Information security management in ICT and non-ICT sector companies: A preventive innovation perspective

Despite the growing dependence of companies on information technology and increasingly negative impact security incidents worldwide, there is little research management at company level. This paper seeks to expand knowledge implementation an system based widely used international standard ISO/IEC 27001. We present motives, experienced impacts, obstacles related 27001 using data from a survey 125 certified in Germany. Since adoption rates vary between ICT non-ICT sector companies, we highlight sector-related variations. classify this as preventive organizational innovation apply Structural Equation Modeling unearth explanations for comparatively low among outside sector. We, therefore, derive recommendations policymakers, standardization, certification bodies foster its diffusion.