6. Conclusion and Future Research
This study, primarily conducted to empirically validate the ISG process model derived from the extant literature confirms the relevance of integrating IT governance controls into IS security resulting in a phased methodology to implement ISG. First, the paper confirms the role of the Plan-Do-Check-Act Deming cycle in ISG where concepts of IS security and IT governance were conspicuous throughout the ISG process model. Second, the study provides guidelines/best practices to consider in each phase of the PDCA cycle. Third, the relevance of an automated feedback mechanism using appropriate metrics throughput the cycle was methodologically demonstrated. Fourth, the research affirms the relevance of inculcating an IT security as well as IT governance culture in any organization prior and during the process of ISG. Finally, the guidelines provided in the study aid in continuously updating the model to align with the highly dynamic nature of information security threats.
The validated model helps academics, and practitioners gain insight into the methodology of the phased implementation of an information systems governance process through the PDCA model, as well as the positioning of ITG and ITG frameworks in ISG. Practitioners can glean valuable insights from the empirical section of the research where experts detail the critical success factors, the subsequent steps, and justifications of each factor on the ISG implementation process. This can assist practitioners in incrementing and building an ISG knowledge base to apply the steps outlined in each of the four phases of PDCA.
