{"id":"https://openalex.org/W4248078407","doi":"https://doi.org/10.1109/cr.2018.8626831","title":"A Conceptual Framework of IT Security Governance and Internal Controls","display_name":"A Conceptual Framework of IT Security Governance and Internal Controls","publication_year":2018,"publication_date":"2018-11-01","ids":{"openalex":"https://openalex.org/W4248078407","doi":"https://doi.org/10.1109/cr.2018.8626831"},"language":"en","primary_location":{"id":"doi:10.1109/cr.2018.8626831","doi":"https://doi.org/10.1109/cr.2018.8626831","is_oa":false,"landing_page_url":"https://doi.org/10.1109/cr.2018.8626831","pdf_url":null,"source":{"id":"https://openalex.org/S4306418145","display_name":"Cyber Resilience Conference","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2018 Cyber Resilience Conference (CRC)","raw_type":"proceedings-article"},"volume":null,"type":"conference-paper","is_traditional":true,"indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5110528759","display_name":"Nadianatra Musa","orcid":"https://orcid.org/0009-0005-6577-2049","observed_orcids":["https://orcid.org/0009-0005-6577-2049"]},"institutions":[{"id":"https://openalex.org/I41461413","display_name":"Universiti Malaysia Sarawak","ror":"https://ror.org/05b307002","country_code":"MY","type":"education","lineage":["https://openalex.org/I41461413"]}],"countries":["MY"],"is_corresponding":true,"raw_author_name":"Nadianatra Musa","raw_affiliation_strings":["Faculty of Computer Science and Information Technology, Universiti Malaysia Sarawak (UNIMAS), Kota Samarahan, Malaysia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Faculty of Computer Science and Information Technology, Universiti Malaysia Sarawak (UNIMAS), Kota Samarahan, Malaysia","institution_ids":["https://openalex.org/I41461413"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5110528759"],"corresponding_institution_ids":["https://openalex.org/I41461413"],"apc_list":null,"apc_paid":null,"fwci":0.8008,"has_fulltext":false,"cited_by_count":16,"citation_normalized_percentile":{"value":0.73069909,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":87,"max":98},"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"4"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11572","display_name":"Information Technology Governance and Strategy","score":0.6547999978065491,"subfield":{"id":"https://openalex.org/subfields/1404","display_name":"Management Information Systems"},"field":{"id":"https://openalex.org/fields/14","display_name":"Business, Management and Accounting"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},"topics":[{"id":"https://openalex.org/T11572","display_name":"Information Technology Governance and Strategy","score":0.6547999978065491,"subfield":{"id":"https://openalex.org/subfields/1404","display_name":"Management Information Systems"},"field":{"id":"https://openalex.org/fields/14","display_name":"Business, Management and Accounting"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.34299999475479126,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T13034","display_name":"Information Systems Education and Curriculum Development","score":0.0005000000237487257,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/internal-control","display_name":"internal control","score":0.9229999780654907},{"id":"https://openalex.org/keywords/board-engagement","display_name":"board engagement","score":0.6380000114440918},{"id":"https://openalex.org/keywords/corporate-governance","display_name":"corporate governance","score":0.6380000114440918},{"id":"https://openalex.org/keywords/malaysian-listed-firms","display_name":"Malaysian listed companies","score":0.5410000085830688},{"id":"https://openalex.org/keywords/conceptual-framework","display_name":"conceptual framework","score":0.8489999771118164}],"concepts":[{"id":"https://openalex.org/C39389867","wikidata":"https://www.wikidata.org/wiki/Q380767","display_name":"Corporate