# Policy Components - A Conceptual Model for Tailoring Information Security Policies

Elham Rostami, Fredrik Karlsson, Shang Gao

► To cite this version:

Elham Rostami, Fredrik Karlsson, Shang Gao. Policy Components - A Conceptual Model for Tailoring Information Security Policies. 16th International Symposium on Human Aspects of Information Security and Assurance (HAISA), Jul 2022, Mytilene, Lesbos, Greece. pp.265-274, 10.1007/978-3-031-12172-2_21. hal-05324924

HAL Id: hal-05324924

https://inria.hal.science/hal-05324924v1

Submitted on 21 Oct 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
<figure><img src="image_2.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
# Policy Components - A Conceptual Model for Tailoring Information Security Policies

Elham Rostami(✉), Fredrik Karlsson, and Shang Gao

CERIS, Informatics, Örebro University, Örebro, Sweden
{elham.rostami,fredrik.karlsson,shang.gao}@oru.se

**Abstract.** Today, many business processes are propelled by critical information that needs safeguarding. Procedures on how to achieve this end are found in information security policies (ISPs) that are rarely tailored to different target groups in organizations. The purpose of this paper is therefore to propose a conceptual model of policy components for software that supports modularizing and tailoring of ISPs. We employed design science research to this end. The conceptual model was developed as a Unified Modeling Language class diagram using existing ISPs from public agencies in Sweden. The conceptual model can act as a foundation for developing software to tailor ISPs.

**Keywords:** Information security policy · Tailored policy design · Conceptual model

## 1 Introduction

In contemporary organizations many business processes are highly dependent on information assets. Therefore, information security, where the purpose is to safeguard an organization's information assets, is critical. Organizations can choose to implement controls, i.e., measures that address risks, to enhance information security. These controls are often sorted into three main categories: technical, formal, and informal controls [1]. Among the formal controls, information security policy (ISP), is viewed as one of the most important ones. An ISP includes “established rules that provide guidance in the protection of an organization’s assets” [2] and thus directs employees’ use of information and information systems. However, employees’ non-compliance with ISPs is a perennial problem for many organizations [3, 4].

At the same time, half of all information security breaches caused by employees are accidental [5]. It has therefore been argued that there is also an ISP-design related aspect to employees’ non-compliance [6], where ISPs can be cumbersome to follow and sometimes even incompatible with existing business processes [7]. As it has been shown by [8], existing research mostly takes a monolithic view of ISPs, where the same ISP is used for the entire organization, i.e., for all employees. Thus, there is a relevance issue with ISPs. Having said that, research has acknowledged that the needs of employees differ [e.g. 9], which suggests pursuing a tailoring approach to ISPs. Furthermore, designing
is a non-trivial task [10], which means there is a design burden of information security managers. Researchers have therefore suggested software to aid the management of ISPs [e.g. 11, 12], however they have addressed the tailoring aspect of ISPs to a very limited extent. One notable exception is [13], who identified two requirements about tailoring of ISPs among a larger set of requirements for software to aid ISP design. Consequently, combining the ideas of tailoring of ISP and software could address both the relevance issue of ISPs and ease the design burden of information security managers. To facilitate consistent and coherent tailoring with the use of such software, an ISP needs to be possible to represent as modules that can be selected depending on the relevance for the audience. Therefore, this paper *aims to propose a conceptual model of policy components for software that supports modularizing and tailoring ISPs*.

