net­works” and Bul­gurcu et al. [2010, p. 526] view that an ISP is “a state­ment of the roles and respon­si­bil­i­ties of the employ­ees to safe­guard the infor­ma­tion and tech­nol­ogy resources of their orga­ni­za­tions.”

Con­dens­ing these three classes of mean­ing, in this study we define ISPs as doc­u­ments that guide or reg­u­late peo­ple or sys­tems’ actions in the domain of infor­ma­tion secu­rity [de Sá-Soares 2005].

Hav­ing clar­i­fied our under­stand­ing of ISP, and given the focus of this study, next we review the lit­er­a­ture on infor­ma­tion secu­rity poli­cies con­tent, orga­niz­ing the con­tri­bu­tions into two groups: fea­tures of poli­cies and com­po­nents of poli­cies.

2.1 Features of Information Security Policies

The fea­tures of an ISP are the set of char­ac­ter­is­tics that the pol­icy doc­u­ment presents. The lit­er­a­ture review iden­ti­fied reg­u­lar­i­ties among the works of sev­eral researchers with regard to the fea­tures an ISP should pos­sess. Among the fea­tures that gather more con­sen­sus are its short length, accu­racy and clar­ity, ease of under­stand­ing, high level of abstrac­tion, dura­bil­ity and inde­pen­dence from the tech­nol­ogy and spe­cific secu­rity con­trols [Bar­man 2001; Hone and Eloff 2002b; Palmer et al. 2001; Peltier 2002; Pip­kin 2000].

The length of a pol­icy depends on the amount and com­plex­ity of the sys­tems and agents that it cov­ers, as well as the level of abstrac­tion applied in its writ­ing, since a doc­u­ment with a high level of abstrac­tion will not come into exten­sive detail. Höne and Eloff [2002a] rec­om­mend a length rang­ing between one and five pages.

The way poli­cies are writ­ten is another pre­pon­der­ant fac­tor con­sid­ered in the lit­er­a­ture, which rein­forces the need for the text to be accu­rate, clear and eas­ily under­stood. All these for­mal fea­tures of poli­cies sug­gest the con­cern that researchers place on the need of the recip­i­ents of these doc­u­ments to assim­i­late them quickly, com­pletely, and unam­bigu­ously. This con­cern is demon­strated by Simms [2009], by argu­ing that pol­icy for­mu­la­tion must pro­duce doc­u­ments that are clear, sim­ple and focused on the tar­get audi­ence and that they should include def­i­n­i­tions of tech­ni­cal terms used in them, to min­i­mize incon­sis­ten­cies in their inter­pre­ta­tion and to pre­vent that users do not com­ply with pol­icy deter­mi­na­tions due to a lack of under­stand­ing of the doc­u­ments. This need to write poli­cies in plain lan­guage and easy to under­stand had already been high­lighted by Kee [2001], who advanced the SMART rule (acronym for Spe­cific, Mea­sur­able, Agree­able, Real­is­tic and Time-bound) as a guide for writ­ing these doc­u­ments.

The dura­bil­ity of pol­icy doc­u­ments points to the need to revise the word­ing in the pol­icy at reg­u­lar inter­vals. This implies that these doc­u­ments should have an expected dura­tion, after which they should be sub­ject to assess­ment in order to deter­mine their ade­quacy and time­li­ness. This fea­ture enables that changes in IT or busi­ness are taken into account, as well as even­tual inad­e­qua­cies of poli­cies’ pro­vi­sions to the con­text for which they were orig­i­nally con­ceived. While poli­cies may con­sist of pro­vi­sional doc­u­ments, they should not be found in a con­tin­u­ous review process, since it is expected that these doc­u­ments show a min­i­mum sta­bil­ity over time. This sta­bil­ity of poli­cies will depend, in part, on not being too depen­dent upon spe­cific IT, which could hap­pen if they included ref­er­ences or assump­tions about the more tech­ni­cal aspects related to the imple­men­ta­tion of secu­rity mech­a­nisms, as these may vary over time [Hone and Eloff 2002b].

An addi­tional fea­ture of the poli­cies is how they are struc­tured, with dif­fer­ent authors rec­og­niz­ing dif­fer­ent forms of struc­tur­ing. Lindup [1995] acknowl­edges the exis­tence of orga­ni­za­tional poli­cies, which estab­lish gen­eral guide­lines for the infor­ma­tion secu­rity pro­gram, and of tech­ni­cal poli­cies, which estab­lish the secu­rity require­ments that a prod­uct or a com­puter sys­tem should observe. In turn, Whit­man et al. [2001] acknowl­edge the exis­tence of three fun­da­men­tal struc­tures for poli­cies:

• Indi­vid­ual pol­icy—In this struc­ture, the orga­ni­za­tion cre­ates a sep­a­rate and inde­pen­dent secu­rity pol­icy for each tech­nol­ogy and sys­tem used.

• Com­plete pol­icy—In this struc­ture, which is the most com­mon accord­ing to the authors, the orga­ni­za­tion cen­trally defines, con­trols and man­ages one sin­gle doc­u­ment which includes all the tech­nolo­gies used and pro­vides gen­eral guide­lines to all the sys­tems used by the orga­ni­za­tion.

• Mod­u­lar com­plete pol­icy—This pol­icy is cen­trally con­trolled and man­aged as in the case of the com­plete pol­icy, and it con­sists of gen­eral sec­tions, with descrip­tions of the tech­nolo­gies used, and dis­cus­sions about the sys­tems respon­si­ble and appro­pri­ate use. It dif­fers from the pre­vi­ous struc­ture because it includes mod­u­lar appen­dixes, which pro­vide spe­cific details on each tech­nol­ogy and bring for­ward par­tic­u­lar obser­va­tions, dif­fer­ences, restric­tions, and func­tion­al­i­ties related to the use of tech­nol­ogy which are not prop­erly cov­ered in the base pol­icy doc­u­ment. For Whit­man et al. [2001], this is the most effec­tive struc­ture for infor­ma­tion secu­rity poli­cies.

The medium in which the pol­icy takes shape should be con­sid­ered. It may be avail­able printed or in elec­tronic for­mat, in which case it may be eas­ier to change and dis­sem­i­nate by its recip­i­ents.

Finally, one may ask what kind of doc­u­ments the poli­cies are. The con­sid­er­a­tion of the poli­cies’ titles and the analy­sis of their com­po­nents may help typ­i­fy­ing the doc­u­ments.

2.2 Components of Information Security Policies

The com­po­nents of an infor­ma­tion secu­rity pol­icy are the set of ele­ments that the pol­icy doc­u­ment con­tains, i.e., its con­stituent parts.

