<abstract xmlns="http://www.w3.org/1999/xhtml">

<bold>Purpose:</bold> Outsourcing information security has proven to be an efficient solution for information security management; however, it may not be the most suitable approach for every organization. This research aimed to develop a multi-criteria decision-making model that would enable organizations to determine which approach to information security management (outsourcing or internal management) is more suitable for their needs and capabilities.
<bold>Methods:</bold> Our study utilized several different research methods. First, the decision criteria were identified by reviewing related work and then selected by information security experts in a focus group. Second, a survey was conducted among information security practitioners to assign the criteria weights. Third, four use cases were conducted with four real-world organizations to assess the usability, ease of use, and usefulness of the developed model.
<bold>Results:</bold> We developed a ten-criteria model based on the analytic hierarchy process. The survey results promote performance-related criteria as more important than efficiency-focused criteria. Evidence from use cases proves that the decision model is useful and appropriate for various organizations.
<bold>Conclusion:</bold> To make informed decisions on approaching information security management, organizations must first conduct a thorough analysis of their capabilities and needs and investigate potential external contractors. In such a case, the proposed model can serve as a useful support tool in the decision-making process to obtain clear recommendations tailored to factual circumstances.
</abstract>

Purpose: Outsourcing information security has proven to be an efficient solution for information security management; however, it may not be the most suitable approach for every organization. This research aimed to develop a multi-criteria decision-making model that would enable organizations to determine which approach to information security management (outsourcing or internal management) is more suitable for their needs and capabilities.
Methods: Our study utilized several different research methods. First, the decision criteria were identified by reviewing related work and then selected by information security experts in a focus group. Second, a survey was conducted among information security practitioners to assign the criteria weights. Third, four use cases were conducted with four real-world organizations to assess the usability, ease of use, and usefulness of the developed model.
Results: We developed a ten-criteria model based on the analytic hierarchy process. The survey results promote performance-related criteria as more important than efficiency-focused criteria. Evidence from use cases proves that the decision model is useful and appropriate for various organizations.
Conclusion: To make informed decisions on approaching information security management, organizations must first conduct a thorough analysis of their capabilities and needs and investigate potential external contractors. In such a case, the proposed model can serve as a useful support tool in the decision-making process to obtain clear recommendations tailored to factual circumstances.

Outsource or not? An AHP Based Decision Model for Information Security Management

Organizacija

This work is licensed under the Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License.

Purpose: Outsourcing information security has proven to be an efficient solution for information security management; however, it may not be the most suitable...

Outsource or not? An AHP Based Decision Model for Information Security Management

Published Online: Jun 23, 2022

Page range: 142 - 159

Received: Nov 03, 2021

Accepted: Apr 28, 2022

DOI: https://doi.org/10.2478/orga-2022-0010

Keywords
Information security, Decision model, Analytic hierarchy process, AHP, Management, Outsourcing

© 2022 Luka Jelovčan et al., published by Sciendo

This work is licensed under the Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License.

Outsource or not? An AHP Based Decision Model for Information Security Management

Published Online: Jun 23, 2022

Page range: 142 - 159

Received: Nov 03, 2021

Accepted: Apr 28, 2022

DOI: https://doi.org/10.2478/orga-2022-0010

KeywordsInformation security, Decision model, Analytic hierarchy process, AHP, Management, Outsourcing

© 2022 Luka Jelovčan et al., published by Sciendo

This work is licensed under the Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License.

Keywords
Information security, Decision model, Analytic hierarchy process, AHP, Management, Outsourcing