CoChat
Sign Up
Cited by 47Information and Cyber SecurityInformation Technology Governance and StrategySecurity, Politics, and Digital Transformation

The DOI matches its Crossref record; 3 of the 3 references it cites were found in a registry or an index.

Information security governance in the public sector: investigations, approaches, measures, and trends

Open access
Magnusson, Lars, Iqbal, Sarfraz, Elm, Patrik, Dalipi, Fisnik·2025·International Journal of Information Security
DOI 10.1007/s10207-025-01097-x
Open this paper in CoChat — free accountOpen PDF

Abstract

Information security governance in the public sector involves risk management, accountability frameworks, network security, e-government systems infrastructure, mitigation plans, and alignment with corporate strategy. It equips organizations with the ability to deal with the security of their vital information assets systematically. However, several recent hacking incidents reveal the fact that substandard governance processes are among the common causes of weak security measures in most organizations. This study has been conducted following the established protocol outlined in the Preferred Reporting Items for Systematic Reviews and Meta-Analyses (PRISMA) guidelines. Systematic Mapping Review (SMR) initially identified 1496 papers, and this reviews and reports on 41 papers. The reviewed literature emphasizes the adherence to recognized governance standard frameworks such as ISO/IEC 27,001, EU General Data Protection Regulations (GDPR), and EU Network and Information Security Act (NIS) for providing effective information security guidance frameworks in the public sector. However, a general scarcity is found regarding the best practices followed in the area of information security compliance. There is a lack of employing key performance indicators, risk assessment measures, security maturity models in organizations, and compliance audits. Additionally, the study suggests that, to some extent, the adoption of appropriate information security governance procedures is linked with available budgeted resources for individual organizations. The study results can serve as a starting point for the research and practitioners’ community in the area of information security governance.

