## 2 Theoretical Background
### Information Governance and Knowledge Management Disruption Following Data Breaches  
The disruption of established knowledge management systems following data breaches represents a second theoretical domain essential for understanding employee-driven information governance [1]. Traditional models of organisational knowledge management emphasise structured information flows, codified knowledge repositories, and prescribed information-sharing protocols [13]. However, breach events fundamentally disrupt these systems, creating what [4] term \"knowledge governance vacuums\" wherein established informational authorities are temporarily suspended. Within these governance vacuums, employees become critical nodes in reconfigured knowledge networks. As [4] explain, \"Data breach incidents fundamentally alter both formal and informal knowledge flows within organisations, temporarily suspending established hierarchies of informational authority and creating spaces for emergent knowledge governance structures\" (p. 83). Their comparative analysis of pre-breach and post-breach knowledge networks across 12 organisations demonstrates significant reconfigurations in information flow patterns, with employees demonstrating increased autonomy in knowledge dissemination decisions. This governance disruption simultaneously affects both explicit and tacit knowledge domains. While explicit knowledge management disruptions manifest in altered documentation practices and information classification protocols, tacit knowledge disruptions occur within interpersonal knowledge-sharing networks [14]. As [PERSON] and colleagues (2022) note, \"The erosion of trust following breach events disproportionately impacts tacit knowledge flows, with employees demonstrating heightened selectivity in verbal information sharing and creating informal knowledge enclaves based on perceived trustworthiness\" (p. 418). The concept of \"knowledge resilience\" emerges as particularly salient in this theoretical domain. [11] define knowledge resilience as \"the capacity of organisational knowledge systems to maintain functional integrity while simultaneously adapting to security disruptions\" (p. 236). Their framework identifies employee agency as the primary determinant of knowledge resilience following breach events, with particular emphasis on employees' capacity to: (1) maintain critical knowledge flows during disruption, (2) identify and protect vulnerable knowledge assets, (3) distinguish between legitimate and illegitimate knowledge sharing requests, (4) re-establish trusted knowledge pathways following breaches. Importantly, [11] distinguish between reactive knowledge governance (focused on containing information leakage) and regenerative knowledge governance (focused on rebuilding robust information flows). Their empirical findings suggest that organisations emphasising reactive governance strategies experience prolonged knowledge disruption, while those facilitating employee-driven regenerative governance demonstrate accelerated knowledge system recovery. Building upon this distinction, [15] propose the concept of \"information governance maturity\" as a framework for assessing organisational capacity to manage knowledge disruptions following breaches. Their maturity model incorporates five progressive levels: (1) ad hoc _responses_, characterised by fragmented uncoordinated knowledge management responses; (2) _defined protocols_: featuring standardised but inflexible knowledge governance procedures; (3) _integrated systems_, demonstrating coordinated technical and human knowledge management components; (4) _quantitatively managed_, employing metrics to assess and optimise knowledge governance effectiveness; (5) _optimising_, continuously improving knowledge governance through systematic learning and adaptation.