Lena Connolly
email: y.connolly1@nuigalway.ie

Michael Lang

J D Tygar

Investigation of Employee Security Behaviour: A Grounded Theory Approach

Keywords: Employee Security Behaviour, Security Countermeasures, Organisational Culture, National Culture

At a time of rapid business globalisation, it is necessary to understand employee security behaviour within diverse cultural settings. While general deterrence theory has been extensively used in Behavioural Information Security research with the aim to explain the effect of deterrent factors on employees' security actions, these studies provide inconsistent and even contradictory findings. Therefore, a further examination of deterrent factors in the security context is required. The aim of this study is to contribute to the emerging field of Behavioural Information Security research by investigating how a combination of security countermeasures and cultural factors impact upon employee security behaviour in organisations. A particular focus of this project is to explore the effect of national culture and organisational culture on employee actions as regards information security. Preliminary findings suggest that organisational culture, national culture, and security countermeasures do have an impact upon employee security behaviour.

Introduction

The majority of modern organisations are heavily relying on computerised information systems (IS). These systems store the sensitive data necessary to run businesses efficiently, including financial, customer, and product records. Therefore, managing risks associated with the loss of this vital information is essential. Threats can come from external as well as internal sources. External attacks are typically initiated by hackers who are seeking political or financial gain. The common way to prevent external attacks is an implementation of technical security controls, including firewalls, anti-malware software, and authentication controls. These measures are widely employed by organisations and are largely effective. On the other hand, an insider threat refers to an intentional or unintentional misuse of an organisation's IS by employees that may negatively affect the confidentiality, integrity, or availability of that organisation's vital information. Maintaining employees' compliance with information security rules is a more problematic matter as technical controls are unable to prevent all human blunders. For instance, employees tend to write passwords down, share them with colleagues or send confidential information in an unencrypted form. It is estimated that at least half of information security breaches are made by internal personnel [START_REF] Spears | User participation in information systems security risk management[END_REF]. Posey et al. [START_REF] Posey | Understanding the mindset of the abusive insider: an examination of insiders' causal reasoning following internal security changes[END_REF] argue that deviant behaviour is best managed with a combination of technical and social measures.

Overcoming the issue of "human error" has received considerable attention in Behavioural Information Security (InfoSec) research. Various approaches designed to improve employee security behaviour have been suggested by IS scholars. These range from security awareness programmes [START_REF] D'arcy | User awareness of security countermeasures and its impact on information systems misuse: A deterrence approach[END_REF] and security education and training [START_REF] Lee | An integrative model of computer abuse based on social control and general deterrence theories[END_REF] to approaches that take into account deterrent [START_REF] Hu | Managing employee compliance with information security policies: the role of top management and organizational culture[END_REF] as well as cognitive [START_REF] Hu | Does deterrence work in reducing information security policy abuse by employees?[END_REF][START_REF] Ifinedo | Understanding information systems security policy compliance: An integration of the theory of planned behavior and the protection motivation theory[END_REF] factors.

However, a comprehensive literature review conducted for this research revealed that a number of areas in Behavioural InfoSec research require further investigation. To begin with, while IS researchers demonstrate the influence of security countermeasures on employee security behaviour, the results of these studies are inconsistent and therefore require further clarification [START_REF] D'arcy | A review and analysis of deterrence theory in the IS security literature: Making sense of the disparate findings[END_REF]. Several IS researchers suggested that the influence of deterrent factors may vary under the impact of other aspects [START_REF] Son | Out of fear or desire? Toward a better understanding of employees' motivation to follow IS security policies[END_REF]. A literature review conducted for this project revealed a limited amount of studies that investigate the influence of deterrent factors in combination with cultural aspects. Furthermore, cross-cultural studies are particularly rare in Behavioural InfoSec research, although prior research shows that national culture (NC) has an effect on organisational behaviour [START_REF] Pavlou | What drives electronic commerce across cultures? A crosscultural empirical investigation of the theory of planned behavior[END_REF][START_REF] Dinev | User behaviour towards protective information technologies: the role of national culture differences[END_REF]. Finally, Hu et al. [START_REF] Hu | Managing employee compliance with information security policies: the role of top management and organizational culture[END_REF] report that there is a general lack of studies that examine the effect of organisational culture (OC) on employee security behaviour and existing studies fail to illustrate strong theoretical foundations for linking OC and behaviour.

This research in progress addresses the aforementioned literature gaps and attempts to answer the following research questions: 1. How do organisational culture values affect employee security behaviour? 2. How does national culture affect employee security behaviour? 3. How do security countermeasures affect employee security behaviour? This is a cross-cultural study conducted in the USA and Ireland. As is commonly the situation with comparative international studies, the initial choice of these two countries was more opportunistic than deliberate, arising as it did out of a research exchange programme which necessitated the lead author spending extended periods of time in both countries. Nevertheless, although the cultures of both Ireland and the USA are often referred in the extant literature as "Western", these two countries have similar as well as contrasting cultural characteristics [START_REF] Hofstede | Culture's Consequences: International Differences in Work-related Values[END_REF] and therefore are worthy of comparison. Additionally, Ireland is an important commercial gateway between the USA and Europe, it being the location of the European headquarters of several American multinational corporations. Ireland is situated at the interface of two rather different perspectives on privacy and data protection (i.e. EU versus USA), which is a further reason why a cross-cultural study between Ireland and the USA is a useful undertaking.

Theoretical Context

Fig. 1. Theoretical framework.

Culture

The study of culture is rooted in sociology, social psychology, and anthropology [START_REF] Ali | Culture and IS: National Cultural Dimensions within IS Discipline[END_REF].

Culture has been studied for over a hundred years in various disciplines. As a result, numerous definitions, conceptualisations, and dimensions of culture have been produced by researchers. For example, Kroeber and Kluckhohn [START_REF] Kroeber | Culture: A critical review of concepts and definitions[END_REF] identify 164 definitions of culture. They range from simple to complex, incorporate and extend previous definitions, and even contradict prior definitions. Consequently, viewpoints on culture vary significantly. For example, some scholars perceive culture as a hidden or partly hidden force and therefore culture is problematic to assess as it is not directly observable [START_REF] Baker | Managing organizational culture[END_REF]. In contrast, DeLong and Fahey [START_REF] Delong | Diagnosing cultural barriers to knowledge management[END_REF] argue that culture embraces explicit and observable artifacts and therefore can be assessed.

The two most commonly used theoretical frameworks of culture are the sociocultural system and the individual system [START_REF] Ali | Culture and IS: National Cultural Dimensions within IS Discipline[END_REF]. Taking the socio-cultural perspective, Mead [START_REF] Mead | National character[END_REF] defines culture as "shared patterns of behaviour". This definition implies that "culture is a group-level construct, situated between the personality of individuals and the human nature that is common to all of us" [13, p. 549]. Groups like societies, organisations and professions are considered to have their own cultures. Hence, studying culture entails more than observing and describing behaviour. On the other hand, the individual perspective treats culture as "an individual's characteristic way of perceiving the man-made part of one's environment" [18, p.3]. This definition assumes that culture can be assessed by analysing an individual's behaviour [START_REF] Ali | Culture and IS: National Cultural Dimensions within IS Discipline[END_REF].