Overview

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.1007/s10207-025-01097-x

Cites

3 of 3 references verified0 citation errors · 0 not checkable

Statistics

Verification

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Citations

Cites

Flagged first, then by citations

Show all 3 references

Research works printed but not linked: 70

  1. Bhuyan, S.S., et al.: Transforming healthcare cybersecurity from reactive to proactive: Current status and future recommendations. J. Med. Syst. 44, 1–9 (2020) · DOI
  2. Lin, Z., Lu, W., Xu, S.: Unified preventive and reactive cyber defense dynamics is still globally convergent. IEEE/ACM Trans. Networking. 27(3), 1098–1111 (2019) · DOI
  3. Martínez, J., Durán, J.M.: Software supply chain attacks, a threat to global cybersecurity: SolarWinds’ case study. Int. J. Saf. Secur. Eng. 11(5), 537–545 (2021) · DOI
  4. Von Solms, R., Van Niekerk, J.: From information security to cyber security. Computers Secur. 38, 97–102 (2013) · DOI · Paper page
  5. Posthumus, S., Von Solms, R.: A framework for the governance of information security. Computers Secur. 23(8), 638–646 (2004) · DOI
  6. Sajko, M., Hadjina, N., Sedinić, I.: Information security governance and how to accomplish it. in 2011 Proceedings of the 34th International Convention MIPRO. IEEE. (2011)
  7. Moulton, R., Coles, R.S.: Applying information security governance. Computers Secur. 22(7), 580–584 (2003) · DOI
  8. Magnusson, L., Dalipi, F., Elm, P.: Cybersecurity Compliance in the Public Sector: Are the Best Security Practices Properly Addressed? in International Conference on Human-Computer Interaction. Springer. (2023) · DOI
  9. Cole, M.D., Schmitz, S.: The interplay between the NIS directive and the GDPR in a cybersecurity threat landscape. University of Luxembourg law working paper, 2019(2019-017) · DOI
  10. EU: General Data Protection Regulation (GDPR) - Regulation (EU) 2016/679 on the Protection of Natural Persons with Regard To the Processing of Personal Data and the Free Movement of Such Data. EU, Editor (2016)
  11. Magnusson, L., Iqbal, S.: Post-Mortem of Mega Hacks-Signifying the Need for a Systemic Enterprise View on Information Security. in 7th International Conference on Cryptography, Security and Privacy (CSP). 2023. IEEE. (2023) · DOI
  12. Rebollo, O., et al.: Comparative analysis of information security governance frameworks: a public sector approach. in The Proceedings of the11th European Conference on eGovernment–ECEG. (2011)
  13. Pasquinucci, A.: Security, risk analysis and governance: A practical approach. Comput. Fraud Secur. 2007(7), 12–14 (2007) · DOI
  14. Williams, P.: Information security governance. Inform. Secur. Tech. Rep. 6(3), 60–70 (2001) · DOI
  15. Sugiharti, I., et al.: E-Government Roadmap for Smart Governance: A Study from Banyuwangi Smart Village. in. International Conference on Computer Science, Information Technology, and Electrical Engineering (ICOMITEE). 2021. IEEE. (2021) · DOI
  16. Warkentin, M., Orgeron, C.: Using the security triad to assess blockchain technology in public sector applications. Int. J. Inf. Manag. 52, 102090 (2020)
  17. AlGhamdi, S., Win, K.T., Vlahu-Gjorgievska, E.: Information security governance challenges and critical success factors: Systematic review. Computers Secur. 99, 102030 (2020) · DOI
  18. Culot, G., et al.: The ISO/IEC 27001 information security management standard: Literature review and theory-based research agenda. TQM J. 33(7), 76–105 (2021) · DOI
  19. Parums, D.V.: Review articles, systematic reviews, meta-analysis, and the updated preferred reporting items for systematic reviews and meta-analyses (PRISMA) 2020 guidelines. Med. Sci. Monitor: Int. Med. J. Experimental Clin. Res. 27, e934475–e934471 (2021) · DOI
  20. Al-Izki, F., Weir, G.R.: Management attitudes toward information security in Omani public sector organisations. in Cybersecurity and Cyberforensics Conference (CCC). 2016. IEEE. (2016) · DOI
  21. Gautama, H.: Information security readiness of government institution in Indonesia. in 2nd International Conference on Information and Communication Technology (ICoICT). 2014. IEEE. (2014)
  22. Srinivas, T., Vivek, G.: Cyber security: The state of the practice in public sector companies in India. in International Conference on Computing and Communication Technologies. IEEE. (2014) · DOI
  23. Erastus, L., Jere, N., Shava, F.B.: A security model for Namibian Government Services. in 2017 IST-Africa Week Conference (IST-Africa). IEEE. (2017) · DOI
  24. Coppolino, L., et al.: How to protect public administration from cybersecurity threats: The COMPACT project. in. 32nd International conference on advanced information networking and applications workshops (WAINA). 2018. IEEE. (2018) · DOI · Paper page
  25. Craig, R., Tryfonas, T., May, J.: A viable systems approach towards cyber situational awareness. in IEEE International Conference on Systems, Man, and Cybernetics (SMC). 2014. IEEE. (2014) · DOI
  26. Sabillon, R., Higuera, J.R.B.: New Validation of a Cybersecurity Model to Audit the Cybersecurity Program in a Canadian Higher Education Institution. in 2023 Conference on Information Communications Technology and Society (ICTAS). IEEE. (2023) · DOI
  27. Webb, J., et al.: A situation awareness model for information security risk management. Computers Secur. 44, 1–15 (2014) · DOI
  28. Topping, C., et al.: Beware suppliers bearing gifts! Analysing coverage of supply chain cyber security in critical National infrastructure sectorial and cross-sectorial frameworks. Computers Secur. 108, 102324 (2021) · DOI
  29. Karlsson, F., Hedström, K., Goldkuhl, G.: Practice-based Discourse Anal. Inform. Secur. Policies Computers Secur. 67, 267–279 (2017)
  30. Szczepaniuk, E.K., et al.: Information security assessment in public administration. Computers Secur. 90, 101709 (2020) · DOI
  31. Karvounidis, T., et al.: A Methodology for Adopting Security Management Principles in Health Sector Environments. in Proceedings of the 25th Pan-Hellenic Conference on Informatics. (2021) · DOI
  32. Abraham, C., Chatterjee, D., Sims, R.R.: Muddling through cybersecurity: Insights from the US healthcare industry. Bus. Horiz. 62(4), 539–548 (2019) · DOI
  33. Markopoulou, D., Papakonstantinou, V., De Hert, P.: The new EU cybersecurity framework: The NIS directive, enisa’s role and the general data protection regulation. Comput. Law Secur. Rev. 35(6), 105336 (2019) · DOI