governance","level":2,"score":0.6632130146026611},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.6191450357437134},{"id":"https://openalex.org/C14224292","wikidata":"https://www.wikidata.org/wiki/Q13600188","display_name":"Conceptual framework","level":2,"score":0.5501722097396851},{"id":"https://openalex.org/C2778348171","wikidata":"https://www.wikidata.org/wiki/Q167037","display_name":"Corporation","level":2,"score":0.5415210723876953},{"id":"https://openalex.org/C178148461","wikidata":"https://www.wikidata.org/wiki/Q1632136","display_name":"Security controls","level":3,"score":0.4875938296318054},{"id":"https://openalex.org/C2775924081","wikidata":"https://www.wikidata.org/wiki/Q55608371","display_name":"Control (management)","level":2,"score":0.45945674180984497},{"id":"https://openalex.org/C189922023","wikidata":"https://www.wikidata.org/wiki/Q17056348","display_name":"Information governance","level":4,"score":0.4592364728450775},{"id":"https://openalex.org/C527648132","wikidata":"https://www.wikidata.org/wiki/Q189900","display_name":"Information security","level":2,"score":0.45498931407928467},{"id":"https://openalex.org/C195094911","wikidata":"https://www.wikidata.org/wiki/Q14167904","display_name":"Process management","level":1,"score":0.4493213891983032},{"id":"https://openalex.org/C121955636","wikidata":"https://www.wikidata.org/wiki/Q4116214","display_name":"Accounting","level":1,"score":0.44119778275489807},{"id":"https://openalex.org/C2780257311","wikidata":"https://www.wikidata.org/wiki/Q2563977","display_name":"Senior management","level":2,"score":0.4331565797328949},{"id":"https://openalex.org/C83163435","wikidata":"https://www.wikidata.org/wiki/Q3954104","display_name":"Security management","level":2,"score":0.42185115814208984},{"id":"https://openalex.org/C148976360","wikidata":"https://www.wikidata.org/wiki/Q1662500","display_name":"Information security management","level":5,"score":0.4133656919002533},{"id":"https://openalex.org/C56739046","wikidata":"https://www.wikidata.org/wiki/Q192060","display_name":"Knowledge management","level":1,"score":0.3808578848838806},{"id":"https://openalex.org/C103377522","wikidata":"https://www.wikidata.org/wiki/Q3493999","display_name":"Security information and event management","level":4,"score":0.3686087727546692},{"id":"https://openalex.org/C39549134","wikidata":"https://www.wikidata.org/wiki/Q133080","display_name":"Public relations","level":1,"score":0.32365041971206665},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.28579574823379517},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.24655196070671082},{"id":"https://openalex.org/C184842701","wikidata":"https://www.wikidata.org/wiki/Q370563","display_name":"Cloud computing security","level":3,"score":0.23802897334098816},{"id":"https://openalex.org/C180198813","wikidata":"https://www.wikidata.org/wiki/Q121182","display_name":"Information system","level":2,"score":0.1953866183757782},{"id":"https://openalex.org/C187736073","wikidata":"https://www.wikidata.org/wiki/Q2920921","display_name":"Management","level":1,"score":0.17842641472816467},{"id":"https://openalex.org/C17744445","wikidata":"https://www.wikidata.org/wiki/Q36442","display_name":"Political science","level":0,"score":0.16168466210365295},{"id":"https://openalex.org/C10138342","wikidata":"https://www.wikidata.org/wiki/Q43015","display_name":"Finance","level":1,"score":0.14016801118850708},{"id":"https://openalex.org/C29848774","wikidata":"https://www.wikidata.org/wiki/Q61905","display_name":"Management information systems","level":3,"score":0.13539931178092957},{"id":"https://openalex.org/C144024400","wikidata":"https://www.wikidata.org/wiki/Q21201","display_name":"Sociology","level":0,"score":0.1161314845085144},{"id":"https://openalex.org/C162324750","wikidata":"https://www.wikidata.org/wiki/Q8134","display_name":"Economics","level":0,"score":0.10709425806999207},{"id":"https://openalex.org/C79974875","wikidata":"https://www.wikidata.org/wiki/Q483639","display_name":"Cloud