## 2 Related Research

The use of software to aid the design of ISPs is not new in research, but this topic has received limited attention from researchers [14]. The papers that addressed such software [11, 12, 15, 16] address few aspects of tailoring of ISPs. Furthermore, these papers seem to focus on demonstrating the software's functionality and do not present the conceptual models behind the software designs. [12] introduced a framework, which they implemented as a software, helping managers when “evaluating information security policy performance”. Consequently, they did not provide design support for modularizing of ISPs. [16] and [11] elaborated further on the information security management toolbox that has been introduced by [17]. The software builds on the information security governance model [18], which is process-oriented model. The software implements two phases, a direct phase, and a control phase, where the design of ISPs is part of the former phase. The direct phase also supports the selection of information security controls based on the ISP. The software enables a dynamic ISP, where supporting security procedures “are presented for selection based on the security controls selected” [11]. Although the software provides a “personalized and tailormade Word-document” [11] it is still unclear to what extent it is tailored to the employees' work situation. The reason is that the controls are selected from the international information security standard ISO 27002. Furthermore, they do not provide any conceptual model to aid the implementation of such tailoring functionality in other software. Moving beyond the research on software that aid the design of ISPs, existing research provides some model框架s that support ISP design [e.g. 19, 20]. However, these models are not conceptual models, i.e., models that are representations of software, and they do not address the tailoring aspects. Finally, [13] identify 14 requirements on software to aid ISP design. Among these requirements 2 of them directly focus on tailoring ISPs (1) support a tailorable design of ISPs, and (2) address clear and uniform target groups. The remaining software requirements to aid ISP design are actionable advice, adopted to the work practice, based on identified risks, clarifying responsibilities, clear communicative objectives, clear structure, clearly defined concepts, informed by laws, regulations, and standards, internally congruent ISP actions, keep up-to-date, goal alignment, and styling. Although these requirements as prerequisite for developing software to support tailoring ISP are valuable, they were not turned into a model or a software.
# 3 Research Method

This research is part of a larger design science research (DSR) endeavor, where the end goal is to suggest a software for tailoring of ISPs. Our particular research follows the DSR approach suggested by [21], but is here limited to the first four phases of the our first design science cycle: (1) Problem identification and motivation, (2) Define objectives of a solution, (3) Design and development, and (4) Demonstration.

The Problem identification and motivation phase is found in the Introduction, showing that there is an ISP-design-related aspect to employees' non-compliance. Existing research has suggested a tailoring approach to ISP, which we combine with the idea of software to aid information security managers in achieving this goal. The Define objectives of a solution phase focused on setting the objective for the first DSR cycle and was operationalized into two design goals: (1) To develop a conceptual model that supports modularized ISP content to self-contained and free-standing parts, and (2) To develop a conceptual model that supports creating tailored ISPs by reusing modules.

The Design and development phase focused on developing the conceptual model of policy components. As an empirical starting point for our conceptual modeling, we had access to 159 ISPs from public agencies in Sweden. Still, we had to balance resources available for modeling and arriving at a stable conceptual model. We therefore divided our modeling work into two steps: (1) developing an initial conceptual model and (2) validating the model. During the first step we selected the three most extensive ISPs that we had access to and used them as input to develop an initial conceptual model. The conceptual modeling of the ISPs took place during three workshops where all three authors participated. During the second step, we validated the initial conceptual model using the ISPs from the database until we reached saturation [22]. This meant, we stopped modeling when modeling another ISPs would not add anything new to the conceptual model. To reduce researcher bias we developed an algorithm to select 10 ISPs from the available ISPs randomly for each validation iteration. We reached saturation after two iterations, which meant that we validated the conceptual model using 20 ISPs in total. During the second step, we used the classes and associations in the model to sort the content of the ISPs. Things that could not be sorted using the conceptual model were noted and later considered as input for revising the model. The refined conceptual model is presented in Sect. 4. In this section we also provide (a) references to existing ISP design research, pinpointing theoretical grounding of the model in addition to our empirical work and (b) show how the model addresses the requirements in [13].

The Demonstration phase consists of two parts. First, we use the conceptual model to elicit policy components from one of the ISPs from public agencies in Sweden that we had access to. Consequently, it is an empirical demonstration showing how policy components are self-contained and free-standing parts (i.e., meeting our first design goal). Second, we use the elicited policy components to create two tailored ISPs targeting different target groups. This part of the demonstration shows how policy components can be reused across two tailored ISPs (i.e., meeting our second design goal). Executing this demonstration as a proof-of-concept is important before investing in software implementation and demonstrating tailoring as a proof-of-value in actual organizational cases [23].
# 4 Policy Component – Conceptual Model

The conceptual model of policy components is shown in Fig. 1 as a Unified Modeling Language (UML) class diagram. The conceptual model consists of 13 classes: actor, role, information security policy, policy component, structure, policy statement, actionable advice, educational content, general content, consequence, concept, goal, and supplementary sources. Between these classes, we find several named associations.

