Balanced Scorecard Implementation of Security Strategies: A Framework for IT Security Performance Management

REFERENCES

• Banker , R. D. , Chang , H. and Pizzini , M. J. 2004 . The balanced scorecard: judgmental effects of performance measures linked to strategy . The Accounting Review , 79 ( 1 ) : 1 – 23 .
   Web of Science ®Google Scholar
• Bremser , W. G. and Chung , Q. 2005 . A framework for performance measurement in the e-business environment . Electronic Commerce Research and Application , 4 : 395 – 412 .
   Web of Science ®Google Scholar
• Brown , M. G. and Svenson , R. A. 1998 . Measuring R&D productivity . Research-Technology Management , 31 ( 4 ) : 11 – 15 .
   Google Scholar
• Brynjolfsson , E. and Hitt , L. 1996 . Paradox lost? Firm-level evidence on the returns to information systems . Management Science , 42 ( 2 ) : 541 – 558 .
   Google Scholar
• Camp , L. J. and Wolfram , C. 2004 . “ Pricing Security ” . In The Economics of Information Security , Edited by: Camp , J. and Lewis , R. 17 – 34 . Kluwer, MA, , USA : Academic Publishers .
   Google Scholar
• Cazemier , J. A. , Overbeek , P. L. and Peters , L. M. 2000 . Security Management (IT Infrastructure Library Series) , UK : Stationery Office .
   Google Scholar
• Chew , E. , Swanson , M. , Stine , K. , Bartol , N. , Brown , A. and Robinson , W. 2008 . Performance Measurement Guide for Information Security (NIST Special Publication (SP) 800-55, Revision 1) , United States Department of Commerce and National Institute of Standards and Technology (NIST)o. Document Number .
   Google Scholar
• Choobineh , J. , Dhillon , G. , Grimaila , M. R. and Rees , J. 2007 . Management of Information Security: Challenges and Research Directions . Communication of Association of Information Systems , 20 ( 57 ) : 1 – 17 .
   Google Scholar
• Davenport , T. and Harris , J. 2007 . Competing on Analytics: The New Science of Winning , Boston, MA : Harvard Business School Press .
   Google Scholar
• Davila , T. , Epstein , M. and Shelton , R. 2006 . Making Innovation Work , Upper Saddle River, N.J : Warton School Publishing .
   Google Scholar
• Financial Reporting Council . 2005 . Internal Control: Revised Guidance for Directors on the Combined Code o. Document Number
   Google Scholar
• Gordon , L. A. and Loeb , M. P. 2002 . The Economics of Information Security Investment . ACM Transactions on Information and Systems Security , 5 ( 4 ) : 438 – 457 .
   Google Scholar
• Herath , H. , Bremser , W. and Birnberg , J. 2009 . “ Joint Selection of Balanced Scorecard Targets and Weights in a Collaborative Setting ” . In Journal of Accounting and Public Policy
   Google Scholar
• Herath , H. and Herath , T. 2009 . Investments in Information Security: A Real Options Perspective with Bayesian Post-Audit . Journal of Management Information Systems , 25 ( 3 ) : 337 – 375 .
   Web of Science ®Google Scholar
• Herath , T. and Rao , H. R. 2009a . Encouraging information security behaviors in organizations: Role of penalties, pressures, and perceived effectiveness . Decision Support Systems , 47 ( 2 ) : 154 – 165 .
   Web of Science ®Google Scholar
• Herath , T. and Rao , H. R. 2009b . Protection Motivation and Deterrence: A Framework for Security Policy Compliance in Organisations . European Journal of Information Systems , 18 ( 2 ) : 106 – 125 .
   Web of Science ®Google Scholar
• Hoo , K. J. S. 2000 . “ How much is Enough? A Risk Management Approach to Computer Security ” . Palo Alto, CA Stanford University .
   Google Scholar
• Huang , S. -M. , Lee , C. -L. and Kao , A. -C. 2006 . Balancing performance measures for information security management: A balanced scorecard framework . Industrial Management + Data Systems , 106 ( 1/2 ) : 242 – 255 .