For the purpose of this research, culture is regarded as follows: 1. Culture is explicit and therefore can be observed. 2. Culture can be assessed by analysing an individual's behaviour.

Organisational Culture and Security Behaviour

Prior research shows that OC affects behaviour. For example, Kilmann [START_REF] Kilmann | Managing your organization's culture[END_REF] describes culture as a separate and hidden force that controls behaviours and attitudes in organisations. Furthermore, Philips [START_REF] Phillips | Industry mindsets: Exploring the cultures of two macro-organizational setting[END_REF] portrays culture as a set of tacit assumptions that guide acceptable perceptions, thoughts, feelings, and behaviour among members of the group. Finally, Baker [START_REF] Baker | Managing organizational culture[END_REF] emphasises the importance of OC as a power that can lead a company to success or weaken its vitality because OC directly affects employee behaviour in an organisation. While the aforementioned studies show a link between OC and behaviour, this subject area has received very little attention in Behavioural InfoSec research. A literature review conducted for this study revealed a general lack of OC studies in the security context.

National Culture and Security Behaviour

Various academic works show that NC influences organisational behaviour. In particular, Hofstede [START_REF] Hofstede | Culture's Consequences. Comparing Values, Behaviors, Institutions, and Organizations Across Nations.3rd Edition[END_REF] argues that organisations are bound by national cultures and underlines the cross-national differences in the functioning of organisations and people in them. He compares culture with an onion consisting of multiple layers, values being the inner layer of the onion, which are invisible until they become evident in behaviour. Ali and Brooks [START_REF] Ali | Culture and IS: National Cultural Dimensions within IS Discipline[END_REF] define NC as a shared set of core values, norms and practices in a society that shapes individuals' behaviour within that society. However, cross-cultural research in Behavioural InfoSec is particularly scarce and urgent calls for more studies have been made [START_REF] Pavlou | What drives electronic commerce across cultures? A crosscultural empirical investigation of the theory of planned behavior[END_REF]. For example, Dinev et al. [START_REF] Dinev | User behaviour towards protective information technologies: the role of national culture differences[END_REF] report differences in user behaviour toward protective information technologies in the USA and South Korea. Flores et al. [START_REF] Flores | Information security knowledge sharing in organizations: Investigating the effect of behavioral information security governance and national culture[END_REF] state that the effect of behavioural information security governance factors on the establishment of security knowledge sharing differs between Swedish and the USA organisations.

Cross-Cultural Dimensions. Hofstede's [START_REF] Hofstede | Culture's Consequences: International Differences in Work-related Values[END_REF] original taxonomy describes culture in terms of four dimensionspower distance, uncertainty avoidance, masculinity vs. femininity, and individualism vs. collectivism. The score difference between the USA and Ireland's individualism vs. collectivism dimension is 21. Thus, it may be possible to explain the effect of NC on employee security behaviour from the perspective of the national trait of individualism. According to Hofstede [START_REF] Hofstede | Culture's Consequences: International Differences in Work-related Values[END_REF], the United States has a highly individualistic culture, which affects relationships between individuals. For example, in the USA people typically take care of themselves and their immediate family. On the contrary, Irish people normally take into consideration group as well as individual interests. Propensity towards individualism or collectivism in a society can have an impact on organisational affairs. For example, Zhang et al.'s [START_REF] Zhang | The Impact of Individualism-Collectivism, Social Presence, and Group Diversity on Group Decision Making under Majority Influence[END_REF] study conducted in the United States and China, reveal that the level of majority influence (i.e. the attempt by the majority of group members to impose their common position on group dissenters during group decision making) on group minorities appears to be stronger in collectivist societies. Furthermore, Hofstede [START_REF] Hofstede | Culture's Consequences: International Differences in Work-related Values[END_REF] points out that the level of individualism in society will affect the organisational members' reasons for complying with organisational rules and regulations. For example, in Ireland, peer pressure may have a stronger effect on employee security behaviour than in the USA. Furthermore, Hofstede [12, p.217] claims that national characteristics have a strong affect on the "nature of relationships between a person and the organisation to which she or he belongs". Regardless of the nature of business, organisations in different countries vary in terms of organisational structures and processes [START_REF] Hofstede | Culture's Consequences: International Differences in Work-related Values[END_REF]. Mintzberg [START_REF] Mintzberg | Structure in fives: Designing effective organizations[END_REF] stresses that five distinct coordinating mechanisms explain the fundamental ways in which organisations manage their work, including mutual adjustment, direct supervision, standardisation of work processes, standardisation of work outputs, and standardisation of worker skills. These mechanisms form an organisational structure. Hofstede [START_REF] Hofstede | Culture's Consequences: International Differences in Work-related Values[END_REF] argues that typically Irish organisations employ a mutual adjustment mechanism for coordinating activities and form a structure of adhocracy, in which the support staff is the key part. Mutual adjustment achieves the coordination of work by a simple process of informal communication and control of the work rests in the hands of the doers [START_REF] Mintzberg | Structure in fives: Designing effective organizations[END_REF]. On the other hand, the structure of the United States organisations takes a divisionalised form, based on standardisation of outputs, in which the middle line is the key part. Typically, American firms standardise outputs by setting specific goals and results [START_REF] Hofstede | Culture's Consequences: International Differences in Work-related Values[END_REF]. Prior studies show that employees tend to circumvent security rules when put under pressure to meet deadlines [START_REF] Besnard | Computer security impaired by legitimate users[END_REF]. Therefore, factors that impel employees to break security rules may be different in the United States and Ireland due to different organisational structures.

Security Countermeasures and Security Behaviour

With the increasing occurrence of computer abuse by employees, organisations are searching for improved ways to deter it. According to the General Deterrence Theory (GDT), organisations can increase employee compliance with information security rules by implementing deterrence mechanisms, including technical controls, information security policies, and security education, training and awareness programmes [START_REF] D'arcy | User awareness of security countermeasures and its impact on information systems misuse: A deterrence approach[END_REF][START_REF] Lee | An integrative model of computer abuse based on social control and general deterrence theories[END_REF]. Deterrence theory is one of the most widely applied theories in IS security research [START_REF] Pavlou | What drives electronic commerce across cultures? A crosscultural empirical investigation of the theory of planned behavior[END_REF]. Rooted in criminology [START_REF] Beccaria | On Crimes and Punishment[END_REF], the classic deterrence theory posits that individuals weigh costs and benefits before committing a crime. If an individual believes that the risk of getting caught is high and that penalties will be applied if caught, then GDT states that the individual will not commit the crime. D'Arcy et al. [START_REF] D'arcy | User awareness of security countermeasures and its impact on information systems misuse: A deterrence approach[END_REF] present an extended deterrence theory model and report that security countermeasures such as security policies, awareness programmes, and computer monitoring influence perceived severity of formal sanctions, which leads to reduced intention to misuse IS, while certainty of formal sanctions does not have any effect on intention to misuse IS. Furthermore, Lee et al. [START_REF] Lee | An integrative model of computer abuse based on social control and general deterrence theories[END_REF] show that deterrencebased countermeasures, including information security policy, security education and training awareness programmes, and security systems, directly influence security behaviour in organisations. In contrast, Herath and Rao [START_REF] Herath | Encouraging information security behaviors in organizations: role of penalties, pressures and perceived effectiveness[END_REF] report that perceived severity of penalties has significant but negative effect on security policy compliance intention. Additional studies inform that deterrence constructs do not have a significant influence on employee behaviour [START_REF] Siponen | Neutralization: new insights into the problems of employee information systems security policy violations[END_REF]. Overall, the extant literature provides inconsistent findings for deterrence theory in the information security context. Therefore, an additional examination of the influence of deterrence measures on actual behaviour is needed.