The attempt to gen­er­al­ize the ele­ments that an ISP should include is ham­pered by the depen­dence that the com­po­si­tion of these doc­u­ments presents on the nature of the orga­ni­za­tion, its size and goals [Dhillon 1999; Karyda et al. 2003]. Although it is accepted that an ISP may vary con­sid­er­ably from orga­ni­za­tion to orga­ni­za­tion, this pos­si­bil­ity has not pre­vented some authors from mov­ing for­ward with guid­ance on the ele­ments that poli­cies should typ­i­cally include. Thus, Wood [1995] claims that ISPs should include gen­eral state­ments of aims, goals, beliefs and respon­si­bil­i­ties, fre­quently accom­pa­nied by gen­eral pro­ce­dures for their achieve­ment.

Whit­man [2004] argues that a good ISP should out­line indi­vid­ual respon­si­bil­i­ties, define which users are allowed to use the sys­tem, pro­vide employ­ees with an inci­dent report­ing mech­a­nism, estab­lish penal­ties for vio­la­tions of the pol­icy, and pro­vide a pol­icy updat­ing mech­a­nism.

Given the impor­tance of cur­rently avail­able nor­ma­tive ref­er­ences for the infor­ma­tion secu­rity man­age­ment activ­ity, the ISO/IEC 27000 series of stan­dards should be taken into account, namely ISO/IEC 27002, with respect to the com­po­nents of an ISP. Accord­ing to this inter­na­tional stan­dard, the pol­icy doc­u­ment should estab­lish the man­age­ment com­mit­ment to infor­ma­tion secu­rity and con­tain the fol­low­ing state­ments [ISO/IEC 2005]:

• A def­i­n­i­tion of infor­ma­tion secu­rity, its over­all objec­tives, scope and the impor­tance of secu­rity as an enabling mech­a­nism for infor­ma­tion shar­ing

• A state­ment of man­age­ment intent, sup­port­ing the goals and prin­ci­ples of infor­ma­tion secu­rity aligned with the busi­ness strat­egy and objec­tives

• A frame­work for set­ting con­trol objec­tives and con­trols

• A brief expla­na­tion of the secu­rity poli­cies, prin­ci­ples, stan­dards, and com­pli­ance require­ments of par­tic­u­lar impor­tance to the orga­ni­za­tion (com­pli­ance with leg­isla­tive, reg­u­la­tory, and con­trac­tual require­ments; secu­rity edu­ca­tion, train­ing, and aware­ness require­ments; busi­ness con­ti­nu­ity man­age­ment; and con­se­quences of infor­ma­tion secu­rity pol­icy vio­la­tions)

• A def­i­n­i­tion of gen­eral and spe­cific respon­si­bil­i­ties for infor­ma­tion secu­rity man­age­ment

• Ref­er­ences to doc­u­ments which may sup­port the pol­icy, such as more detailed secu­rity poli­cies and pro­ce­dures for spe­cific infor­ma­tion sys­tems or secu­rity rules users should com­ply with.

By com­par­ing sev­eral infor­ma­tion secu­rity stan­dards, Hone and Eloff [2002a] iso­lated the fol­low­ing ele­ments as generic com­po­nents that ISPs should include:

• Need for and Scope of Infor­ma­tion Secu­rity

• Objec­tives of Infor­ma­tion Secu­rity

• Def­i­n­i­tion of Infor­ma­tion Secu­rity

• Man­age­ment Com­mit­ment to Infor­ma­tion Secu­rity

• Approval of the Infor­ma­tion Secu­rity Pol­icy

• Pur­pose or Objec­tive of the Infor­ma­tion Secu­rity Pol­icy

• Infor­ma­tion Secu­rity Prin­ci­ples (risk man­age­ment, com­pli­ance, access con­trol, etc.)

• Roles and Respon­si­bil­i­ties

• Infor­ma­tion Secu­rity Pol­icy Vio­la­tions and Dis­ci­pli­nary Actions

• Mon­i­tor­ing and Review

• User Dec­la­ra­tion and Acknowl­edge­ment

• Cross Ref­er­ences (to other infor­ma­tion secu­rity doc­u­ments)

• Gen­eral Ele­ments (authors, date of pol­icy and review date of pol­icy)

Among the stud­ies reviewed, the com­po­nents that col­lect more con­sen­sus are the pur­pose of the pol­icy, its scope and the respon­si­bil­i­ties it assigns to orga­ni­za­tional agents. The pur­pose sets out the main objec­tives of the pol­icy and the rea­sons that led to its for­mu­la­tion [Robi­ette 2001]. The scope iden­ti­fies the sys­tems to which the pol­icy applies, the employ­ees to whom it is addressed and the sit­u­a­tions in which it is rel­e­vant [Hare 2004]. The respon­si­bil­i­ties clar­ify the duties of man­agers, tech­ni­cians and other employ­ees with regard to infor­ma­tion secu­rity [Kovacich 1998].

3. Research Questions

The aim of the study is to char­ac­ter­ize the con­tent of ISP doc­u­ments that have been adopted by orga­ni­za­tions. Its moti­va­tion was the inten­tion to sup­ple­ment accu­mu­lated knowl­edge with work grounded in the analy­sis of infor­ma­tion secu­rity empir­i­cal mate­ri­als.

Bear­ing in mind the goal of the work and how the lit­er­a­ture review on the con­tent of ISPs was orga­nized, we seek to answer the fol­low­ing research ques­tion: What fea­tures and com­po­nents do infor­ma­tion secu­rity pol­icy doc­u­ments present in prac­tice?

Link­ing this ques­tion with the main con­tri­bu­tions of the lit­er­a­ture allowed us to instan­ti­ate the spe­cific ques­tions that guided the analy­sis in terms of poli­cies’ fea­tures and com­po­nents. Thus, with respect to the fea­tures of poli­cies, we will address the fol­low­ing issues:

• What is the length of the pol­icy doc­u­ments?

• How are the poli­cies writ­ten?

• What is the expected dura­bil­ity of the pol­icy doc­u­ments?

• What is the struc­ture of the poli­cies?

• In what medium are the poli­cies deliv­ered?

• What kind of doc­u­ments are the poli­cies?

In what regards the poli­cies’ com­po­nents, we put for­ward the fol­low­ing spe­cific ques­tions:

• What com­po­nents do the poli­cies con­tain?

• Are there com­po­nents that form part of all pol­icy doc­u­ments?

• Are there com­po­nents that are not present in any of the pol­icy doc­u­ments?

• What is the pur­pose of the poli­cies?

• What is the scope of the poli­cies?

• What kinds of respon­si­bil­i­ties do the poli­cies deter­mine?

The analy­sis of the pro­vi­sions con­tained in the poli­cies may also allow under­stand­ing of whether the adopted poli­cies con­fig­ure doc­u­ments of a more descrip­tive or of a more pre­scrip­tive nature. Specif­i­cally, the analy­sis of the respon­si­bil­i­ties com­po­nent may clar­ify whether the pol­icy doc­u­ments, in prac­tice, reg­u­late behav­ior through the estab­lish­ment of pro­hi­bi­tions or per­mis­sions.