<figure><img src="image_3.png" /><figcaption>Fig. 1. Conceptual model of policy components</figcaption></figure>

In organizations, many different work tasks are carried out in relation to business processes. Thus, not all parts of an ISP are equally relevant for all roles and existing research recommends that ISPs are divided into several parts that target specific audiences [9]. Organizations define roles in order for employees and other associated actors to know what is expected of them. Thus, starting in the upper-left corner of Fig. 1, an *Actor* is an individual associated with the organization, while a *Role* is a function played by an actor in the organization. Thus, actors playing the same role is a common ground for the addressing the “clear and uniform target groups” requirement [13]. For example, at a hospital, an employee can play the role of a nurse in a ward. The model defines those actors included must have at least one role in an organization, but some roles have no dedicated actors at a specific point in time.
A *Policy component* can both guide and restrict tasks associated with a specific role. Addressing the “tailorable design” requirement in [13], a policy component is a self-contained part of an ISP expressing rules that guide the protection of the organization’s assets while executing a defined task. The nurse exemplified above could have several defined tasks, and one of them could be to access a patient’s medical record to provide care. A policy component is prescribed in order to achieve one or more goals. A *Goal* is a verifiable state of the world toward which the policy component is directed. Goals can be derived from supplementary sources, such as internal standards, work instructions, laws, and regulations. For example, one goal related to the exemplified task above is to keep patient information confidential. By explicitly stating the goals of the policy components, it is possible to identify any goal conflicts, conflicts that may create future non-compliance situations [24]. Thus, this addresses the “goal alignment” requirement in [13].

The policy components provide a set of *Policy statements* to support an actor playing a role. A policy statement is direction-giving and guides towards the goal of the policy component. Thus, these statements have different communication objectives [6]. As shown in Fig. 1, a policy statement is an abstract class, and there are three different types of policy statements (actionable, educational, general) that serve different purposes. Thus, we address the requirement of having “clear communicative objectives” in [13]. *Actionable advice* provides instructions and rules on how to execute a task [6]. Thus, the actionable advice defines what is allowed and what is not allowed regarding the task [25]. For example, when using medical records to provide care, one part of the actionable advice is to access a patient’s medical records that the nurse provides care for only. It means that as a nurse, you are not allowed to access all medical records. One main purpose of an ISP is to limit non-compliant behavior, and actionable advice can be associated with one or more *Consequences*. Drawing on deterrence theory [26], a consequence is a specific sanction for not complying with the instructions and rules found in the actionable advice. For example, the policy components should include the consequences of accessing a patient record without having work-related reasons, clearly stating that the care provider always reports to the police when they suspect unauthorized access to patient records to continue with the running illustration. Consequently, we address the “actionable advice” and “clarifying responsibility” requirements in [13].

*Educational content* and *General content* serve a different purpose than actionable advice; these types of advice do not have the purpose of regulating. Drawing on [6], separating different communicative functions in an ISP is important to provide clear and efficient communication. Simultaneously, the policy component’s design allows referring between these types of advice. Educational content provides information about information security and the task to educate the actor. For example, the care provider can explain that activities in the electronic patient record system are logged and that these logs are audited regularly. By providing this information, the care provider can raise awareness of how the system works. Finally, general content provides information about information security and the task that serves the purpose of generally informing the information security policy user.