Research Methodology

The methodology adapted for this study draws on the analytical grounded theory (AGT) approach [START_REF] Matavire | Profiling grounded theory approaches in information systems research[END_REF], employing the constant comparative method of Maykut and Morehouse [START_REF] Maykut | Beginning Qualitative Research: A Philosophic and Practical Guide[END_REF]. This methodological framework draws on the work of Lincoln and Guba [START_REF] Lincoln | Naturalistic Inquiry[END_REF]. While none of the grounded theory principles were directly employed, nevertheless this project adapts a grounded theory approach insofar as the findings of this study are entirely rooted in the data. The AGT is the method of applying grounded theory analytical (constant comparative method) to analyse data without a necessity to follow grounded theory principles. For example, a researcher may start with prior theory, then go on to collect empirical data, and analyse it using grounded theory coding techniques.

The constant comparative method is particularly appropriate for this research project because both OC and NC can be investigated within a single study. Due to similar characteristics, it may be hard to separate traits of OC and NC. For example, hierarchy in an organisation could be a result of a bureaucratic culture within the organisation [START_REF] Wallach | Individuals and organizations: The cultural match[END_REF] or the effect of a NC trait of high power distance [START_REF] Hofstede | Culture's Consequences: International Differences in Work-related Values[END_REF]. A constant comparative method allows to overcome this challenge by first performing in-case analysis to analyse data within each country and then cross-case analysis to compare results between two research settings.

Data collection was carried out using semi-structured in-person interviews. Interviews are suitable to study behaviour [START_REF] Maykut | Beginning Qualitative Research: A Philosophic and Practical Guide[END_REF] because interview participants are given an opportunity to describe their past experiences and incidents. Company selection for this project was partly opportunistic. Organisations from a diverse set of industries were selected. Using personal connections, seven companies were interviewed in the United States from September to November 2012, and eight companies in Ireland from June to August 2013. Details about US and Irish companies are given in Table 1 andTable 2 The interview guide was constructed following a thorough analysis of the literature. The guide included questions about OC values and security countermeasures and their relationships with employee security behaviour. A list of the most prominent OC frameworks used in IS research was borrowed from Leidner and Kayworth's [START_REF] Leidner | Review: A review of culture in information systems research: Toward a theory of information technology culture conflict[END_REF] work. Due to the evident similarity, these values were grouped into categories, including Solidarity, Sociability, People-Orientation, Task-Orientation, Rule-Orientation, and Hierarchy.

With regards to security countermeasures, various classification have been offered by IS researchers on deterrent mechanisms. This research adapts D'Arcy et al.'s [START_REF] D'arcy | User awareness of security countermeasures and its impact on information systems misuse: A deterrence approach[END_REF] taxonomy of security countermeasures, suggesting the following four topics for the interview guide -Employee Awareness, Information Security Policy, Information Security Training, and Technical Controls. Interview guide topics including corresponding references and questions are illustrated in Table 3.

Preliminary Findings

Data analysis is currently ongoing but a number of interesting preliminary results have emerged:

Organisational Culture Values and Security Behaviour

So far, preliminary results suggest that OC impacts upon employee security behaviour. CivEngCo is a bureaucratic organisation where rules and discipline prevail, and segregation between management and regular employees exists.

Employees in this organisation generally comply with rules. A Civil Engineer, who is also an ambitious and creative individual, informs: "…typically, employees conform with information security rules".

However, this is an organisation with established procedures and practices and normally higher management is reluctant to except new ideas and change traditional ways of conducting business. A motivated and striving employee would find it hard to survive in this type of environment. The same Civil Engineer shares her disappointment:

"I remember, one time I really wanted to change the design methodology…the manager of the project did not accept it but I had my supervisor backing me up… so we made a big meeting-fight…it was a very tough meeting…and finally I could convince them to change their approach... the type of practice they do is too old… and these old managers…it is so hard to change their minds…" Furthermore, the same Civil Engineer adds that the fact that she cannot challenge management's decision discourages her and negatively affects every aspect of her job, including compliance with information security rules:

"…If I lose my motivation, it affects everything, in particular the quality of job that I do, such as how I archive things, how I back up things, how I care about everything, including organisation in general and security in particular. Of course, it affects everything".

EducOrg demonstrates similar traits of organisational culture, where ambitious employees are not encouraged to strive because promotions are scarce and some managers have a reputation of treating employees improperly. Since a promotion may entail a migration to a different department managed by an unfair manager, staff is reluctant to apply. Additionally, due to internal politics, promotions are not distributed justly. As a result, this atmosphere creates a lax attitude towards information security:

"…For the last few years there have not been too many opportunities to be promoted…but if a promotion is coming up, I feel I don't stand a chance…I am happy in the place I am at the moment…if I go somewhere else, it might be like walking on a frying pan…Right now there is an opportunity for a promotion but I would not go there because a lot of managers in this department have a reputation of treating staff really, really, really badly. And this atmosphere creates a lax attitude towards sensitive information…the attitude is "it's not my job".

On the contrary, in CloudSer there is an environment where employees are welcome to express their opinions and contribute to various aspects of company's functioning. Employees are encouraged to provide feedback regarding information security rules and in some instances, they are trusted to make independent decisions as this organisation does not have rigid rules and procedures. A Software Developer reveals:

"…a security team designs and implements an information security policy…however, there have been instances when software engineers did not agree with certain aspects of the policy…for example, two-factor authentication…but there is a communication channel…we talked it out and agreed that two-factor authentication is vital… but if I felt a requirement was too restrictive and I could not challenge it, I would really view my security policy differently…but the fact that I can challenge, changes my opinion…I feel I can contribute…I feel it is participative…I do not feel excluded…" "…in terms of security rules, nobody has tried to violate the rules…we have a fairly relaxed environment in terms of security rules…there is a lot of trust which is placed on the employees to make the right choices..."

RetCo is a financial organisation, where employees also are encouraged to provide feedback regarding security rules and changes have been made in the past based on this feedback. Staff are proud to work for this organisation. Subsequently, employees comply with organisational rules. A Security Executive Officer reports:

"…I think in our organisation some of those unwritten assumptions would be that everybody matters in the organisation, so everybody has an opinion and equal voice…people are very proud to work here…and as a result, there is this assumption that everybody is going to conduct themselves in a manner that is appropriate for that value...they are happy to be there and working there…" "…I have not heard personally of any instance where somebody has broken a rule, a fixed rule…"

The above analysis leads us to conclude that OC affects employee security behaviour. A flat organisational structure and employees' involvement in a company's life have a positive effect on employee compliance with information security rules. However, employee-management segregation, poor management, and an unjust treatment of employees lead to disappointment and ultimately to a lax attitude towards information security.

