from information security management to strongenterprisestrong risk.pdfVIP

From Information Security Management to Enterprise Risk Management Margareth Stoll Abstract Organizations are faced with increasing complexity, uncertainty and enhanced threats from a wide range of forces. Depending on how this situation is handled, it can become risk or opportunity to erode or enhance business value. In addition, organizations have to meet most different stakeholders ’, legal and regulatory risk management requirements. Thus, comprehensive enterprise risk management has become key challenge and core compe- tence for organizations ’ sustainable success. Given the central role of information security management and the common goals with enterprise risk management, organizations need guidance how to extend information security management in order to fulfill enterprise risk management requirements. Yet, interdisciplinary security research at the organizational level is still missing. Accordingly, we propose a systemic framework, which guides organizations to promote enterprise risk management starting from information security management. The results of our case studies in different small and medium-sized organizations suggest that the framework was useful to promote enterprise risk manage- ment in an effective, efficient, cost-effe