  34. Thomas, L., et al.: A framework for data privacy and security accountability in data breach communications. Computers Secur. 116, 102657 (2022) · DOI
  35. Al-Karaki, J.N., Gawanmeh, A., El-Yassami, S.: GoSafe: On the practical characterization of the overall security posture of an organization information system using smart auditing and ranking. J. King Saud University-Computer Inform. Sci. 34(6), 3079–3095 (2022) · DOI
  36. Borgman, B., Mubarak, S., Choo, K.-K.R.: Cyber Security Readiness in the South Australian Government, vol. 37, pp. 1–8. Computer Standards & Interfaces (2015) · DOI
  37. Navajas-Adán, J., et al.: Perceptions and dilemmas around cyber-security in a Spanish research center after a cyber-attack. Int. J. Inf. Secur. 23(3), 2315–2331 (2024) · DOI
  38. Mustafa, G., et al.: Blockchain-based governance models in e-government: A comprehensive framework for legal, technicthical and security considerations. Int. J. Law Manage., (2024) · DOI
  39. Williams, K., Axelsen, M., Brea, E.: Navigating data governance challenges in healthcare. J. Inform. Technol. Teach. Cases,: p. 20438869241240493. (2024) · DOI
  40. Andreasson, A., et al.: A census of Swedish public sector employee communication on cybersecurity during the COVID-19 pandemic. in. International Conference on Cyber Situational Awareness, Data Analytics and Assessment (CyberSA). 2021. IEEE. (2021) · DOI
  41. Cheng, E.C., Wang, T.: Institutional strategies for cybersecurity in higher education institutions. Information. 13(4), 192 (2022) · DOI
  42. Lee, I.: Analysis of insider threats in the healthcare industry: A text mining approach. Information. 13(9), 404 (2022) · DOI
  43. Min, K., Chai, S.-W.: An analytic study of cyber security strategies of Japan. Int. J. Secur. Its Appl. 10(10), 37–46 (2016)
  44. Dang-Pham, D., Pittayachawan, S.: Comparing Intention To Avoid Malware across Contexts in a BYOD-enabled Australian University: A Protection Motivation Theory Approach, vol. 48, pp. 281–297. Computers & Security (2015) · DOI
  45. Caldarulo, M., Welch, E.W., Feeney, M.K.: Determinants of cyber-incidents among small and medium US cities. Government Inform. Q. 39(3), 101703 (2022) · DOI
  46. Uchendu, B., et al.: Developing a cyber security culture: Current practices and future needs. Computers Secur. 109, 102387 (2021) · DOI
  47. Porcedda, M.G.: Patching the patchwork: Appraising the EU regulatory framework on cyber security breaches. Comput. Law Secur. Rev. 34(5), 1077–1098 (2018) · DOI
  48. Clarke, R.: The prospects of easier security for small organisations and consumers. Comput. Law Secur. Rev. 31(4), 538–552 (2015) · DOI
  49. Jung, B., Li, Y., Bechor, T.: CAVP: A context-aware vulnerability prioritization model. Computers Secur. 116, 102639 (2022) · DOI
  50. Kemp, R.: Legal aspects of cloud security. Comput. Law Secur. Rev. 34(4), 928–932 (2018) · DOI
  51. Ali, O., et al.: Assessing information security risks in the cloud: A case study of Australian local government authorities. Government Inform. Q. 37(1), 101419 (2020) · DOI
  52. Mutemwa, M., Masango, M.G., Gcaza, N.: Managing the Shift in the Enterprise Perimeter in order to delay a Cybersecurity Breach. in Proceedings of the International Conference on Artificial Intelligence and its Applications. (2021) · DOI
  53. Naarttijärvi, M.: Balancing data protection and privacy–The case of information security sensor systems. Comput. Law Secur. Rev. 34(5), 1019–1038 (2018) · DOI
  54. Min, K.-S., Chai, S.-W., Han, M.: An international comparative study on cyber security strategy. Int. J. Secur. Its Appl. 9(2), 13–20 (2015)
  55. Khader, M., Karam, M., Fares, H.: Cybersecurity awareness framework for academia. Information. 12(10), 417 (2021) · DOI
  56. Khando, K., et al.: Enhancing employees information security awareness in private and public organisations: A systematic literature review. Computers Secur. 106, 102267 (2021) · DOI
  57. Lomotey, R.K., Kumi, S., Deters, R.: Data trusts as a service: Providing a platform for multi-party data sharing. Int. J. Inform. Manage. Data Insights. 2(1), 100075 (2022)
  58. Tenzin, S., McGill, T., Dixon, M.: An investigation of the factors that influence information security culture in government organizations in Bhutan. J. Global Inform. Technol. Manage. 27(1), 37–62 (2024) · DOI
  59. He, Z.: When data protection norms Meet digital health technology: China’s regulatory approaches to health data protection. Comput. Law Secur. Rev. 47, 105758 (2022) · DOI
  60. Morris, H., Gallacher, L.: ITIL Intermediate Certification Companion Study Guide: Intermediate ITIL Service Capability Exams. Wiley (2017)
  61. Posthumus, S., Von, R., Solms, King, M.: The board and IT governance: The what, who and how. South. Afr. J. Bus. Manage. 41(3), 23–32 (2010) · DOI
  62. Von Solms, B., Von, R., Solms: The 10 deadly sins of information security management. Computers Secur. 23(5), 371–376 (2004) · DOI
  63. Schinagl, S., Shahim, A.: What do we know about information security governance? From the basement to the boardroom: Towards digital security governance. Inform. Comput. Secur. 28(2), 261–292 (2020) · DOI
  64. Connolly, L.Y., Lang, M., Tygar, D.J.: Employee Security Behaviour: the Importance of Education and Policies In Organisational settings. In Advances In Information Systems Development: Methods, Tools and Management. Springer (2018) · DOI
  65. Disterer, G.: ISO/IEC 27000, 27001 and 27002 for information security management. J. Inform. Secur., 4(2). (2013) · DOI
  66. Shu, X., et al.: Breaking the target: An analysis of target data breach and lessons learned. arXiv preprint arXiv:1701.04940, (2017) · arXiv
  67. Cyert, R., March, J.: Behavioral Theory of the firm, in Organizational Behavior 2, pp. 60–77. Routledge (2015)
  68. Landoll, D.J.: Information Security Policies, Procedures, and Standards: A Practitioner’s Reference. Auerbach (2017) · DOI
  69. Goddard, M.: The EU general data protection regulation (GDPR): European regulation that has a global impact. Int. J. Market Res. 59(6), 703–705 (2017) · DOI
  70. Malatji, M.: Management of enterprise cyber security: A review of ISO/IEC 27001: 2022. in 2023 International conference on cyber management and engineering (CyMaEn). IEEE. (2023) · DOI