National Culture and Security Behaviour

Although findings reveal that employees break rules in organisations in both countries, group non-compliance with rules in Ireland is more prevalent than in the United States. Besides, a larger amount of incidents was recorded in Irish organisations than in the United States. A Security Executive of an Irish financial institution shares the following: "…I would like to be a bit stricter on some of the rules. Sometimes, after implementing a certain security measure, someone in a managerial position may ask to have an access to something that is forbidden to access…the rules should be there for everybody…and they are not…once certain people ask, I have to circumvent the rule…the rule is broken then. At the moment, really senior people want to have access to Twitter…that will be another battle…"

An IT manager from BevCorp further confirms that rules get broken collectively in Ireland:

"…I think breaking rules is kind of an Irish thing…'sure that rule does not apply to me because I have a good excuse or I can reason myself out of why I did not follow the rules'… I have definitely seen rules being broken…and the level of acceptance for that from peers…it is not like one person did it and everyone was shocked…they are not going to tell on somebody as well…"

Finally, a Software Developer at TelCommCorp verifies that Irish employees break rules as a group:

"…One of my colleague's laptop was stolen from her work desk…I think there is a policy that if you leave your laptop at work, you are supposed to chain it to the desk…she did not anyway and I never do…I leave my laptop there every evening and I do not lock it…and a lot of people leave their laptops at work without locking them…the general attitude is: 'if it is robbed, it is not my problem…it is company's security is lacking' "

In the United States, however, employees seem to be breaking rules individually and collectively. A Civil Engineer from CivEngCo shares:

"…If I like the organisation, then I follow their security rules, of course. If I get disappointed with the organisation, then I don't care about anything, one of them would be security"

A Security Researcher from TechCorp adds: "…My laptop is sitting on my desk upstairs and I am not supposed to leave it…so this is an example of a rule I have broken today…My laptop should be in a hibernated mode…I don't hibernate it, I usually just suspend it, so this is a violation of the policy" Finally, a Professor from EducInst adds: "…At EducInst we break rules all the time…When was the day I didn't break a rule?...Let me give you an example…a student needs a resource…there is a lot of rules about handling and allocating…I might just cut through them and make sure that a student gets the resource…and I am not interested about whether the right form is being filled out"

As can be seen from the above quotes, in Irish organisations breaking rules at a group level is more prevalent than in the United States.

Security Countermeasures and Security Behaviour

Results A Security Consultant from FinCo adds: "…I think information security policy creates a framework that people shape their day-to-day work around".

Finally, Security Executive from RetCo further confirms:

"…training affects employees' behaviour…an alternative way to educate employees is to remind them of the safe security practices by sending notifications and bulletins…I think this is another way employees interact with information security policy and it affects how they do their jobs…" Generally, the above quotes suggest that procedural security countermeasures positively affect employee security behaviour in organisational settings.

Conclusion

Preliminary results indicate that security countermeasures, OC, and NC impact upon employee security behaviour in organisational settings. In terms of OC, in the organisations where employees are empowered to make changes and express their opinion, staff compliance with security rules is prevalent. However, in organisations where employees are discouraged to implement new ideas and employee-management segregation exists, security rules get broken. Wallach [START_REF] Wallach | Individuals and organizations: The cultural match[END_REF] labels culture based on power and control as bureaucratic. Organisations, where bureaucracy prevails, are resistant to implement changes. Therefore, a strong bureaucratic culture is unlikely to attract and retain creative and ambitious people [START_REF] Wallach | Individuals and organizations: The cultural match[END_REF]. On the contrary, in companies with supportive culture, employees are involved in organisation's matters and are given power to speak up. Supportive culture promotes employee autonomy, which leads to improved overall performance of an organisation [START_REF] Shrednick | Empowerment: key to is world-class quality[END_REF]. Hence, if an organisation explicitly states that information security is its vital function, employees will be inclined to comply with rules.

Regarding NC, employee security behaviour in organisations in the United States and Ireland shows slightly different patterns. In particular, in the United States, employee security actions are driven by a combination of factors, including individual interests and group aspects. However, in Ireland, collective disobedience with security rules is more prevalent. The influence of peer pressure may be stronger in Ireland as opposed to the United States due to the difference in the score on individualism. Interestingly, Zhang et al.'s [START_REF] Zhang | The Impact of Individualism-Collectivism, Social Presence, and Group Diversity on Group Decision Making under Majority Influence[END_REF] work demonstrate that in collectivist China the pressure from group's majority influence on minorities is stronger than in the United States. Therefore, security practitioners may need to focus on group participant-led security trainings in collectivist countries as oppose to computerised security tests performed individually.

Security countermeasures, including security policy, awareness programmes, and security training encourage employee compliance with security rules. These deterrent countermeasures serve as important guidelines for employees to distinguish between appropriate and inappropriate actions. When employee are aware of company's security etiquette, they are less likely to engage in illicit behaviour, which is consistent with results reported by D'Arcy et al. [START_REF] D'arcy | User awareness of security countermeasures and its impact on information systems misuse: A deterrence approach[END_REF]. Hence, companies are advised to have in place deterrent countermeasures. Overall, based on the aforementioned findings, this research in progress has a potential to make a valuable contribution to research and practice.

Table 1 .

 1 . Facts about US companies

	Name
	(aliases)

Industry type? When founded, size? Number of people interviewed and their organisational roles

	PublCo	Publishing; 2005; SME	One person -a business owner
	CloudSer	IT; 1998; large	One person -a software developer
	RetCo	Finance; 1932; large	One person -a security executive
	CivEngCo	SME Civil Engineering; 1945;	One person -a civil engineer
	TechCorp	IT; 1968; large	Two security researchers
	EducInst	Education; 1868; large	Two people -an administrator and a lecturer with substantial industry experience in the security field
	FinCo	Finance; 1982; large	One person -a security consultant

Table 2 .

 2 Facts about Irish companies

	Name	Industry type? When	Number of people interviewed and their
	(aliases)	founded, size?	organisational roles
	TechCorp	IT; 1968; large	Two people -a product manager and an IT executive
	CharOrg	Charity; 1883; large	One person -a data protection officer
	BevCorp	Manufacturing; 1944; large Food and Beverage	One person -an IT executive
	PublOrg	Publishing; 2000; SME	One person -a chief editor
	EducOrg	Education; 1845; large	Two people -an administrator and a lecturer with substantial experience in information security research
	TelCommCorp IT; 1984; large	One person -a software developer
	ResReg	SME Energy Regulation; 1999;	One person -a policy analyst
	BankOrg	Finance; 1982; large	One person -a security executive

Table 3 .

