Implementing international standards for Information Security Management in China and Europe: a comparative multi-case study

The leading international standards for information security management, ISO/IEC 27001 and ISO/IEC 27002, originate from the UK but are applied world-wide. Although the technology used is identical, the institutional and cultural settings are different. This paper explores whether the processes of selection, implementation and use of these interrelated standards differ between China and Europe. We have studied cases of Chinese and European companies. Main differences relate to governance and management of standard adoption. This study is innovative in 1) the method used for standardisation research (comparative multi-case-study, and distinguishing selection, implementation, use and impact of the standard), 2) the topic: implementation and impact of information security management standards, and 3) the geographic area: both China and Europe.