The Role of Conflict Resolution in Designing and Implementing Information Security Policies: An Institutional Perspective

This paper examines the suitability of institutional theory in explaining the design and implementation of information security policies in organizations. We conduct a case study in a large governmental organization in the United States. We capture multiple perspectives among the different groups in the organization and examine how this affects the design and implementation of security policies. We find a high interdependence between the information security group and other groups in the organization resulting in task and process conflicts. These conflicts had both positive and negative outcomes. A combination of dominating and compromising conflict management styles are shown to produce positive results in resolving the conflicts. Our study highlights the importance for managers to balance security and usability and to ensure that the stringency of security policies do not override the business objectives of the organization.