The answer to these ques­tions will enable to relate the fea­tures and com­po­nents of the poli­cies reviewed with the rec­om­men­da­tions made in the lit­er­a­ture with regard to the con­tent that pol­icy doc­u­ments should dis­play. This com­par­i­son will allow the assess­ment of the extent to which the doc­u­ments adopted by orga­ni­za­tions reflect the rec­om­men­da­tions of the lit­er­a­ture and, even­tu­ally, the iden­ti­fi­ca­tion of any dis­crep­an­cies whose under­stand­ing may require fur­ther inquiry.

4. Research Strategy

Since this study aims to ana­lyze ISP doc­u­ments actu­ally adopted by orga­ni­za­tions, the first chal­lenge to the design of this research was to obtain those doc­u­ments. Given the inten­tion of mak­ing a com­par­i­son between sev­eral pol­icy doc­u­ments, it was decided to restrict the col­lec­tion of doc­u­ments to a sin­gle orga­ni­za­tional sec­tor. With this option, we sought to min­i­mize the pos­si­bil­ity of doc­u­ments belong­ing to dif­fer­ent sec­tors hav­ing dif­fer­ent fea­tures and com­po­nents, due to par­tic­u­lar char­ac­ter­is­tics of each of those sec­tors as well as spe­cific infor­ma­tion secu­rity needs.

The sec­tor selected for the col­lec­tion of poli­cies was the local gov­ern­ment in Por­tu­gal. This sec­tor was selected for two major rea­sons. First, being one of the main investors in IT [Gart­ner 2009], the gov­ern­ment sec­tor offers an inter­est­ing case for study­ing infor­ma­tion secu­rity, and among the var­i­ous Pub­lic Admin­is­tra­tion insti­tu­tional agents, City Coun­cils assume a spe­cific rel­e­vance, as they con­cen­trate a grow­ing demand from their cit­i­zens for qual­ity infor­ma­tion ser­vices and for the diver­sity and quan­tity of data they deal with in the per­for­mance of their duties. Con­sid­er­ing the infor­ma­tion they manip­u­late, the secu­rity of their IS is indis­pens­able to their nor­mal func­tion­ing and to the pro­tec­tion of per­sonal data which they are entrusted with. The sec­ond rea­son relates to pre­vi­ous research under­taken by the authors on local gov­ern­ment infor­ma­tion secu­rity. Hav­ing con­ducted a sur­vey on ISPs adop­tion, we found that 38 (12%) of the 308 Por­tuguese City Coun­cils said to have adopted ISPs and 270 (88%) have not adopted any pol­icy yet [Lopes and de Sá-Soares 2010].

For the present study, we con­tacted those 38 City Coun­cils and asked them to pro­vide us the ISP doc­u­ment. This inter­ac­tion resulted in the col­lec­tion of 25 doc­u­ments, which are the basis for this study. The dis­tri­bu­tion of the doc­u­ments col­lected is pre­sented in Table 1 (the fig­ure marked with an aster­isk is explained by the fact that one City Coun­cil had for­mu­lated an ISP, but was await­ing for­mal approval for its adop­tion at the time the research team asked the pol­icy doc­u­ments to City Coun­cils).

Table 1: Dis­tri­b­u­tion of Pol­icy Doc­u­ments Col­lected

The char­ac­ter­i­za­tion of the pol­icy doc­u­ments in terms of their fea­tures and com­po­nents pre­sented researchers with dif­fer­ent chal­lenges. While most of the poli­cies’ fea­tures related ques­tions could be answered by a “more impres­sion­ist way” [Bab­bie 1999, p. 71], such as the length, dura­bil­ity, struc­ture and medium of the doc­u­ment, the ques­tions regard­ing poli­cies’ com­po­nents demanded a sys­tem­atic exam­i­na­tion. In order to per­form this exam­i­na­tion, we applied the con­tent analy­sis research tech­nique.

Con­tent analy­sis uses a group of pro­ce­dures to draw valid infer­ences from texts [Weber 1990]. As stated by Berel­son [1952, p. 74], con­tent analy­sis is a “research tech­nique for the objec­tive, sys­tem­atic, and quan­ti­ta­tive descrip­tion of man­i­fest con­tent of com­mu­ni­ca­tions.” So that this descrip­tion can be objec­tive, it requires a pre­cise def­i­n­i­tion of the analy­sis cat­e­gories, in order to enable dif­fer­ent researchers to use them and still get the same results. So that it is sys­tem­atic, the whole rel­e­vant con­tent must be ana­lyzed in rela­tion to all the mean­ing­ful cat­e­gories. Finally, quan­tifi­ca­tion allows the pro­vi­sion of more pre­cise and objec­tive infor­ma­tion con­cern­ing the occur­rence fre­quency of con­tent fea­tures.

The process of con­tent analy­sis starts with the cre­ation of a scheme of cat­e­gories com­posed of the var­i­ous analy­sis units. The more clearly for­mu­lated and well adapted to the prob­lem and con­tent under analy­sis the cat­e­gories are, the more pro­duc­tive the stud­ies using con­tent analy­sis will be [Berel­son 1952]. After the sys­tem of cat­e­gories to use in the analy­sis has been estab­lished, it is pos­si­ble to move on to the cod­ing stage.

From a pro­ce­dural point of view, the analy­sis of ISPs pro­ceeded as fol­lows:

1. Elab­o­ra­tion of the code­book—The sec­ond author elab­o­rated a code­book to sup­port the analy­sis of the doc­u­ments. The code­book devel­op­ment fol­lowed the gen­eral guide­lines pro­vided by Mac­Queen et al. [1998]. The codes were defined based on an exten­sive review of the lit­er­a­ture on ISPs and of nine stan­dards in the field of infor­ma­tion secu­rity. Besides the code iden­ti­fier, each code has asso­ci­ated the fol­low­ing fields of infor­ma­tion: code name, brief descrip­tion, full descrip­tion, when to use the code, and when not to use the code. The code­book is com­posed of 51 main codes. Some of these codes require the jux­ta­po­si­tion of sub­codes, namely the tar­gets of the pol­icy as spec­i­fied in its scope, spe­cific respon­si­bil­i­ties of the pol­icy owner, enti­ties to con­tact for spe­cific pur­poses related to the pol­icy, to whom a pol­icy pro­vi­sion applies, the type of par­tic­u­lar respon­si­bil­i­ties and the infor­ma­tion secu­rity object a par­tic­u­lar pro­vi­sion of the pol­icy refers to.

2. Elab­o­ra­tion of cod­ing instruc­tions—The sec­ond author pre­pared a doc­u­ment with instruc­tions to guide the cod­ing stage. These instruc­tions include prepara­tory work to under­take before start­ing cod­ing and the sequence of steps that should be per­formed by the coder when pro­cess­ing each pol­icy doc­u­ment, includ­ing what to do if ques­tions arise dur­ing the cod­ing process.

