Do information security policies reduce the incidence of security breaches: An exploratory analysis.

Information is a critical corporate asset, which has become increasingly vulnerable to attacks from viruses, hackers, criminals and human error. Consequently, organizations are having to prioritise the security of their computer systems, to ensure that their information assets retain their accuracy, confidentiality and availability. Whilst the importance of the information security policy (InSPy) in ensuring the security of information is widely acknowledged, there has, to date, been little empirical analysis of its impact or effectiveness in this role. To help fill this gap an exploratory study was initiated that sought to investigate the relationship between the uptake and application of information security policies and the accompanying levels of security breaches. To this end a questionnaire was designed, validated and then targeted at IT managers within large organizations in the United Kingdom. The findings, presented in this paper, are somewhat surprising, as they show no statistically significant relationships between the adoption of information security policies and the incidence or severity of security breaches. The paper concludes by exploring the possible interpretations of this unexpected finding, and its implications for the practice of information security management.