| Newly emergent in scholarly and practitioner literature is the paradigmatic shift in perspective of information security that supports a shift away from a technical role toward a strategic, value-creating role (Ezingeard, McFadzean, & Birchall, 2005; Sherizen, 2003; Van Opstal, 2006) yet there is a lack of scholarly research regarding perceptions of that viewpoint from top business executives. This research helps to fulfill the empirical gap by surveying executives (as single informants) of large U.S. companies through a self-reported, structured instrument developed for the study. The mixed methodology comprised a qualitative descriptive part that was applied to explore the ways, if any, that information security creates value; the types of metrics used, if any, to demonstrate its value; the extent of InfoSec-business alignment and areas that could hinder alignment. Business value benefits were assessed uniquely through measures of perceived knowledge and actual knowledge (having evidence thereof). The quantitative part of the methodology was used to examine the relationship between perceived and actual business value benefits and firms of different industry sectors. Results of the study revealed key items of business value, and found overall perceived measures of benefits to be most dominant over actual measures of benefits. Conclusions indicated that there was no statistically significant evidence to show that perceptions of business value (both perceived and actual) varied among different industry sectors. Contingency table analyses were used to examine relationships and chi-square tests of independence were used to determine significance. |
