Table 3 Implementation of ISO/IEC 27001... | Emerald Publishing

Table 3

Implementation of ISO/IEC 27001

Main themes/research results	Relevant papers (evidence: C = conceptual; E = empirical)
Tools and methods
High flexibility of the guidelines	Bamakan and Dehghanimohammadaba (2015) (C), Barafort et al. (2017) (C), Barafort et al. (2019) (C), Beckers et al., (2013) (C), Beckers et al. (2016) (C), Bounagui et al. (2019) (C), Culot et al. (2019) (E), Dionysiou (2011) (C), Fuentes et al. (2011) (C), Ganji et al. (2019) (C), Gillies (2011) (E), Heston and Phifer (2011) (C), Itradat et al. (2014) (E), Ku et al. (2009) (E), Liao and Chueh (2012a) (E), Liao and Chueh (2012b) (C), Lomas (2010) (C), Mirtsch et al. (2021) (E), Ozkan and Karabacak (2010) (E), Raabi et al. (2020) (C), Rezaei et al. (2014) (C), Simić-Draws et al. (2013) (C), Stewart (2018) (C), Van Wessel et al. (2011) (E)
Security controls difficult to assess/implement	Almeida and Respício (2018) (C), Bettaieb et al. (2019) (C), Crowder (2013) (E), Ho et al. (2015) (E), Liao and Chueh (2012a) (E), Liao and Chueh (2012b) (C); Montesino et al. (2012) (E) Simić-Draws et al. (2013) (C), Susanto et al. (2011) (C), Susanto et al. (2012) (C), Stewart (2018) (C), Topa and Karyda (2019) (C), Van Wessel et al., 2011 (E)
Difficult assessment of external interdependencies	Beckers et al. (2013) (E), Culot et al. (2019) (E), Lomas (2010) (C), Smith et al. (2010) (E), Stewart (2018) (C)
Further effort needed to integrate legal requirements	Beckers et al. (2013) (C), Broderick (2006) (C), Diamantopoulou et al. (2020) (C), Lomas (2010) (C), Simić-Draws et al. (2013) (C)
Possible integration with GDPR requirements	Annarelli et al. (2020) (E), Diamantopoulou et al. (2020) (C), Gaşpar and Popescu (2018) (C), Lopes et al. (2019) (E), Serrado et al. (2020) (E)
Relevant cultural and psychological elements not adequately addressed	Asai and Hakizabera (2010) (E), Topa and Karyda (2019) (C), van Wessel et al. (2011) (E)
Project governance
Senior management commitment	Beckers et al. (2013) (C), Beckers et al. (2016) (C), Crowder (2013) (E), Everett (2011) (C), Gillies (2011) (E), Kossyva et al. (2014) (C), Ku et al. (2009) (E), Liao and Chueh (2012a) (E), Ozkan and Karabacak (2010) (E), Smith et al. (2010) (E), Stewart (2018) (C), Van Wessel et al. (2011) (E)
Cross-functional coordination	Crowder (2013) (E), Itradat et al. (2014) (E), Kossyva et al. (2014) (C), Ku et al. (2009) (E), Simić-Draws et al. (2013) (C), Smith et al. (2010) (E), Van Wessel et al. (2011) (E)
Support of external consultants	Annarelli et al. (2020) (E), Dionysiou (2011) (E), Gillies (2011) (E), Hlača et al. (2008) (E), Mirtsch et al. (2021) (E), Rezaei et al. (2014) (C), Van Wessel et al. (2011) (E)
Organizational learning through self-implementation	Crowder (2013) (E), Gillies (2011) (E), Ku et al. (2009) (E), Van Wessel et al. (2011) (E)
Significant time/cost to implement	Annarelli et al. (2020) (E), Broderick (2006) (C), Culot et al. (2019) (E), Deane et al. (2019) (C), Dionysiou (2011) (C), Everett (2011) (C), Gillies (2011) (E); Hlača et al. (2008) (E), Kossyva et al. (2014) (C), Majerník et al. (2017) (C), Mirtsch et al. (2021) (E), Montesino et al. (2012) (C), Ozkan and Karabacak (2010) (E), Pardo et al. (2016) (C), Smith et al. (2010) (E), Stewart (2018) (C), Van Wessel et al. (2011) (E)
Actual adoption of practices (absorption)
Symbolic/informal implementation of the standard	Culot et al. (2019) (E), Everett (2011) (E), Lomas (2010) (C), Mirtsch et al. (2021) (E)
Low employees' compliance	Asai and Hakizabera (2010) (E), Heston and Phifer (2011) (C), Smith et al. (2010) (E), Topa and Karyda (2019) (C), Van Wessel et al. (2011) (E)