 3 Interview guide topics

	Topics	Reference	Examples of questions
	Organisational Culture
	Solidarity	Goffee and Jones [34]	Do you ever voluntary work overtime in order to complete some important task?
	Sociability	Goffee and Jones [34]	Is it common to have non-work related chats with your colleagues during work hours?
	People-orientation	Cooke and Lafferty [35]	How satisfying is the you are working for with respect to employee benefits?
	Task-orientation	Cooke and Lafferty [35]	Do you think management expects you to put company goals before your personal goals?
	Rule-orientation	Denison and Mishra [36]	Is it acceptable to break rules in your organisation?
	Hierarchy	Ouchi [37]	Is it common in your organisation to disagree with your superior's opinion/decision?


Fredrik Karlsson

Göran Goldkuhl
email: goran.goldkuhl@liu.se

Karin Hedström

Practice-Based Discourse Analysis of InfoSec Policies

Keywords: Information security policy, Discourse Analysis, Communicative Analysis, Quality criteria

Employees' poor compliance with information security policies is a perennial problem for many organizations. Existing research shows that about half of all breaches caused by insiders are accidental, which means that one can question the usefulness of information security policies. In order to support the formulation of practical, from the employees' perspective, information security policies, we propose eight tentative quality criteria. These criteria were developed using practice-based discourse analysis on three information security policy documents from a health care organisation.

Introduction

Information and information systems have become key assets in, for example, health care. Here is timely access to correct electronic medical records (EMR) essential in order to provide medical care of high quality. Consequently, the importance of information security increases; the confidentiality, availability and integrity of business information assets need to be kept at the level regulated by laws and public administration policies. It is argued that employees' poor compliance with information security policies is a perennial problem for many organizations [START_REF] Ernst | Global Information Security Survey[END_REF][START_REF] Ernst | Borderless security -Ernst & Young's 2010 Global Information Security Survey[END_REF]. Having said that, existing research also shows that about half of all breaches caused by insiders are accidental [START_REF] Vroom | Towards information security behavioural compliance[END_REF], which means that one can question how useful today's information security policies are in guiding employees. Despite the importance of information security policies the design of such artefacts is an understudied area of information security research in general [START_REF] Baskerville | An information security meta-policy for emergent organizations[END_REF]. Gaskell [START_REF] Gaskell | Simplifying the onerous task of writing security policies[END_REF], one of few who has studied the design process, has characterized the information security policy design process as ad-hoc.

The main input that information security managers draw upon during such a design process is elicited information security requirements and international security standards [START_REF]Information Technology -Secuirty Techniques -Code of Practice for Information Management Systems -Requirements[END_REF]. Standards are general guidelines not addressing the specific context of an organisation [START_REF] Baskerville | Information systems security design methods: Implications for information systems development[END_REF], such as the specific needs of healthcare, making the elicited requirements an important complement.

If few studies focus information security policy design, even fewer studies have been carried out on information security policies as communicative objects and what constitutes a useful information security policy from a communicative point of view. Stahl et al. [START_REF] Stahl | Information security policies in the UK healthcare sector: a critical evaluation[END_REF] is a notable exception, who based on a discourse analysis of information security policies provide six advices for the development of information security policies. Of course, this is a valuable contribution, but according to Baskerville's and Siponen's [START_REF] Baskerville | An information security meta-policy for emergent organizations[END_REF] taxonomy of information security policies, Stahl et al. [START_REF] Stahl | Information security policies in the UK healthcare sector: a critical evaluation[END_REF] mainly focus on high-level policies. With this focus they seem to leave out the problematic aspect that employees often are exposed to several documents that together constitute the information security policy.

We therefore take an explicit starting point in a practice-based perspective. This means that a) we critically assess the role of the information security policy as a practical tool in the employee's every day work, including the use of both high-level and low-level policy documents, and b) we acknowledge the fact that there exist multiple practices in an organisation that need to interact. To this end we view information security policy documents as the results of the interaction (or lack thereof) between the information security practice and the health care practice. Information security policy documents are in this setting thus seen as communicative objectives.

The purpose of this paper is a) to illustrate the usefulness of practice-based discourse analysis for understanding information security policy design, and b) to provide a set of tentative quality criteria for information security policy design in health care from a practice-based perspective. For this purpose, we carried out a case study at a Swedish emergency hospital. We employed a practice-based discourse analysis on the hospital's information security policy. A practice-based discourse analysis means besides collecting and analysing information security policy texts, that we also have studied the mentioned practices through observations and interviewing. The latter is important in order to interpret the communicative limitations of the policy from the employees' perspective. Hence, this research responds to the call for more research on employees' behaviour with respect to information security policies within health care [START_REF] De Lusignana | The roles of policy and professionalism in the protection of processed clinical data: A literature review[END_REF] and it focuses communicative aspects of the information security policy artefact, which is an even more understudied area. As far as we know there exist no quality criteria for information security policy design in health care anchored in a practice-based perspective.

Information security policy theories

An information security policy is a general rule for directing acceptable behaviour of employees when using an organisation's information assets [START_REF] Davis | Management information systems: conceptual foundations, structure, and development[END_REF]; they provide information security management with a vehicle for establishing information security practices in organisations [START_REF] Von Solms | From policies to culture[END_REF]. Given the strategic importance of information assets it is nowadays stressed that information security management should be integrated into corporate governance [START_REF] Von Solms | Corporate Governance and Information Security[END_REF]. The executive management at the strategic level outlines a set of directives to indicate the importance of information assets, which are operationalized through the organisation's information security policy design. While information security governance research fail to offers detailed guidance on how to develop information security policies [e.g. 13], there exists practitioner-oriented literature that do [START_REF] Peltier | Information security policies and procedures -a practitioner's reference[END_REF][START_REF] Wood | Information security policies made easy. Information Shield[END_REF]. However, this literature focuses on design guidelines without reflecting on the end products' usefulness from an employee perspective. Scholarly studies about information security policy design exist as well. Gaskell [START_REF] Gaskell | Simplifying the onerous task of writing security policies[END_REF] and Sibley [START_REF] Sibley | Experiments in organizational policy representation: resuls to date[END_REF] have described the information security policy formulation as an ad-hoc process, although, for example, Wood [START_REF] Wood | Writing InfoSec Policies[END_REF] has stressed the importance of a well thought out design process. It is common in information security literature to recommend that this process should be informed by information security standards [START_REF] Gaskell | Simplifying the onerous task of writing security policies[END_REF][START_REF] Janczewski | Managing Security Functions Using Security Standards[END_REF]. However, the use of information security standards has been criticised, since they do not take into account that organisations differ [START_REF] Baskerville | An information security meta-policy for emergent organizations[END_REF][START_REF] Baskerville | Information systems security design methods: Implications for information systems development[END_REF], and Wood [START_REF] Wood | Writing InfoSec Policies[END_REF] argued that 'one must understand the special needs of an organization before one attempts to generate specific written management directives'. Knapp et al. [START_REF] Knapp | Information security policy: An organizational-level process model[END_REF] provided a more balanced view when proposing that both external and internal aspects of an organisation should influence information security policy work.