   Web of Science ®Google Scholar
• ISG. (2006). Information Security Governance: Guidance for Boards of Directors and Executive Management, 2nd ed. IT Governance Institute publication) http://www.isaca.org/ContentManagement/ContentDisplay.cfm?ContentID=34997 (Accessed: 14 December 2009 ).
   Google Scholar
• Ittner , C. and Larcker , D. 1998 . Are non-financial measures leading indicators of financial performance? An analysis of customer satisfaction . Journal of Accounting Research , 36 : 1 – 35 .
   Web of Science ®Google Scholar
• Ives , B. 1994 . “ Probing Productivity Paradox ” . In MIS Quarterly Vol. 18 , R21 – R24 .
   Google Scholar
• Kaplan , R. S. and Norton , D. P. 1992 . The balanced scorecard-measures that drive performance . Harvard Business Review , 70 : 71 – 79 .
   PubMed Web of Science ®Google Scholar
• Kaplan , R. S. and Norton , D. P. 1993 . Putting the balanced scorecard to work . Harvard Business Review , : 134 – 147 .
   Web of Science ®Google Scholar
• Kaplan , R. S. and Norton , D. P. 1996a . The Balanced Scorecard , Boston, MA : Harvard Business School Press .
   Google Scholar
• Kaplan , R. S. and Norton , D. P. 1996b . Using the balanced scorecard as a strategic management system . Harvard Business Review , : 75 – 85 .
   Web of Science ®Google Scholar
• Kaplan , R. S. and Norton , D. P. 2001a . The Strategy Focused Organization , Boston, MA : Harvard Business School Press .
   Google Scholar
• Kaplan , R. S. and Norton , D. P. 2001b . Transforming the balanced scorecard from performance measurement to strategic management: part I . Accounting Horizons , : 87 – 104 .
   Google Scholar
• Kaplan , R. S. and Norton , D. P. 2004 . The strategy map: guide to aligning intangible asset . Strategy & Leadership , 32 ( 5 ) : 10 – 17 .
   Google Scholar
• Kerssens-van Drongelen , I. , Nixon , B. and Pearson , A. 2000 . Performance Measurement in Industrial R&D . International Journal of Management Reviews , 2 ( 2 ) : 111 – 143 .
   Google Scholar
• Libby , T. , Salterio , S. E. and Webb , A. 2004 . The Balanced Scorecard: The Effects of Assurance and Process Accountability on Managerial Judgment . The Accounting Review , 79 : 1075 – 1095 .
   Web of Science ®Google Scholar
• Lipe , M. and Salterio , S. 2000 . The balanced scorecard: Judgmental effects of common and unique performance measures . The Accounting Review , 75 : 283 – 298 .
   Web of Science ®Google Scholar
• Longstaff , T. A. , Chittister , C. , Pethia , R. and Haimes , Y. Y. 2000 . Are we forgetting the Risks of Information Technology? . IEEE Computer , 33 ( 12 ) : 43 – 51 .
   Google Scholar
• Lonnqvist and Pirttimaki , V. 2006 . The Measurement of Business Intelligence . Information Systems Management , 23 ( 1 ) : 32 – 40 .
   Web of Science ®Google Scholar
• Marr , B. and Schiuma , G. 2003 . Business performance measurement – past, present and future . Management Decision , 41 : 680 – 687 .
   Google Scholar
• Martinsons , M. , Davison , R. and Tse , D. 1999 . The balanced scorecard: a foundation for the strategic management of information systems . Decision Support Systems , 25 : 71 – 88 .
   Web of Science ®Google Scholar
• Neely , A. , Mills , J. , Platts , K. , Richards , H. , Gregory , M. Bourne , M. 2000 . Performance measurement system design: developing and testing a process-based approach . International Journal of Operations & Production Management , 20 : 1119 – 1145 .
   Web of Science ®Google Scholar
• Olve , N. G. , Roy , J. and Wetter , M. 1999 . PerformanceDrivers: A Practical Guide to Using the BalancedScorecard , New York : John Wiley & Sons .
   Google Scholar
• Shelmire, A., Rome, J., & Marsteller, J. (2007). The Case for Risk Based Information Assurance. Paper presented at the Teragrid 2007 Conference, Madison, WI. http://www.pmw.org/aaron/stuff/Risk_Based_Information_Assurance (Accessed: 1 November 2009 ).
   Google Scholar