Main themes/research results	Relevant papers (evidence: C = conceptual; E = empirical)
Tools and methods
High flexibility of the guidelines	Bamakan and Dehghanimohammadaba (2015) (C), Barafort et al. (2017) (C), Barafort et al. (2019) (C), Beckers et al., (2013) (C), Beckers et al. (2016) (C), Bounagui et al. (2019) (C), Culot et al. (2019) (E), Dionysiou (2011) (C), Fuentes et al. (2011) (C), Ganji et al. (2019) (C), Gillies (2011) (E), Heston and Phifer (2011) (C), Itradat et al. (2014) (E), Ku et al. (2009) (E), Liao and Chueh (2012a) (E), Liao and Chueh (2012b) (C), Lomas (2010) (C), Mirtsch et al. (2021) (E), Ozkan and Karabacak (2010) (E), Raabi et al. (2020) (C), Rezaei et al. (2014) (C), Simić-Draws et al. (2013) (C), Stewart (2018) (C), Van Wessel et al. (2011) (E)
Security controls difficult to assess/implement	Almeida and Respício (2018) (C), Bettaieb et al. (2019) (C), Crowder (2013) (E), Ho et al. (2015) (E), Liao and Chueh (2012a) (E), Liao and Chueh (2012b) (C); Montesino et al. (2012) (E) Simić-Draws et al. (2013) (C), Susanto et al. (2011) (C), Susanto et al. (2012) (C), Stewart (2018) (C), Topa and Karyda (2019) (C), Van Wessel et al., 2011 (E)
Difficult assessment of external interdependencies	Beckers et al. (2013) (E), Culot et al. (2019) (E), Lomas (2010) (C), Smith et al. (2010) (E), Stewart (2018) (C)
Further effort needed to integrate legal requirements	Beckers et al. (2013) (C), Broderick (2006) (C), Diamantopoulou et al. (2020) (C), Lomas (2010) (C), Simić-Draws et al. (2013) (C)
Possible integration with GDPR requirements	Annarelli et al. (2020) (E), Diamantopoulou et al. (2020) (C), Gaşpar and Popescu (2018) (C), Lopes et al. (2019) (E), Serrado et al. (2020) (E)
Relevant cultural and psychological elements not adequately addressed	Asai and Hakizabera (2010) (E), Topa and Karyda (2019) (C), van Wessel et al. (2011) (E)
Project governance
Senior management commitment	Beckers et al. (2013) (C), Beckers et al. (2016) (C), Crowder (2013) (E), Everett (2011) (C), Gillies (2011) (E), Kossyva et al. (2014) (C), Ku et al. (2009) (E), Liao and Chueh (2012a) (E), Ozkan and Karabacak (2010) (E), Smith et al. (2010) (E), Stewart (2018) (C), Van Wessel et al. (2011) (E)
Cross-functional coordination	Crowder (2013) (E), Itradat et al. (2014) (E), Kossyva et al. (2014) (C), Ku et al. (2009) (E), Simić-Draws et al. (2013) (C), Smith et al. (2010) (E), Van Wessel et al. (2011) (E)
Support of external consultants	Annarelli et al. (2020) (E), Dionysiou (2011) (E), Gillies (2011) (E), Hlača et al. (2008) (E), Mirtsch et al. (2021) (E), Rezaei et al. (2014) (C), Van Wessel et al. (2011) (E)
Organizational learning through self-implementation	Crowder (2013) (E), Gillies (2011) (E), Ku et al. (2009) (E), Van Wessel et al. (2011) (E)
Significant time/cost to implement	Annarelli et al. (2020) (E), Broderick (2006) (C), Culot et al. (2019) (E), Deane et al. (2019) (C), Dionysiou (2011) (C), Everett (2011) (C), Gillies (2011) (E); Hlača et al. (2008) (E), Kossyva et al. (2014) (C), Majerník et al. (2017) (C), Mirtsch et al. (2021) (E), Montesino et al. (2012) (C), Ozkan and Karabacak (2010) (E), Pardo et al. (2016) (C), Smith et al. (2010) (E), Stewart (2018) (C), Van Wessel et al. (2011) (E)
Actual adoption of practices (absorption)
Symbolic/informal implementation of the standard	Culot et al. (2019) (E), Everett (2011) (E), Lomas (2010) (C), Mirtsch et al. (2021) (E)
Low employees' compliance	Asai and Hakizabera (2010) (E), Heston and Phifer (2011) (C), Smith et al. (2010) (E), Topa and Karyda (2019) (C), Van Wessel et al. (2011) (E)