Research on techniques for eliciting local information security requirements [e.g. 20, 21] make a valuable contribution in such cases. Although there is a large body of research on information security policy, and much consensus can be found with regard to the importance of information security policies, less attention has been given to how to design the content of these policies. Wood [START_REF] Wood | Writing InfoSec Policies[END_REF] provided guidelines for the information security policy design process, arguing that different audiences often require tailored policies. Baskerville and Siponen [START_REF] Baskerville | An information security meta-policy for emergent organizations[END_REF] explored the design of information security policies, but their conclusions are limited to emerging organisations. Doherty et al. [START_REF] Doherty | The information security policy unpacked: A critical study of the content of university policies[END_REF] stated that 'there are very few studies that explicitly address how the scope or content of information security policies support the employee in their daily work.' They concluded that there is a wide diversity of disparate policies in use and that they contain a low degree of detail. A somewhat broader take on how to design information security policy content also shows a debate about the ideal number of policies in an organisation and how they should be inter-related [e.g. [START_REF] Baskerville | An information security meta-policy for emergent organizations[END_REF][START_REF] Siponen | Policies for construction of information systems' security guidelines[END_REF]. However, Lindup [START_REF] Lindup | The Role of Information Security in Corporate Governance[END_REF] has noted that in practice organisations often have one single information security policy.

In summary, existing research stresses the importance of congruent communication, and that information security policies should align both with business strategies and international standards. However, we found few empirical studies that address the communicative quality of information security policies. One exception is the study by Stahl et al. [START_REF] Stahl | Information security policies in the UK healthcare sector: a critical evaluation[END_REF] who present six advices on how to design an information security policy, based on a critical discourse analysis of twenty-five information security policies.

Research approach

3.1

The study object and its implication on overall research strategy

The research approach taken in this study is discourse analysis [START_REF] Potter | Discourse and social psychology. Beyond attitudes and behaviour[END_REF]. Discourse in an open sense 'cover all forms of spoken interaction, formal and informal, and written texts of all kind' (ibid p 7). An inter-textual analysis is a natural element of discourse analysis. So is also an action perspective: 'Texts … do not just describe things; they do things.' (ibid p 6; emphasis in original). A discourse analysis of an information security policy will study how different text elements relate to each other; how well they congruently build up the whole text. The discourse analysis will also focus how the text is intended to influence the regulated practice and how it succeeds to comply with governing statements of higher order (standards and regulations). A discourse analysis of this kind is qualitative and interpretive with the purpose to reveal meanings of inter-textual and efficacious character. As a practice-based discourse analysis, we have besides collection and analysis of the information security policy texts also studied the mentioned practices through observations and interviewing.

Case study and data collection

This study is as a case study [START_REF] Yin | Case study research: design and methods[END_REF], and the analysis is based on a reading of three documents that regulate the information security practice in one medium-size Swedish county council. The information security policy consists of one high-level policy document, and two low-level documents that more in detail describe information security instructions and rules. The findings in these documents were complemented with interviews with three high-level information security managers. The interviews gave us deeper knowledge about the county council's information security policies and how they were designed. In order get an understanding of the type of practice we studied, we selected one hospital within the county council for studies of information security policy compliance and translation in practice. We chose a hospital with about 750 employees, 142 places of treatment that serves around 90 000 citizens. Two clinics at the hospital were chosen as cases based on their different degrees of computerization of patient information: one clinic had manual handling of medical records; the other has used an EMR system for a number of years. This variety was important for providing us with rich data concerning information security in both light and heavy computerized settings, both of which are common in health care. We carried out twenty-four semi-structured interviews with health care staff (e.g., nurses, physicians, administrators) at the two clinics. The interviews lasted between one and two hours and concerned how information security were translated and carried out in practice, together with the reasons for the information security actions. The interviews were tape-recorded and transcribed. We complemented the interviews with 28 hours of observations of the information security practice. The observations were documented by note-taking and, when appropriate, by photographs (for example, how medical record were stored). The interviews and observations taken together gave us deeper knowledge about how information security was integrated in the health care practice.

During observations we focused on the same categories as during the interviews, i.e., areas regulating the information security practice. This resulted in re-interviewing and further probing about the rationality for information security actions in practice.

A conceptual framework for practice-based discourse analysis

We characterize this type of discourse analysis as practice-based. A practice is considered to be "embodied, materially mediated arrays of human activity centrally organized around shared practical understanding" [27, p 2]. This means that language and discourse is part of a practice. A practice consists of humans and their activities including material and semiotic elements. Thus, a study of documents (as e.g. information security policies) cannot be made without taking into account the practices where these documents are generated and used. Three important influences to be used in discourse analysis have been suggested: a semiotic understanding of different language functions; a speech act-based understanding of utterances; an ethnomethodological understanding of conversation. Consequently, they have stated these demands, but they have not synthesised and operationalised these theoretical orientations into a coherent approach for discourse analysis. Within information systems research there exists several studies that use different linguistic theories, but usually only one such theory at a time. Goldkuhl [START_REF] Goldkuhl | The many facets of communication -a socio-pragmatic conceptualisation for information systems studies[END_REF] has presented a socio-pragmatic communication framework adapted to studies in information systems. It is a synthesis of speech act theory [e.g. 29], ethnomethodological conversation analysis [START_REF] Sacks | Lectures on conversation[END_REF] and semiotics [e.g. 31]. Goldkuhl's [START_REF] Goldkuhl | The many facets of communication -a socio-pragmatic conceptualisation for information systems studies[END_REF] framework consists of nine communicative functions. It emphasises a multi-functional view of language and communication, i.e. we do several things at the same time while communicating. The nine functions are shown in Table 1 together with an explanation of each function, and the analytical questions we have used to assess each function. What is meant?

Carried

The message is using the features of some medium.

How? By what means? Constitutive

The message creates changes in social states between communicators and sometimes socially broader.

What is done?

Directed

The message is intended towards one or more addressees.

To whom?

Expressive

The message is an expression of the locutor's (the one who says the speech act) subjectivity (e.g. desires, emotions, values).

By whom?

Referential

The message is saying something about something in the world.

About what?

Presituationally compliant

The message is in accordance with general institutions and norms and specific presituational grounds.

Why? What reasons there?

Projected future actions

The message is an initiative for further actions.

For what?

Situationally responsive

The message is a response to prior messages and other situational features.

Why? What reasons there?

We have modified the terminology of two functions (carried, constitutive) in order to make them more intelligible. In our discourse analysis we have selected seven of these functions to use for our study of the information security policy. We have not used the functions of carried (since it is sufficient with a general characterization that policies are written documents), or situationally responsive (since the demand to write a policy has been excluded from our analysis).

Analytical steps

A classical dilemma and choice in empirical social research is how to be open-minded vs. to be informed by previous theories in relation to the data material. In our study we used both strategies. We studied the text in an inductive and open-minded way, and then in the further analysis of the text we applied Goldkuhl's [START_REF] Goldkuhl | The many facets of communication -a socio-pragmatic conceptualisation for information systems studies[END_REF] framework in a theory-informed way. We have adopted an inquiry attitude [START_REF] Dewey | Logic: The theory of inquiry[END_REF], i.e. searched for and recorded what seems problematic in some way from a communicative point of view.