3. Set up of cod­ing team—A team of two coders was set up for ana­lyz­ing the poli­cies. One of the coders was the first author of this paper and the other coder was a third researcher. Both researchers were versed on infor­ma­tion secu­rity.

4. Prepa­ra­tion of the cod­ing team—The cod­ing team per­formed sev­eral pre­lim­i­nary tasks before start­ing the cod­ing process of the 25 poli­cies. After a thor­ough study of the code­book and cod­ing instruc­tions, a meet­ing was set up with coders and the author of the code­book and cod­ing instruc­tions to answer ques­tions that the study might have raised. Since the cod­ing process can be made eas­ier and more sys­tem­atic by using text pro­cess­ing tools, in this study the coders resorted to the qual­i­ta­tive data analy­sis soft­ware ATLAS.ti. Assisted by this pro­gram, the coders were trained using the code­book and cod­ing instruc­tions by cod­ing four ISPs not per­tain­ing to the 25 poli­cies that form the basis of this study. A sec­ond meet­ing was held with the author of the code­book and cod­ing instruc­tions to jointly ana­lyze the qual­ity of the cod­ing and to clar­ify any pend­ing issues. When­ever the phras­ing used in the code­book was con­sid­ered ambigu­ous, the sec­ond author clar­i­fied it, pro­duc­ing a revised ver­sion of the code­book.

5. Prepa­ra­tion of the doc­u­ments—The first author pre­pared the doc­u­ments to com­ply with the cod­ing instruc­tions and to allow the use of qual­i­ta­tive data analy­sis soft­ware.

6. Cod­ing process—Each coder indi­vid­u­ally coded the 25 ISPs. At the end of this process, the coders met to dis­cuss spe­cific dis­sim­i­lar­i­ties in the out­put of the cod­ing process and to make fine adjust­ments to some units of analy­sis in what con­cerns the degree of cod­ing detail.

The time spent on cod­ing by the two coders was approx­i­mately 120 hours, which cor­re­sponds to an aver­age of 2.4 hours per pol­icy doc­u­ment per coder.

5. Results

The length of the ISP doc­u­ments ana­lyzed ranges between a max­i­mum of 26 pages and a min­i­mum of one page. The aver­age length is 8.8 pages, with stan­dard devi­a­tion of 6.2 pages. For a 99% con­fi­dence inter­val, the pop­u­la­tion mean is in the range defined by 9 ± 2 pages. In terms of words, the doc­u­ments range between a max­i­mum of 5497 words and a min­i­mum of 125 words, with an aver­age length of 2180 words and stan­dard devi­a­tion of 1468 words. For a sim­i­lar con­fi­dence inter­val, the pop­u­la­tion mean is in the range defined by 2180 ± 485 words.

In the opin­ion of the coders, most of the pol­icy doc­u­ments are easy to read and to under­stand, prop­erly struc­tured and writ­ten in a clear, cor­rect and intel­li­gi­ble lan­guage. Some of the doc­u­ments that apply tech­ni­cal terms in the realm of infor­ma­tion secu­rity pro­vide a list of def­i­n­i­tions for those terms.

The major­ity of the doc­u­ments do not allow any infer­ence in what regards its dura­bil­ity. Of the 25 doc­u­ments, only one pol­icy dis­plays its default expected dura­bil­ity, by stat­ing when the doc­u­ment should be reviewed.

The analy­sis of the 25 ISPs pro­vided by the City Coun­cils sug­gests that these doc­u­ments may be clas­si­fied as orga­ni­za­tional poli­cies, fol­low­ing Lindup’s [1995] cat­e­go­riza­tion. None of the col­lected doc­u­ments con­fig­ures a purely tech­ni­cal pol­icy aimed to reg­u­late the secu­rity behav­ior of a tech­no­log­i­cal sys­tem or prod­uct. Still con­sid­er­ing the struc­tur­ing of the poli­cies, and apply­ing the cat­e­gories sug­gested by Whit­man et al. [2001], three poli­cies (12%) are ‘indi­vid­ual poli­cies’, 21 (84%) fit the type ‘com­plete pol­icy’ and one (4%) is a ‘com­plete mod­u­lar pol­icy’.

All of the pol­icy doc­u­ments were pro­vided in elec­tronic ver­sion, except one that was sent printed by con­ven­tional mail. The exam­i­na­tion of the poli­cies showed that in five doc­u­ments (20%), the pol­icy deter­mined what medium should be employed for its dis­sem­i­na­tion: three by elec­tronic means (intranet and email) and two printed.

Of the 25 poli­cies, 23 (92%) have a clearly iden­ti­fi­able title. Nev­er­the­less, the title of the doc­u­ments varies con­sid­er­ably, though they may be grouped into the fol­low­ing cat­e­gories: reg­u­la­tion (nine cases), norm (nine cases), man­ual of rules and pro­ce­dures (two cases), job instruc­tions (one case), rule (one case) and pol­icy (one case). Despite this vari­ety, most of the titles include a ref­er­ence to IS or IT, such as infor­ma­tion, IT equip­ment, email, inter­net, com­put­ers, and appli­ca­tions. It should be noted that although all the doc­u­ments con­tain pro­vi­sions regard­ing infor­ma­tion secu­rity (most con­cern­ing accept­able use of IT and infor­ma­tion, and in a reduced num­ber of cases regard­ing infor­ma­tion secu­rity man­age­ment deter­mi­na­tions), and five have the word ‘secu­rity’ in their title, none of the doc­u­ments was labeled infor­ma­tion secu­rity pol­icy, although they are viewed as such doc­u­ments by the City Coun­cils con­cerned.

With regard to the com­po­nents com­prised in the poli­cies, there is con­sid­er­able vari­a­tion among the doc­u­ments ana­lyzed. Although sev­eral poten­tial com­po­nents were taken into account in this study, in Table 2 we present the most fre­quent com­po­nents that were found in the poli­cies. The list was sorted in descend­ing order of fre­quency.

Table 2: Com­po­nents Con­tained in the Infor­ma­tion Secu­rity Poli­cies

The com­po­nents that appear in more than half of the poli­cies are respon­si­bil­i­ties of indi­vid­ual or entity (the duties and oblig­a­tions of orga­ni­za­tional agents regard­ing infor­ma­tion secu­rity), infor­ma­tion secu­rity direc­tives (deci­sions for the imple­men­ta­tion of infor­ma­tion secu­rity), require­ments for infor­ma­tion secu­rity (imper­a­tives for the infor­ma­tion secu­rity efforts under­taken by the orga­ni­za­tion), pur­pose of pol­icy (why the pol­icy was for­mu­lated), con­tacts (the name and means of con­tact of an indi­vid­ual or orga­ni­za­tional unit), scope of pol­icy (to whom the pol­icy applies), penal­ties (the con­se­quences for infor­ma­tion secu­rity vio­la­tions), and approval of pol­icy (state­ment of man­age­ment approv­ing the pol­icy). Of these com­po­nents, only one is uni­ver­sal to the 25 doc­u­ments, namely ‘respon­si­bil­i­ties’.

