Contribution of corporate social responsibility to information security management

Contemporary societies develop scepticism about the social responsibility of businesses. There are expectations that firms/corporations/industries/ companies make more than just economic contributions. In the area of information technology, more and more companies recognize their responsibility to promote information security management, above and beyond the level required by law, in order to achieve/build a secure information society for daily business operations. While concepts of Corporate Social Responsibility (CSR) have been applied to a plethora of sectors/industries, information security from the aspect of CSR is still behind in both theory and practice. The purpose of this paper is to apply the concept of CSR to the practice of information security management. The paper reviews and analyzes the theoretical background (definitions) of CSR from both practice and the literature and tries to explain what socially responsible management of information security actually is. © 2010 Elsevier Ltd. All rights reserved