Information Systems Security : Developing a Stage Theory

This is the beginning of a research stream focused on examining information systems research from a stage theory perspective. This paper outline the approach proposed by first giving a detailed look at stage theory in general and then stage theory as it has been applied to information systems specifically. The paper then moves on to discuss a proposed methodology to investigate this phenomenon. The paper then concludes with stating the goals that developing such a model will hopefully fulfill. Introduction The concept that an organization’s Information Systems (IS) Department evolves through stages dates back as to 1969 (Churchill, Kempster and Uretsky 1969). The idea that an organization’s IS department has certain characteristics representative of a particular stage suggests that by recognizing key characteristics and how those characteristics are different at different stages, that an organization can “mature” and advance to a stage further down the evolutionary trail. The popularity of using stage theories to explain this evolutionary process is likely due to their intuitive nature (Young 2009, Lucas and Sutton 1977). Perhaps the best known stage theory as it relates to IS is that put forth by Richard Nolan in which four initial stages were identified: Initiation, Contagion, Control, and Integration (Nolan 1973). While Nolan’s stage theory has gone through modifications (Nolan 1973, Gibson and Nolan 1974) and challenges (Benbasat, et al. 1984, King and Kraemer 1984, Lucas and Sutton 1977), the intuitive appeal of understanding how an organization evolves through stages along with characteristics and identifiable steps necessary to advance into more mature stages has served as a driving force with respect to continuing to use stage theories to advance phenomena. This paper seeks to follow in the footsteps of prior work done regarding stage theory and apply it to the more specific area of IS Security in organizations. Much like the argument of IS in general evolving through stages, it is likely that an organization’s security evolves as well as an organization becomes more dependent on their information system and as an organization’s investment continues to rise with respect to their information system. Though relatively little work has been conducted in this specific area or research, one notable exception must be discussed. Young (2009) theorized that an organization’s security posture could be associated with one of four prescriptively developed stages. While Young’s study did bring a focus on Information Systems Security (ISS) from a stage theory perspective, the prescriptive nature and the lack of variance between respondents with respect to which stages they most identified with made the Young model limited in value. Much of Young’s work built upon the work by King and Teo (1997) in which they prescriptively developed a stage model to describe business and information systems planning. Though appropriate for their model where many of the constructs as they relate to managerial planning are well developed and understood, this approach, it is argued, is not appropriate for examining the various stages in which an organization moves through with respect to their security. It is argued that a more appropriate approach would be to first develop a stage theory based on descriptive techniques in order to observe the actual stages (assuming they exist), the characteristics of each stage, and the necessary elements necessary to move from one stage to the next. That is the goal of this stream of research; to first develop an understanding of the number and characteristics of stages that exist as it relates to information systems security and then to empirically test the model. This paper’s specific goal is to outline an approach to accomplish those stated goals. Literature Review Stage Theory Stage theories have been used for years to describe various phenomena. For example, Piaget used stages to describe the development that a child evolves through (Piaget 1950). Marx and Engels (1848) suggested that economic systems evolved through stages from feudalism to communism. By understanding how a phenomena evolves, we can not only anticipate how a phenomena at a lower stage will evolve, but we can potentially affect that evolution in order to make the transitions through stages occur more smoothly and/or potentially more quickly. As it relates to information systems (IS), considerable research has been conducted describing how an IS department evolves in an organization (Churchill, Kempster and Uretsky 1969, Greiner 1972, Nolan 1973). Perhaps the most notable research conducted using stage theories as it relates to IS has been that conducted by Richard L. Nolan and company (Nolan 1973, Nolan 1979, Nolan 1977, Gibson and Nolan 1974) in which an organization was described as evolving through stages with respect to planning, organizing, and controlling. It was posited that, based on an organization’s computer budget, that it would exhibit certain characteristics regarding each of these criteria. In his initial identification of stages, Nolan (1973) identified four stages which he termed Initiation, Contagion, Control, and Integration in order from least sophisticated to most sophisticated respectively. In the initial stage, the computer system is first introduced into the organization. Few people know how to utilize their new resource and as a result, it often is underutilized. At this stage, little planning, organizing, and controlling activities take place. Stage two, Contagion, marks the realization that the system can automate and perform many functions and as a result, intense system development occurs. Little planning occurs at this stage. Applications are simply developed hap-hazard in response to user requests with little regard for integration into other applications/systems. Limited attempts to control and organize occur at this stage. By stage three, the rapid application development that occurred during stage two has manifested itself as a route cause for a now expensive IS department. These high costs must be brought under control. As a result, controls are put in place in order to regulate application development and avoid the high costs experienced in stage two. Planning starts to become more important in order to more effectively allocate resources to projects deemed necessary by some newly created part of the organization such as a steering committee. By stage four, Integration, it is realized that overly restrictive controls placed on systems development in stage three do not allow applications to be developed that truly address the needs of users. The realization that a balance needs to be struck between the need for systems development and control functions is recognized. As a result, control functions are relaxed and refined in order to foster appropriate development within the confines of cost restrictions. Refined planning occurs at this stage as does organization of resources. Nolan argued that at each of these stages, the planning, organizing, and controlling functions of an organization are distinct and that by understanding how an organization evolves, from one stage to another, other organizations could transition from one stage to the next with less disruption. Additionally, by identifying the characteristics that an organization has at a more advanced stage could serve as a model for other organizations wishing to move themselves along the evolutionary model. In subsequent research, Nolan posited that a fifth stage and sixth stage existed (Nolan 1975). The fifth stage, Data Administration and sixth stage, Maturity, were developed to illustrate an organization’s use of data administration and when an organization’s application portfolio’s data flows mirror the organization’s information flows respectively. Consistent with the development of his theory, Nolan expanded his understanding of the criteria with which an organization could be examined to understand in which stage they existed. Instead of just planning, organizing, and controlling, Nolan expanded those criteria to include application portfolio, data processing organization, data processing planning and control, and user awareness (Nolan 1979). Similar to his previous stage model, Nolan believed that his newer, more complete model could be used to describe an organization and that by understanding the characteristics of organizations at each stage, a better understanding of what it would take to advance to more mature stages would be possible. It is important to note that in Nolan’s conceptualization of stages, organizations simply evolved from one stage to the next. In other words, it was not considered that an organization could either skip from one stage to another without first taking on the characteristics of the stage or stages in between. Likewise, Nolan also did not consider the case where an organization might actual devolve into a lower stage. Miller and Friesen (1984) noted in their study of corporate life cycles that stages could be skipped and that regression from one stage to a prior stage could indeed occur. In the context of an organizations security posture, it suggests that an organization can potentially move from a very early stage of information systems security to a much better developed posture or that they could actually regress to a lower stage representing a less secure organization. Stage theory is not without its detractors though. Benbasat et al. (1984) in a brief review of Nolan’s Stage Theory found little support for the explanatory power of the theory to predict the growth in organizational computing. They noted that while maturity is an intuitively appealing concept, that empirically, it been difficult to measure. They attribute some of this to the dynamic nature of maturity in that our definition of maturity changes over time. This explains the changes in Nolan’s model over time to account for addi