It is important that all actors using the ISP have a shared understanding of the terms used and what concepts that they refer to [27]. Information security and business
terminology and concepts often come with a certain complexity. The policy component, therefore, includes the possibility to define concepts. A *Concept* is a generic description of how something is conceived in the organization. In the example discussed above, confidentiality is a central concept to understand. Thus, a definition, such as "information is not made available or disclosed to unauthorized individuals, entities, or processes" [28], can be included in a policy component about patient's medical records. The same concept can be associated with more than one piece of advice. This means that we address the "clearly defined concepts" requirement in [13]. Sometimes it is necessary to refer to other documents as a complement to the ISP. Thus, the different types of advice can include references to *Supplementary sources*. A supplementary source is an artifact that contains additional information to specific advice, such as found in laws, regulations, and information security standards [29]. These sources provide background information for the actionable advice that is provided in the policy component. This part of the model addresses the "informed by laws, regulations, and standards" requirement in [13].

A self-contained policy component can act as a building block when constructing tailored ISPs. As is shown in Fig. 1, an ISP tailored for a specific role consists of one or more policy components. We acknowledge the fact that the content of an ISP needs to be presented in a structured way [6, 30] in order to provide an overview for the actor playing a specific role. Thus, each ISP has a *Structure* that organizes related policy components together and addresses the “clear structure” requirement in [13].

# 5 Policy Component – Demonstration

Below we demonstrate the policy component concept as a proof-of-concept. The demonstration consists of two parts. The first part provides an internal view of a policy component, showing its content. The second part of the demonstration shows an external view of policy components, hiding their content. The purpose is to demonstrate how policy components can be combined to create tailored ISPs targeting different roles.

## 5.1 Policy Component: Managing E-mails

The presentation is structured using the classes in Fig. 1. Since the existing ISP which is used as starting point was not designed with this structure in mind, we had to move text around and rephrase some parts to create better flow in the text. We strived not to change the meaning of the ISP; however, the text below should not be interpreted as exact quotes from the original ISP.

**Policy Component:** Managing e-mails.

**Goal:** To govern the use of the agency's e-mail accounts.

**Actionable Advice:** The e-mail account is for work purposes only. Received e-mails must be opened and read within one business day. For example, during an absence due to illness, vacation, or other leave, you should grant a colleague the right to read the incoming e-mails. Note that an automatic reply is not considered sufficient. You may forward received e-mails to another e-mail address; however, replies to incoming e-mails
shall be sent via the agency's e-mail address. You are not allowed to delete an incoming e-mail without first making sure what the content is. E-mail marked as spam must be inspected before deleting. Confidential information should not be sent via e-mail.

*Consequence*: In case of violation of these rules, the e-mail account will be terminated.

*Educational Content*: Spam, also referred to as junk e-mail, is the practice of sending unsolicited messages in bulk by e-mail. There is a central e-mail filter that checks whether incoming e-mails might be spam or not to ease the burden of users. This task is carried out using a predefined set of rules. Spam messages are sent to a specific folder called "Spam". However, there is no definite way to define spam. Therefore, e-mails in this folder must be looked through before deleting. The use of e-mailing lists can be perceived as spam, and it is important to think about the relevance of the e-mail before sending it. The e-mail address represents the agency and thus affects the agency's reputation.

*General Content*: Every staff receives an e-mail account according to the standard firstname.lastname@[agency].se. If there is more than one employee with the same first and last name, the first letter of the middle name will be used by the firstname.a.lastname@[agency].se.

*Concept*: Confidential information is information that is made available to authorized individuals only.

*Supplementary Source:* -

## 5.2 Two Tailored Information Security Policies

In this part of the demonstration, we have created two tailormade ISPs based on elicited policy components. Since the organization does not have tailormade ISPs today, this demonstration shows what such a design would potentially look like. In Fig. 2, we use an object diagram to illustrate the two ISPs and parts of their content. Due to space limitations, we only show three policy components of each ISP. Still, it is enough to illustrate the basic principle of how the selection of policy components enables tailoring of ISPs and illustrates how the same policy component can be reused across multiple ISPs. As it is shown in Fig. 2, the two ISPs target different roles. The uppermost ISP targets the project coordinator role, and the lowermost ISP targets the finance officer role. We have intentionally chosen two roles where it is reasonable to assume that they do not share many tasks in their day-to-day work.