In some doc­u­ments, the pur­pose of the pol­icy was stated as the rea­son for why the pol­icy was for­mu­lated and in other doc­u­ments to spec­ify what the City Coun­cil wants to achieve with the pol­icy. The inci­dences of the pur­pose are the IT resources (eight cases), inter­net and email (five cases), infor­ma­tion (five cases), accept­able use of IT (three cases), and IT/IS resources opti­miza­tion (two cases). Some of the doc­u­ments spec­ify pur­poses that fall in more than one of the pre­vi­ous cat­e­gories.

Of the 13 doc­u­ments where the scope of the pol­icy is spec­i­fied, nine apply to indi­vid­ual orga­ni­za­tional col­lab­o­ra­tors, seven to IT sys­tems and three to orga­ni­za­tional units (the sum is greater than 13 because six doc­u­ments include more than one scope tar­get). None of the doc­u­ments iden­ti­fies infor­ma­tion on its scope spec­i­fi­ca­tion.

In what con­cerns respon­si­bil­i­ties, the major types of respon­si­bil­i­ties allo­cated to users or orga­ni­za­tional units, i.e., those that appear in more than half of the doc­u­ments, are listed in Table 3, along­side with the absolute and per­cent num­ber of doc­u­ments men­tion­ing the type in ques­tion.

Table 3: Major Types of Respon­si­bil­i­ties

It should be stressed that the rec­om­men­da­tions con­tained in the infor­ma­tion secu­rity poli­cies vary accord­ing to the type of user they refer to. There are pro­vi­sions, such as oper­a­tional pro­ce­dures and respon­si­bil­i­ties, whose tar­gets are IT/IS tech­ni­cians. The respon­si­bil­ity for main­tain­ing, mon­i­tor­ing com­pli­ance, and review­ing the infor­ma­tion secu­rity pol­icy usu­ally rests on a spe­cific IT/IS unit (the IT/IS unit). Con­sid­er­ing generic users (all those that manip­u­late infor­ma­tion in the orga­ni­za­tion and that use IT equip­ment), the analy­sis of the doc­u­ments revealed there are a set of respon­si­bil­i­ties that can be said to be trans­ver­sal to most of the doc­u­ments, namely those reg­u­lat­ing the use of email, inter­net use, IT equip­ment use, soft­ware pro­tected by copy­right and inter­nal com­puter net­work use.

Another view on the respon­si­bil­i­ties is the nature of respon­si­bil­ity assigned to an agent. The cod­ing results show that 207 of the total num­ber of respon­si­bil­i­ties con­tained in the pol­icy doc­u­ments are pro­hi­bi­tions (inter­dic­tions to per­form cer­tain infor­ma­tion secu­rity related actions, phrased using terms such as ‘must not’ and ‘for­bid­den to’), 179 are oblig­a­tions (bonds to per­form cer­tain infor­ma­tion secu­rity related actions, phrased using terms such as ‘must’ or ‘has to’), 148 are duties (com­mit­ments to per­form or not to per­form cer­tain infor­ma­tion secu­rity related actions, phrased using terms such as ‘should’ or ‘should not’), and 28 are rec­om­men­da­tions (guid­ance to per­form cer­tain infor­ma­tion secu­rity related actions, phrased using terms such as ‘may’ or ‘con­sider’).

6. Discussion

The aver­age length of the poli­cies exceeds what is rec­om­mended by some authors as being the ideal length. Two doc­u­ments are very brief (one page long), merely set­ting rules for inter­net and email use. Nine poli­cies are lengthy (more than nine pages long) and include detailed pro­vi­sions for a wide range of IT/IS and address dif­fer­ent audi­ences (generic users, IT/IS tech­ni­cians, orga­ni­za­tional units). Typ­i­cally, these doc­u­ments con­sist of inter­nal reg­u­la­tions, orga­nized into chap­ters and arti­cles. In these doc­u­ments infor­ma­tion secu­rity related pro­vi­sions go along with other types of deter­mi­na­tions, such as the IT/IS unit’s orga­ni­za­tion, com­pe­ten­cies and respon­si­bil­i­ties and the role IT plays in the orga­ni­za­tion. There­fore, sev­eral of the doc­u­ments ana­lyzed do not con­fine to ISPs, includ­ing other pro­vi­sions asso­ci­ated to IT/IS, besides those related to infor­ma­tion secu­rity.

The analy­sis revealed that the main recip­i­ents of the doc­u­ments are generic users of IT/IS and IT/IS tech­ni­cians. Given the het­ero­gene­ity of generic users cov­ered by the poli­cies, the lan­guage used in the doc­u­ments is clear and easy to read. Most of the longer doc­u­ments tar­get the two types of recip­i­ents. The coex­is­tence of these two types of recip­i­ents in the same doc­u­ment may decrease its effec­tive­ness since it puts together audi­ences with dif­fer­ent respon­si­bil­i­ties, knowl­edge, skills, and require­ments in the con­text of IS secu­rity. Keep­ing apart generic users from IT/IS spe­cial­ized users, by devel­op­ing two sep­a­rate doc­u­ments, could increase the effec­tive­ness of poli­cies. Alter­na­tively, City Coun­cils could choose to struc­ture their ISP doc­u­ments as mod­u­lar poli­cies, where a root and gen­eral doc­u­ment is sup­ple­mented by mod­u­lar appen­dixes which may be suited to dif­fer­ent tar­gets and sit­u­a­tions.

The type of the pol­icy doc­u­ment appears to depend on the type and diver­sity of its recip­i­ents: when­ever there is a wider access to IT/IS, this access is con­trolled by reg­u­la­tion, which will have to be approved by the Munic­i­pal Assem­bly in order to be effec­tive by law; when­ever the IT/IS are accessed only by and for the City Coun­cil employ­ees, the con­trol is estab­lished by norms, job instruc­tions, poli­cies, or rules. What­ever the case, the titles of the doc­u­ments are aligned with the spe­cific praxis and uni­verse of dis­course of pub­lic admin­is­tra­tion agen­cies.

