Exploring Information Security Governance in Cloud Computing Organisation

2. Conceptual Framework

ISG is defined as the organization’s management responsibilities and practices that provide strategic vision, ensure objectives are achieved, manage risks appropriately, use organizational resources responsibly, and monitor the success or failure of the information security programs (Abu-Musa, 2010). Governance in information security is related to establishment and maintenance of the control environment that manages risks related to confidentiality, integrity and availability of information and its supporting processes and systems (Moulton and Cole, 2003).

This study introduces an integrated ISG framework (Figure 1) that would enable organizations to better understand, analyze, implement, and evaluate ISG practices to achieve business success. The proposed ISG framework has been developed based on the ISG conceptual framework proposed by D a Vega and E loff, 2007 and other ISG models and frameworks available in the literature (von Solms and von Solms, 2006; Ula et al., 2011; Abu-Musa, 2010; von Solms, 2005; Miller et al., 2009; von Solms and von Solms, 2005; Gerber & von Solms, 2001Tudor, 2001).