Metadata

Authors
Magnusson, L., Iqbal, S., Elm, P., & Dalipi, F.
Affiliations
Linnaeus University (SE)
Corresponding author
Magnusson, Lars
ORCID
Venue
International Journal of Information Security
Publisher
Springer Science and Business Media LLC
Published
2025-07-16
Volume
24
Issue
4
ISSN
  • 1615-5262 (ISSN-L)
  • 1615-5270
DOI
10.1007/s10207-025-01097-x
OpenAlex
W4412477505
Cited by
47
References
3
Citations by year
2026: 40 · 2025: 6
FWCI
27.71
Type
journal article
Language
en
Open access
Licence
Locations
  • International Journal of Information Security (publishedVersion, cc-by)
  • KTH Publication Database DiVA (KTH Royal Institute of Technology) (submittedVersion, other-oa)
Funders
Linnaeus University
Topics
  • Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
  • Social Sciences › Business, Management and Accounting › Management Information Systems › Information Technology Governance and Strategy
  • Social Sciences › Political Science and International Relations › Security, Politics, and Digital Transformation
Keywords
information security governance, public sector, risk management, accountability framework, network security, e-government systems, security compliance, ISO/IEC 27001, GDPR, NIS Directive, security maturity model, risk assessment, compliance audit, key performance indicators, security budget

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review