Most of the doc­u­ments ana­lyzed are fun­da­men­tally IT/IS accept­able use poli­cies, focus­ing on the daily work rou­tine of employ­ees in what con­cerns the manip­u­la­tion of infor­ma­tion and IT. The pri­or­i­ties of this accept­able use are con­cen­trated on the com­pli­ance with legal require­ments (e.g., respect for copy­rights, using IT resources only for busi­ness related activ­i­ties and not par­tic­i­pat­ing in abu­sive or illicit use of IT/IS), secure infor­ma­tion exchange (e.g., not open­ing sus­pi­cious email attach­ments, not down­load­ing soft­ware from the inter­net and main­tain­ing the antivirus appli­ca­tion updated), def­i­n­i­tion of respon­si­bil­i­ties for IS assets, and man­age­ment of users’ access to IT/IS. It is also expected that the respon­si­ble use of IT/IS will lead to an opti­miza­tion of IS/IT resources, includ­ing free­ing the IT/IS unit from time con­sum­ing tasks result­ing from user mis­use of sys­tems and appli­ca­tions.

The option for printed doc­u­ments seems to be jus­ti­fied by the need for users to sign a term of acknowl­edge­ment and respon­si­bil­ity con­cern­ing infor­ma­tion secu­rity pro­vi­sions.

With regard to the com­po­nents found in the ISPs, there is an oscil­la­tion in vari­ety and fre­quency (cf. Table 2). Behind this find­ing may be the fact that City Coun­cils dif­fer in terms of infor­ma­tion secu­rity man­age­ment matu­rity lev­els. The inten­sity and com­plex­ity of their use of IT/IS may also play an impor­tant role in the degree of sophis­ti­ca­tion of their secu­rity poli­cies. What­ever the case, the City Coun­cils that have a com­plete ISP doc­u­ment in the light of the lit­er­a­ture are few in num­ber. This may result from a lack of clear and coher­ent ISP mod­els which can be adopted by City Coun­cils accord­ing to their own secu­rity needs (to date in Por­tu­gal there was no generic ISP doc­u­ment issued by a cen­tral gov­ern­men­tal agency that City Coun­cils had to adopt). Explor­ing the asso­ci­a­tion between the length of poli­cies and the num­ber of com­po­nents present, one finds Pear­son r = 0.64 (for the length in pages) and r = 0.63 (for the length in words—cal­cu­lat­ing the asso­ci­a­tion between the nat­ural log­a­rithm of the num­ber of words and the num­ber of com­po­nents increases r to 0.68), both val­ues for p < 0.001. The cor­re­spond­ing coef­fi­cient of deter­mi­na­tion amounts to 40%, sug­gest­ing that an increase in the length of pol­icy is asso­ci­ated with an increase in the com­po­nents present in the ISP doc­u­ment. To some extent this could be expected—longer doc­u­ments may just con­tain more ele­ments, but it raises ques­tions regard­ing the size of ISP doc­u­ments that is actu­ally needed to accom­mo­date the num­ber of pol­icy com­po­nents sug­gested in the lit­er­a­ture.

Among the com­po­nents, only ‘respon­si­bil­i­ties’ form part of all doc­u­ments, clearly denot­ing the behav­ioral guid­ance nature of ISPs. Yet, some of the com­po­nents rec­om­mended by the lit­er­a­ture as essen­tial for an effec­tive ISP are absent from all doc­u­ments, such as the def­i­n­i­tion of infor­ma­tion secu­rity, state­ment of the impor­tance of infor­ma­tion secu­rity for the orga­ni­za­tion, dec­la­ra­tion of man­age­ment com­mit­ment for infor­ma­tion secu­rity, entity respon­si­ble for the pol­icy, pol­icy com­pli­ance mon­i­tor­ing, base­line secu­rity con­trols, and intended secu­rity level.

In only one case there is a ref­er­ence to the time scope in which the pol­icy should be revised. This may result in a poten­tial gap between the poli­cies’ pro­vi­sions and the risks that con­tin­u­ously appear along with the tech­no­log­i­cal and busi­ness evo­lu­tion. Other com­po­nents, though not totally absent, are only found on a sub­set of the doc­u­ments, such as who approved the pol­icy doc­u­ment (when present, the approval is mainly obtained in the Coun­cil meet­ing), how secu­rity objec­tives serve busi­ness objec­tives, and the mech­a­nism to report infor­ma­tion secu­rity inci­dents.
Bear­ing in mind the num­ber of pro­hi­bi­tions and oblig­a­tions that stand out in the poli­cies, the doc­u­ments show a clear ten­dency to a more impos­ing or imper­a­tive char­ac­ter of behav­ior adop­tion or absten­tion con­cern­ing IT/IS users and tech­ni­cians. Although the poli­cies reveal a high degree of behav­ior and con­duct impo­si­tion or pre­scrip­tion, thus hav­ing an unde­ni­ably pre­scrip­tive char­ac­ter, if one con­sid­ers the high level of detail enclosed in sev­eral poli­cies, these doc­u­ments also assume a descrip­tive char­ac­ter. The descrip­tive parts of the doc­u­ments edu­cate and inform read­ers on issues such as the impor­tance of IT to City Coun­cils’ mis­sions, respon­si­ble use of IT, inter­nal orga­ni­za­tion of the IT/IS unit, applic­a­ble legal require­ments, and gen­eral secu­rity direc­tives.

7. Conslusion

This study involved the char­ac­ter­i­za­tion of 25 infor­ma­tion secu­rity poli­cies adopted by Por­tuguese City Coun­cils in terms of com­po­nents and fea­tures. This work con­trib­utes to the lit­er­a­ture by ana­lyz­ing infor­ma­tion secu­rity empir­i­cal mate­ri­als and bring­ing more prac­ti­cal and prac­ti­tioner ori­ented per­spec­tives to infor­ma­tion secu­rity research. By focus­ing on the sub­stance and form of actual ISPs, it elu­ci­dates an area of infor­ma­tion secu­rity research that has been largely ignored, in spite of its prac­ti­cal rel­e­vance for the improve­ment of infor­ma­tion secu­rity by orga­ni­za­tions and sup­ple­ments the lit­er­a­ture whose tra­di­tional focus has been on indi­vid­ual inten­tions towards ISPs. Besides com­par­ing the rec­om­men­da­tions in lit­er­a­ture con­cern­ing ISPs con­tent with the prac­tice per­formed by orga­ni­za­tions, the paper laid ground­work for assess­ing the con­nec­tion between ISP con­tent and ISP com­pli­ance. The work also resorted to a less-uti­lized method in infor­ma­tion secu­rity research, evi­denc­ing that con­tent analy­sis is a well suited approach to exam­ine ISP doc­u­ments.

This research work has some lim­i­ta­tions, namely with regard to the num­ber of doc­u­ments col­lected. Although we believe that the 25 poli­cies gen­er­ated enough data to serve the pur­pose of the work, we also believe that a larger num­ber might result in a richer and more sus­tained data set. Nev­er­the­less, it should be noted that infor­ma­tion secu­rity poli­cies are gen­er­ally con­sid­ered reserved doc­u­ments by orga­ni­za­tions, which makes hard the access to this kind of secu­rity con­trol.