In our case these principles meant the following. First, the information security policy has been read through and we have noticed all things that caught our attention as being communicatively problematic. We made an open coding of data through this reading [START_REF] Corbin | Basics of qualitative research[END_REF], just stating what kind problems or other peculiarities we identified. This means that we have selected a set of policy declarations and made annotations to be used for further analysis. Second we carried out the theory-informed discourse analysis using the results from the open coding as input. The theory-informed analysis in our case meant employing the analytical questions in Table 1. Furthermore, in order to carry out this step the interviews and observations were necessary background information. We used this information to interpret the policy declarations (when asking the analytical questions) from an employee's point of view, since a practice-based discourse analysis of an information security policy requires taking into account the practice where it is used. For example, we used this background understanding when interpreting what the confidentiality instructions meant for the medical secretaries when they are to fax patient information to another care provider. The information security policy stated that 'Patients should be confident that sensitive information does not reach unauthorized'. A second guideline was the following: 'Whatever form the information has, or the way in which it is transmitted or stored, it must always receive adequate protection.' When reading these statements we concluded that the instructions were directed (to whom?) towards the medical secretaries. However, the instructions were vague when it came to projected future actions (for what?).

Our interviews and observations revealed that the instructions were interpreted as follows by the staff: First, the medical secretary checked whether or not the care provider requesting the medical record had the patient's consent or not, either documented in the medical records or provided by the inquiring part. Second, the medical secretary removed the social security number from the physical medical record. This was done to anonymise the medical record when sending it via fax. Third, she/he added a temporary code, for example 2020. Finally, after faxing the medical secretary called her/his contact person at the requesting care provider in order to tell the temporary code. However, this set of actions was difficult to understand of from only reading the information security policy.

The third step was carried out to organise the analysed policy declarations into overall themes. These themes, which were inductively generated, are to be seen as broader problem areas based on the detailed analysis. We ended up with four themes of importance for design of practical communicative information security policies: external congruence, goal conflicts, internal congruence, and target group. These themes were used when constructing the tentative quality criteria, which are found in Section 4.2.

4

From discourse analysis to tentative quality criteria

At the hospital the employees had to deal with three different information security policy documents that together constituted the information security policy. One document contained a high-level description of the information security regulations, while additional two documents contained low-level descriptions. The presentation below is structured according to the thematic analysis we carried out. The analysis was brought further through the formulation of eight tentative quality criteria (Section 4.2). Table 2 shows examples from our analysis. The table has three columns. The left-most column contains identifiers referring to the policy documents. Passages from the high-level document are referred to using 1.x, while the two low-level documents are referred to as 2.x and 3.x. The second column shows the policy declarations. Finally, the right-most column contains the analysis. Due to the limited space we only present the communicative functions that were considered problematic when analysing the policy declarations.

Thematic analysis of information security policy

Internal congruence is our first theme. This theme includes concerns about projected future actions that arise from incomplete explanations and definitions, inconsistent use of terminology, inconsistent communicative function, inconsistent description of the information security mechanisms in use, inconsistent description of the same rule and unclear references between the different information security policy documents. The incomplete explanations and definitions found in the three policy documents can be exemplified with passage 2.7 in Table 2. This quote refers to 'sensitive information' that must be removed from the hard drive before the computer is handed over to external service. However, none of the three investigated policy documents contains a definition of 'sensitive information'. In addition, the same document also includes the term 'business critical information' which is never defined and the differences between these categories are not accounted for. It results in a lack of guidance of the employees due to lack of definitions. Passage 1.4 in Table 2 is to some extent related to the use of definitions, however it is an example of inconsistent use of terminology once it is introduced. This passage gives the impression that information security is achieved through 'information security policies, guidelines, and instructions', which means that technical measures are not necessary. However, it contradicts, for example, passage 2.6 and 2.11 that clearly contain references to technical security controls. It is also contradicts other references to the existence of technical security controls, such as password controls: 'Do not reveal your password to others, or lend out your authorization'. Consequently, the first and second policy documents give different impressions of what types of information security measures that are needed, and also how the most fundamental concept in the policy, information security, is defined. The three documents have inconsistent communicative functions. Information security management switches from being regulative to in some parts being educational. As discussed in Section 2 the main purpose of a policy is limiting acceptable behaviour of employees, meaning that its primary communicative function is to be regula-tive. Of course, it is sometimes necessary to educate employees, but the two types of communicative functions are highly intertwined in the documents, without clear indication which communicative function that is in focus. For example, the detailed instructions on how to lock a workstation (Passage 2.6), is followed by an educational passage on why functionality to log the employees' activities is used: 'Logging of activities and transactions are carried out in order to continuously monitor the security of the IT systems. The purpose is to trace important events if disturbances occur in the systems. Tracing is also used to free the innocent, and discover threats to the information security.' Another educational passage in the document is a discussion on malware: 'code in the form of viruses, trojans, or worms could damage, distort or destroy information, or make sensitive information available to persons not allowed to see the information … Malware can be said to be software'.

In addition, Passage 2.6 is also an example of how the available information security mechanisms are described using an inconsistent level of abstraction. This specific passage is a very clear and detailed instruction compared to a passage similar to the following one, which is found sentences earlier: 'Remember that you are responsible for everything that is registered with your user identity.' Hence, from an employee's point it becomes difficult to understand the role of the document. Passages 3.5 and 3.7 are examples of inconsistent descriptions of the same rule. In this case it concerns if the employee are allowed to store sensitive information on 'the local hard drive'. In passage 3.5 the regular user is not allowed to store sensitive information on the computer. While, passage 3.7 states that such information should only 'in exceptional cases be saved on the local hard drive'. This is an inconsistent description, where the employees are left in the dark on how to act. Finally, as discussed earlier the investigated information security policy consists of three documents, and they contain references to each other. But the naming of the documents is not consistent (2.17), which means that it is difficult for the employees to find the right related document. For example, the 'Information security policy'-document is referred to as the IT-policy in the 'Security instructions for county council IT users'-document.

Target group is the second theme, which covers the problem of ambiguous addressees in three policy documents. Passage 2.7 in Table 2 shows one such case. As discussed above, the example concerns how to handle the computer when it is handed over to a third, external, part for service. However, the regulation is ambiguous. In the first part of the example, there is a focus on 'you' as the addressee: 'If your personal computer is handed over -for external services, you must ensure that any sensitive information is removed from the hard drive'. But in the next sentence it is at the same time the responsibility of the organisation, which means that it is not the employee's responsibility. Finally, the third sentence reads 'IT Support provides software for cleaning and can assist with clean-up', which yet again signals that it is the employee's responsibility. A second example of ambiguous addresses is passage 2.10: 'Information classification should be performed according to documented rules for classification of information.' Information classification is carried out in order to determine the right level of information security measure. It is normally an activity of information security management or general management. If employees would carry out this activity they might start neglecting existing information security measure based on their own classifications. Consequently, it is not evident who the information security management is actually regulating, which in the end means that an ambiguous responsibility is constituted.

External congruence is the third identified theme. In several occasions the three policy documents reference other documents such as laws, regulation, or standards. However, the congruence with these sources is not clear. Passage 1.4 claims, as discussed earlier, that information security is achieved through 'information security policies, guidelines, and instructions.' Hence it is a focus on administrative routines, neglecting technical, physical and informal information security. The same document refers to the ISO-standard 17799, which does not described information security as something to be addressed by administrative means only. Another problem with the information security policy documents is that information security management references laws and regulations in general, without specifying exactly which laws and regulations (Passage 1.3). Consequently, it is difficult for the employees to know exactly which laws and regulations they are to pay attention to.