computing","level":2,"score":0.08065241575241089},{"id":"https://openalex.org/C199539241","wikidata":"https://www.wikidata.org/wiki/Q7748","display_name":"Law","level":1,"score":0.0},{"id":"https://openalex.org/C36289849","wikidata":"https://www.wikidata.org/wiki/Q34749","display_name":"Social science","level":1,"score":0.0},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/cr.2018.8626831","doi":"https://doi.org/10.1109/cr.2018.8626831","is_oa":false,"landing_page_url":"https://doi.org/10.1109/cr.2018.8626831","pdf_url":null,"source":{"id":"https://openalex.org/S4306418145","display_name":"Cyber Resilience Conference","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2018 Cyber Resilience Conference (CRC)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"display_name":"Peace, justice, and strong institutions","score":0.833299994468689,"id":"https://metadata.un.org/sdg/16"}],"study_designs":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":14,"referenced_works":["https://openalex.org/W134933374","https://openalex.org/W1498935721","https://openalex.org/W2006253146","https://openalex.org/W2041823363","https://openalex.org/W2070958191","https://openalex.org/W2080984042","https://openalex.org/W2100432931","https://openalex.org/W2119587968","https://openalex.org/W2122413203","https://openalex.org/W2516800336","https://openalex.org/W2761003679","https://openalex.org/W2801757732","https://openalex.org/W4395059149","https://openalex.org/W6605371790"],"related_works":["https://openalex.org/W1544515980","https://openalex.org/W2761003679","https://openalex.org/W7038735243","https://openalex.org/W3030106500","https://openalex.org/W2788375937","https://openalex.org/W2020980597","https://openalex.org/W2884235705","https://openalex.org/W2274099098","https://openalex.org/W1902494769","https://openalex.org/W2158905831"],"abstract_inverted_index":{"The":[0,129],"Board":[1],"and":[2,8,27,36,42,60,78,81,105,146],"senior":[3,61],"management":[4,62],"use":[5],"internal":[6,85],"controls":[7],"IT":[9,102,143],"risk":[10],"governance":[11],"to":[12,38,94,117,123],"ensure":[13],"that":[14,121],"the":[15,39,58,75,95,119,133,139],"corporation's":[16],"directives":[17],"such":[18],"as":[19],"security":[20,66,73],"policies,":[21],"standards,":[22],"procedures,":[23],"guidelines,":[24],"administrative":[25],"rules":[26],"practices":[28],"at":[29],"all":[30],"organizational":[31],"levels":[32],"are":[33],"properly":[34],"chosen":[35],"adapted":[37],"organization,":[40],"implemented":[41],"enforced.":[43],"There":[44],"were":[45,109,136],"three":[46],"research":[47],"problems":[48],"identified":[49],"in":[50,63,127,132],"this":[51],"paper,":[52],"(1)":[53],"Lack":[54],"of":[55,57,71,84,97,101,142],"involvement":[56],"board":[59],"understanding":[64],"IS/IT":[65,72,89,124],"problems,":[67],"(2)":[68],"unbalanced":[69],"implementation":[70],"within":[74],"Formal,":[76],"Technical":[77],"Informal":[79],"components":[80],"(3)":[82],"lack":[83],"control":[86],"applications":[87],"over":[88],"security.":[90],"This":[91],"had":[92],"led":[93],"development":[96],"a":[98],"conceptual":[99,140],"framework":[100,141],"Security":[103,125,144],"Governance":[104,126,145],"Internal":[106,147],"Controls.":[107,148],"Interviews":[108],"undertaken":[110],"with":[111,138],"eight":[112],"Malaysian":[113],"Publicly":[114],"Listed":[115],"Companies":[116],"identify":[118],"issues":[120],"relate":[122],"Malaysia.":[128],"findings":[130],"reported":[131],"data":[134],"analysis":[135],"consistent":[137]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":2},{"year":2024,"cited_by_count":4},{"year":2023,"cited_by_count":6},{"year":2022,"cited_by_count":1},{"year":2021,"cited_by_count":1},{"year":2020,"cited_by_count":1}],"updated_date":"2026-11-07T11:25:07.637180","created_date":"2022-05-12T00:00:00"}