Another lim­i­ta­tion of this paper regards the delim­i­ta­tion of the study to one orga­ni­za­tional sec­tor and to the national ter­ri­tory. This pre­vents con­clu­sions con­cern­ing dif­fer­ences related to the mis­sions as well as the func­tion­ing of other types of orga­ni­za­tions as well as pos­si­ble cul­tural dif­fer­ences regard­ing City Coun­cils or other orga­ni­za­tions in other coun­tries or cul­tures.

Among the pos­si­ble works to be car­ried out in the future, we point out the pro­posal of an ISP tem­plate, so that it may be used as a poten­tial model in an attempt to invert the reduced num­ber of exist­ing poli­cies in the Por­tuguese City Coun­cils.

Another future work stem­ming from one of the lim­i­ta­tions is to ana­lyze ISP doc­u­ments of orga­ni­za­tions belong­ing to other sec­tors. This would enable the com­par­i­son of pol­icy doc­u­ments’ con­tent in terms of fea­tures and com­po­nents, for instance between pub­lic sec­tor orga­ni­za­tions and pri­vate orga­ni­za­tions.

Lastly, it would make sense to pro­mote research focus­ing on the process of adopt­ing ISPs by City Coun­cils, namely in what relates to the for­mu­la­tion and imple­men­ta­tion of poli­cies. By study­ing how orga­ni­za­tions develop their ISPs we may find out the rea­sons for these doc­u­ments to present the fea­tures and com­po­nents dis­cussed in this paper. Sim­i­larly, by inter­view­ing these orga­ni­za­tions about ISP imple­men­ta­tion we could be in a bet­ter posi­tion to relate ISP con­tents to ISP com­pli­ance by users, thus con­tribut­ing to bridge the gap between infor­ma­tion secu­rity the­ory and prac­tice.

References

• ACL (2001). Dicionário de Lín­gua Por­tuguesa Con­tem­porânea da Acad­e­mia das Ciên­cias de Lis­boa. Lis­boa: Verbo.

  Bab­bie, E. (1999). Méto­dos de Pesquisa de Sur­vey. Belo Hor­i­zonte: UFMG.

  Bar­man, S. (2001). Writ­ing Infor­ma­tion Secu­rity Poli­cies. Indi­anapo­lis: New Rid­ers.

  Baskerville, R. and M. Sipo­nen (2002). An infor­ma­tion secu­rity meta-pol­icy for emer­gent orga­ni­za­tions. Logis­tics Infor­ma­tion Man­age­ment 15 (5/6), 337–346.

  Berel­son, B. (1952). Con­tent Analy­sis in Com­mu­ni­ca­tions Research. New York: Free Press.

  Bosch, C., J. Eloff and J. Car­roll (1993). Inter­na­tional Stan­dards and Orga­ni­za­tional Secu­rity Needs: Bridg­ing the Gap. Pro­ceed­ings of the IFIP TC11 Ninth Inter­na­tional Con­fer­ence on Infor­ma­tion Secu­rity, 171–183

  Boss, S. R., L. J. Kirsch, I. Anger­meier, R. A. Shin­gler and R. W. Boss (2009). If some­one is watch­ing, I’ll do what I’m asked: manda­tori­ness, con­trol, and infor­ma­tion secu­rity. Euro­pean Jour­nal of Infor­ma­tion Sys­tems 18(2), 151–164.

  Bul­gurcu, B., H. Cavu­soglu and I. Ben­basat (2010). Infor­ma­tion Secu­rity Pol­icy Com­pli­ance: An Empir­i­cal Study of Ratio­nal­ity-Based Beliefs and Infor­ma­tion Secu­rity Aware­ness. MIS Quar­terly 34(3), 523–548.

  Dhillon, G. (1999). Man­ag­ing and con­trol­ling com­puter mis­use. Infor­ma­tion Man­age­ment & Com­puter Secu­rity 7(4), 171–175.

  Ful­ford, H. and N. F. Doherty (2003). The appli­ca­tion of infor­ma­tion secu­rity poli­cies in large UK-based orga­ni­za­tions: an exploratory inves­ti­ga­tion. Infor­ma­tion Man­age­ment & Com­puter Secu­rity 11(3), 106–114.

  Gart­ner (2009). Dataquest Alert: Fore­cast, IT Spend­ing in Indus­tries, World­wide, 3Q09 Update. Octo­ber.

  Gilbert, C. (2003). Guide­lines for an Infor­ma­tion Shar­ing Pol­icy. SANS Insti­tute.

  Guel, M. (2007). A Short Primer for Devel­op­ing Secu­rity Poli­cies. SANS Insti­tute.

  Hare, C. (2004). Pol­icy Devel­op­ment. In Trip­ton, H. F. and M. Krause (Eds.), Infor­ma­tion Secu­rity Man­age­ment Hand­book, fifth edi­tion. 925–944. Boca Raton: Auer­bach.

  Herath, T. and H. R. Rao (2009). Pro­tec­tion moti­va­tion and deter­rence: a frame­work for secu­rity pol­icy com­pli­ance in organ­i­sa­tions. Euro­pean Jour­nal of Infor­ma­tion Sys­tems 18(2), 106-125.

  Hig­gins, H. N. (1999). Cor­po­rate sys­tem secu­rity: towards an inte­grated man­age­ment approach. Infor­ma­tion Man­age­ment & Com­puter Secu­rity 7(5), 217–222.

  Höne, K. and J. Eloff (2002a). Infor­ma­tion secu­rity pol­icy—what do inter­na­tional infor­ma­tion secu­rity stan­dards say? Com­put­ers & Secu­rity 21(5), 402–409.

  Höne, K. and J. Eloff (2002b). What makes an effec­tive secu­rity pol­icy? Net­work Secu­rity 6(1), 14–16.

  Hong, K. S., Y. P. Chi, L. R. Chao and J.-H. Tang (2003). An inte­grated sys­tem the­ory of infor­ma­tion secu­rity man­age­ment. Infor­ma­tion Man­age­ment & Com­puter Secu­rity 11(5), 243–248.

  ISO/IEC (2005). ISO/IEC 27002—Infor­ma­tion tech­nol­ogy—Secu­rity tech­niques—Infor­ma­tion secu­rity man­age­ment sys­tems—Require­ments. Inter­na­tional Orga­ni­za­tion for Stan­dard­iza­tion/Inter­na­tional Elec­trotech­ni­cal Com­mis­sion.

  ISO/IEC (2009). ISO/IEC 27000—Infor­ma­tion tech­nol­ogy—Secu­rity tech­niques—Infor­ma­tion secu­rity man­age­ment sys­tems—Overview and vocab­u­lary. Inter­na­tional Orga­ni­za­tion for Stan­dard­iza­tion/Inter­na­tional Elec­trotech­ni­cal Com­mis­sion.