Starting to the left in both object diagrams, we find the policy component we elicited above, the Managing e-mails-component. In the original ISP, these regulations targeted all employees. Therefore, this policy component is included in both ISPs and shared across both roles. Next, we find policy components that are unique for each role, targeting access to specific information systems. In the uppermost ISP, we find a policy component about accessing the organization's project management system. Project coordinators use this system to carry out day-to-day tasks. However, finance officers do not use this system. Therefore, these regulations are not relevant to include in the ISP targeting financial officers. Instead, we have selected a policy component about accessing the
financial management system, which manages the finances of the organization. It is an information system that the financial officers work with daily. This example shows how the difference in tasks is used to tailor the selection of policy components included in the ISPs. Finally, rightmost in each object diagram in Fig. 2, we find a policy component shared across both ISPs. It targets how to access the organization's information assets remotely. The policy component includes instructions on how to use the virtual private network software. This policy component is relevant for both exemplified roles and is necessary when accessing both the project management system and the financial system from a remote location. Thus, this shows that policy components can be included in the ISP to support other policy components.

<figure><img src="image_4.png" /><figcaption>Fig. 2. Object diagram of two tailored information security policies</figcaption></figure>

# 6 Conclusion and Future Research

The proposed conceptual model can act as a foundation for developing software to design tailorable ISPs, which is also the next step of our larger research endeavor. As it was said in Sect. 2, having software for designing ISPs has received limited attention from researchers [14]. Our model can therefore be considered as one step towards developing a software that aids information security managers in designing modularized and tailorable ISPs. More concretely, the model directly addresses the two software requirements about tailoring of ISPs presented by [13]. In addition, we indirectly address an additional seven software requirements about ISP design in [13] in our design of the policy component concept, requirements that are impacted by a tailorable design.
A limitation of our conceptual model is that we analyzed three ISPs from public agencies and used an additional 20 ISPs from public agencies for validation. Consequently, during our design work we focused on public agencies and did not use any ISPs from companies, and all the ISPs were from Swedish organizations. Consequently, we have not addressed any differences in ISP design across industry sectors and countries. It means that the design could be context-bound, making it interesting to further demonstrate and evaluate the model using ISPs from other industry sectors and countries.

## References

1. Dhillon, G.: Information Security - Text & Cases Prospect Press, Burlington (2017)

2. Whitman, M.E.: Security policy - from design to maintenance. In: Straub, D.W., Goodman, S., Baskerville, R. (eds.) Information Security - Policy, Processes, and Practices, pp. 123–151. M E Sharpe, New York (2008)

3. PwC: The information security breaches survey - Technical report. Department for Business, Innovation and Skills (BIS) (2014)

4. PwC: The Global State of Information Security Survey 2018. PriceWaterhouseCoopers (2018)

5. ENISA: ENISA Threat Landscape 2014. Overview of current and emerging cyber-threats. European Union Agency for Network and Information Security (2014)

6. Karlsson, F., Hedström, K., Goldkuhl, G.: Practice-based discourse analysis of information security policies. Comput. Secur. 67(June 2017), 267–279 (2017)

7. Stahl, B.C., Doherty, N.F., Shaw, M.: Information security policies in the UK healthcare sector: a critical evaluation. Inf. Syst. J. 22, 77–94 (2012)

8. Rostami, E.: Tailoring policies and involving users in constructing security policies: a mapping study. In: Furnell, S., Clarke, N.L. (eds.) Proceedings of Thirteenth International Symposium on Human Aspects of Information Security & Assurance, HAISA 2019, Nicosia, Cyprus, 15–16 July 2019, pp. 1–11. University of Plymouth, Plymouth (2019)

9. Cosic, Z., Boban, M.: Information security management—defining approaches to Information Security policies in ISMS. In: IEEE 8th International Symposium on Intelligent Systems and Informatics, pp. 83–85. IEEE (2010)

10. Kinnunen, H., Siponen, M.T.: Developing organization-specific information security policies. In: PACIS 2018, pp. 1–13 (2018)

11. Coertze, J., von Solms, R.: A software gateway to affordable and effective information security governance in SMMEs. In: 2013 Information Security for South Africa, pp. 1–8. IEEE (2013)