Goal conflicts are the fourth and final theme we identified. The three investigated policy documents included a number of goal conflicts. Passage 1.2 concerns the tension between protection of human life and health on one hand, and protection of patient information, i.e. privacy, on the other. In the policy document it is stated that 'protection of human life, health and privacy are valued the most.' Another example of conflicting goals is the following which is found in passage 2.1: 'In addition to legal requirements, there are additional demands from organisations and the public, stating that information must be correct, it must be available and must be handled with respect to privacy or publicity.' In this case the tension is between privacy and publicity. A third example is passage 2.11 gives advises 'for management of information'. However, these advises are not directed towards employees only. From an employee's point of view it is contradictory that information should not be stored on the local disc, but at the same time backup should always be taken. In all these cases the information security management leaves the employees without any guidance on how to choose between the conflicting goals.

Towards tentative quality criteria

The practice-based discourse analysis of this case material has revealed problems with the information security policy. The analysis has aimed for abstraction and four themes have been formulated. These abstracted themes (designating problematic areas in the information security policy) were used for articulating general expectations on policy features. The underlying assumption in our work is that an information security policy should be functional in regulating employees' actions with respect to information security. The policy documents must be comprehensive and useful in guiding employees' actions. The discourse analysis has been a generative basis for formulation of tentative quality criteria for information security policies in health care. The quality criteria express what is considered a good information security policy in health care, i.e. they express positive design values. We have formulated them as criteria that can be useful both in a design/formulation situation and in an evaluation situation. Our criteria cover both the whole information security policy (possibly consisting of different documents of both high-level and low-level character) and different parts of such policy documents.

Quality criteria:

1. The information security policy shall not introduce goal conflicts. We identified several goal conflicts (1.2, 2.1) that the employees were left to manage. The policy was ambiguous with regard to employee prioritization. Theme: goal conflicts. 2. External policies shall be translated and transformed to the current work practice when such parts are included in the information security policy. Our analysis (1.3) showed that parts of laws and international standards were included in the policy without paying attention to the local context, or that only vague references were provide to laws. Theme: external congruence. showed an ambiguous use of concepts, where several concepts were used for the same phenomenon. As a consequence, the policy was ambiguous when referring to phenomena in the work practice. Theme: internal congruence. 6. The information security policy (in whole and parts) shall have a clear structure.

Our analysis (2.7, 2.17) showed ambiguously structured documents where phenomena concerning the same target group were discussed at multiple places. Thus it was difficult for employees to know when they had assimilated all information concerning a specific phenomenon. Theme: internal congruence. 7. The information security policy (in whole and parts) shall have clear objectives; implying clear communicative functions of the document. Our analysis (2.6) showed that the communicative functions of specific parts of the documents were unclear (regulative and educational sections are highly intertwined). Making it difficult to identify regulatory instructions. Theme: internal congruence. 8. The information security policy shall be constitutively clear; clarifying responsibilities and social commitments and expectations. The analysis (2.10) showed that the responsibilities of the employees were unclear. Hence, it was difficult to achieve accountability. Theme: target group.

Conclusions

An information security policy of high communicative quality has the potential to be a practical and useful tool for information security management. The purpose of this paper was a) to illustrate the usefulness of practice-based discourse analysis for un-derstanding information security policy design, and b) to provide a set of tentative quality criteria for information security policies in health care from a practice perspective. Based on a practice-base discourse analysis that includes high-level and low-level information security policy documents we suggest eight quality criteria for design of information security policies in health care. Our findings are based on one case study. We therefore see interesting venues for future research to further validate the criteria and make them more precise. Another research task is to investigate if any of these criteria are applicable in other business sectors, and if so to what extent. Our quality criteria have, to some extent, similarities with the criteria presented by Stahl et al. [START_REF] Stahl | Information security policies in the UK healthcare sector: a critical evaluation[END_REF]. If we are to highlight one similarity, both studies stress the importance of using a clear and congruent conceptual framework adapted to the current work practice.

Otherwise, the policies are not accessible to the employees. However, unlike Stahl et al. [START_REF] Stahl | Information security policies in the UK healthcare sector: a critical evaluation[END_REF] our quality criteria also address the importance of the structure of policy documents. This difference is a result from Stahl et al.'s [START_REF] Stahl | Information security policies in the UK healthcare sector: a critical evaluation[END_REF] choice to limit their study to high-level policies, whereas we studied both high-level and low-level policy documents and their relationships. The criteria presented are all derived from a practicebased perspective. It means that they emphasize information security policies as useful tools for employees. This perspective represents an alternative and a contrast to the management perspective. When designing information security policies both perspectives need to be acknowledged in order to create a balanced solution. Our list of quality criteria is one important component in the discussion to find such a balance.

Table 1 .

 1 Goldkuhl's [28] framework of communicative functions

	Communicative	Explanation	Analytical
	function		question
	Accountable	The message is comprehensible, i.e. include
		sufficient self-references and arguments to
		explain its role in the communication process.

Table 2 .

 2 Practice-based discourse analysis of information security policy

	No	Policy declaration	Analysis
	1.2	'Information security must protect	Pre-situational grounds: Based on
		patients, employees and the public	health law and security standards.
		from harm caused by deficiencies	Accountable: A goal conflict between
		in information management or dis-	health and privacy is built into this
		ruption in information systems. The	policy statement. Projected future
		protection of human life, health and	actions: There is no guidance to users
		privacy are valued the most.'	for choice between conflicting goals.
	1.3	'Laws and regulations shall consti-	Pre-situational grounds: Difficulties
		tute the lowest level when specify-	to know which laws and regulations
		ing security measures and controls.'	one is to pay attention to. Projected
			future actions: Risk that laws and
			regulations are neglected.
	1.4	'Information security is achieved by	Pre-situational grounds: Lack of
		developing and complying with	compliance with standards; neglect of
		appropriate management tools such	technical, physical and informal secu-
		as information security policies,	rity. Accountable: Contradictory to
		guidelines, and instructions.'	other statements including technical
			security. Projected future actions:
			Risk of neglecting measures (e.g.
			technical).
	2.6	'If you leave your work place, you	Accountable: Very clear and detailed
		must lock the PC using the "Ctrl-	instruction implies a shift in the text
		Alt-Del" or log out, even if it is just	from abstract explanations to concrete

  3. The information security policy (or explicit parts thereof) shall have clear and uniformed user groups. The analysis (2.7) showed that it was unclear who were affected by the instructions. Theme: target group. 4. The information security policy shall contain congruent guidelines for actions that are well adapted to the current work practice. The analysis (2.6, 3.5, 3.7) showed that instructions are provided at a general level, which left room for interpretation on how to implement the guidelines in the work practice. Theme: internal congruence. 5. The information security policy shall have a clear and congruent conceptual framework adapted to the current work practice. The analysis (1.4, 2.6, 2.11)