  John­ston, A. C. and M. Warkentin (2010). Fear Appeals and Infor­ma­tion Secu­rity Behav­iors: An Empir­i­cal Study. MIS Quar­terly 34(3), 549–566.

  Karyda, M., S. Koko­lakis and E. Kioun­touzis (2003). Con­tent, Con­text, Process Analy­sis of IS Secu­rity Pol­icy For­ma­tion. In Gritza­lis, D., S. D. C di Vimer­cati, P. Sama­rati and S. K. Kat­sikas (Eds.), Secu­rity and Pri­vacy in the Age of Uncer­tainty, 145–156. IFIP TC11 Inter­na­tional Con­fer­ence on Infor­ma­tion Secu­rity (SEC2003), IFIP Con­fer­ence Pro­ceed­ings. Ams­ter­dam: Kluwer.

  Karyda, M., E. Kioun­touzis and S. Koko­lakis (2005). Infor­ma­tion sys­tems secu­rity poli­cies: a con­tex­tual per­spec­tive. Com­put­ers & Secu­rity 24(3), 246–260.

  Kee, C. (2001). Secu­rity Pol­icy Roadmap—Process for Cre­at­ing Secu­rity Poli­cies. SANS Insti­tute.

  King, C. M., C. E. Dal­ton and T. E. Osman­oglu (2001). Secu­rity Archi­tec­ture: Design, Deploy­ment, and Oper­a­tions. Berke­ley: Osborne/McGraw-Hill.

  Knapp, K., R. Mar­shall, K. Rainer and N. Ford. (2006). Infor­ma­tion Secu­rity: Man­age­ment’s Effect on Cul­ture and Pol­icy. Infor­ma­tion Man­age­ment & Com­puter Secu­rity 11(1), 24–36.

  Kovacich, G. L. (1998). The Infor­ma­tion Sys­tems Secu­rity Offi­cer’s Guide: Estab­lish­ing and Man­ag­ing an Infor­ma­tion Pro­tec­tion Pro­gram. Woburn: But­ter­worth-Heine­man.

  Lindup, K. R. (1995). A New Model for Infor­ma­tion Secu­rity Poli­cies. Com­put­ers & Secu­rity 14(8), 691–695.

  Lopes, I. and F. de Sá-Soares (2010). Infor­ma­tion Sys­tems Secu­rity Poli­cies: A Sur­vey in Por­tuguese Pub­lic Admin­is­tra­tion. Pro­ceed­ings of the IADIS Inter­na­tional Con­fer­ence on Infor­ma­tion Sys­tems, 61–69. Porto.

  Mac­Queen, K. M., E. McLel­lan, K. Kay and B. Mil­stein (1998). Code­book Devel­op­ment for Team-Based Qual­i­ta­tive Analy­sis. Cul­tural Anthro­pol­ogy Meth­ods 10(2), 31–36.

  Myyry, L., M. Sipo­nen, S. Pah­nila, T. Var­tainen and A. Vance (2009). What lev­els of moral rea­son­ing and val­ues explain adher­ence to infor­ma­tion secu­rity rules? An empir­i­cal study. Euro­pean Jour­nal of Infor­ma­tion Sys­tems 18(2), 126–139.

  Palmer, M. E., C. Robin­son, J. C. Patilla and E. P. Moser (2001). Infor­ma­tion Secu­rity Pol­icy Frame­work: Best Prac­tices for Secu­rity Pol­icy in the E-com­merce Age. Infor­ma­tion Sys­tems Secu­rity 10(2), 13–27.

  Peltier, T. R. (2002). Infor­ma­tion Secu­rity Poli­cies, Pro­ce­dures, and Stan­dards: Guide­lines for Effec­tive Infor­ma­tion Secu­rity Man­age­ment. Boca Raton: Auer­bach Pub­li­ca­tions.

  Pfleeger, C. P. (1997). Secu­rity in Com­put­ing, sec­ond edi­tion. Lon­don: Pren­tice-Hall Inter­na­tional.

  Pip­kin, D. L. (2000). Infor­ma­tion Secu­rity: Pro­tect­ing the Global Enter­prise. Upper Sad­dle River: Pren­tice Hall PTR.

  Robi­ette, A. (2001). Devel­op­ing an Infor­ma­tion Secu­rity Pol­icy. JISC, http://www.jisc.ac.uk/abou­tus/howjis­c­works/com­mit­tees/sub­com­mit­tees/past­com­mit­tees/jcas/jcas­pa­persse­cu­rity.aspx

  de Sá-Soares, F. (2005). Inter­pre­tação da Segu­rança de Sis­temas de Infor­mação segundo a Teo­ria da Acção. PhD The­sis, Uni­ver­sity of Minho, Guimarães.

  Schneier, B. (2000). Secrets and Lies: Dig­i­tal Secu­rity in a Net­worked World. New York: John Wiley & Sons.

  Shorten, B. (2004). Infor­ma­tion Secu­rity Poli­cies from the Ground Up. In Trip­ton, H.F. and M. Krause (Eds.), Infor­ma­tion Secu­rity Man­age­ment Hand­book, fifth edi­tion, 917–924. Boca Raton: Auer­bach.

  Simms, D.J. (2009). Infor­ma­tion Secu­rity Opti­miza­tion: From The­ory to Prac­tice. ARES–Inter­na­tional Con­fer­ence on Avail­abil­ity, Reli­a­bil­ity and Secu­rity, p. 675-680.

  Sipo­nen, M. and A. Vance (2010). Neu­tral­iza­tion: New Insights into the Prob­lem of Employee Infor­ma­tion Sys­tems Secu­rity Pol­icy Vio­la­tions. MIS Quar­terly 34(3), 487–502.

  Warkentin, M., A. C. John­ston and J. Shrop­shire (2011). The influ­ence of the infor­mal social learn­ing envi­ron­ment on infor­ma­tion pri­vacy pol­icy com­pli­ance effi­cacy and inten­tion. Euro­pean Jour­nal of Infor­ma­tion Sys­tems 20(3), 267–284.

  Weber, R. (1990). Basic Con­tent Analy­sis, sec­ond edi­tion. Sage Uni­ver­sity Paper.

  Whit­man, M. E. (2004). In Defense of the Realm: Under­stand­ing Threats to Infor­ma­tion Secu­rity. Infor­ma­tional Jour­nal of Infor­ma­tion Man­age­ment 24(1), 3–4.

  Whit­man, M. E., A. M. Townsend and R. J. Aal­berts. (2001). Infor­ma­tion Sys­tems Secu­rity and the Need for Pol­icy. In Dhillon, G. (Ed.), Infor­ma­tion Secu­rity Man­age­ment: Global Chal­lenges in the New Mil­len­nium. Idea Group Pub­lish­ing.

  Wood, C. C. (1995). Writ­ing InfoSec Poli­cies. Com­put­ers & Secu­rity 14(8), 667–674.