12. Syamsuddin, I., Hwang, J.: The use of AHP in security policy decision making: an Open Office Calc application. J. Softw. 5(10), 1162–1169 (2010)

13. Rostami, E., Karlsson, F., Shang, G.: Requirements for computerized tools to design information security policies. Comput. Secur. 99(December 2020), Article number 102063 (2020)

14. Rostami, E., Karlsson, F., Kolkowska, E.: The hunt for computerized support in information security policy management: a literature review. Inf. Comput. Secur. 28(2), 215–259 (2020)

15. Vermeulen, C., von Solms, R.: The information security management toolbox - taking the pain out of security management. Inf. Manag. Comput. Secur. 10(3), 119–125 (2002)

16. Coertze, J., van Niekerk, J., von Solms, R.: A web-based information security management toolbox for small-to-medium enterprises in Southern Africa. In: Venter, H.S., Coetzee, M., Loock, M. (eds.) 2011 Information Security for South Africa (ISSA 2011), Johannesburg, South Africa, pp. 1–8. IEEE (2011)
17. Hoppe, O.A., van Niekerk, J., von Solms, R.: The effective implementation of information security in organizations. In: Ghonaimy, M.A., El-Hadidi, M.T., Aslan, H.K. (eds.) Security in the Information Society - Visions and Perspective, pp. 1–18. Springer, Boston (2002). https://doi.org/10.1007/978-0-387-35586-3_1

18. Coertze, J., von Solms, R.: A model for information security governance in developing countries. In: Jonas, K., Rai, I.A., Tchuente, M. (eds.) AFRICOMM 2012. LNICSSITE, vol. 119, pp. 279–288. Springer, Heidelberg (2013). https://doi.org/10.1007/978-3-642-41178-6_29

19. Ismail, W.B.W., Widyarto, S.A.: Formulation and development process of information security policy in higher education. In: 1st International Conference on Engineering Technology and Applied Sciences, Afyonkarahisar, Turkey (2016)

20. Flowerday, S.V., Tuyikeze, T.: Information security policy development and implementation: the what, how and who. Comput. Secur. 61, 169–183 (2016)

21. Peffers, K., Tuunanen, T., Rothenberger, M.A., Chatterjee, S.: A design science research methodology for information systems research. J. Manag. Inf. Syst. 24(3), 45–77 (2007)

22. Glaser, B.G., Strauss, A.L.: The Discovery of Grounded Theory: Strategies for Qualitative Research. Aldine, New York (1967)

23. Nunamaker, J.F., Briggs, R.O.: Toward a broader vision for information systems. ACM Trans. Manag. Inf. Syst. 2(4), Article 20 (2011)

24. Hedström, K., Kolkowska, E., Karlsson, F., Allen, J.P.: Value conflicts for information security management. J. Strat. Inf. Syst. 20(4), 373–384 (2011)

25. Davis, G.B., Olson, M.H.: Management Information Systems: Conceptual Foundations, Structure, and Development. McGraw-Hill, Inc., New York (1985)

26. D'Arcy, J.D., Devaraj, S.: Employee misuse of information technology resources: testing a contemporary deterrence model. Decis. Sci. J. 43(6), 1091–1124 (2012)

27. Buthelezi, M.P., Van der Poll, J.A., Ochala, E.O.: Ambiguity as a barrier to information security policy compliance: a content analysis. In: International Conference on Computational Science and Computational Intelligence 2016, Las Vegas, NV, USA, pp. 1361–1367. IEEE (2016)

28. ISO: ISO/IEC 27000:2014, Information technology—Security techniques—Information security management systems—Overview and vocabulary. International Organization for Standardization (ISO) (2014)

29. Tuyikeze, T., Flowerday, S.: Information security policy development and implementation: a content analysis approach. In: HAISA 2014, pp. 11–20 (2014)

30. Höne, K., Eloff, J.H.P.: Information security policy – what do international information security standards say? Comput. Secur. 21(5), 402–409 (2002)