{"id":"https://openalex.org/W7160551475","doi":"https://doi.org/10.1016/j.cose.2026.104957","title":"An integrated framework for information security risk management: A mixed-methods systematic literature review","display_name":"An integrated framework for information security risk management: A mixed-methods systematic literature review","publication_year":2026,"publication_date":"2026-05-07","ids":{"openalex":"https://openalex.org/W7160551475","doi":"https://doi.org/10.1016/j.cose.2026.104957"},"language":"en","primary_location":{"id":"doi:10.1016/j.cose.2026.104957","is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.cose.2026.104957","pdf_url":null,"source":{"id":"https://openalex.org/S12529635","display_name":"Computers & Security","issn_l":"0167-4048","issn":["0167-4048","1872-6208"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Computers & Security","raw_type":"journal-article"},"type":"review","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://doi.org/10.1016/j.cose.2026.104957","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5123484449","display_name":"Biju B. Varghese","orcid":null},"institutions":[{"id":"https://openalex.org/I155173764","display_name":"Rochester Institute of Technology","ror":"https://ror.org/00v4yb702","country_code":"US","type":"education","lineage":["https://openalex.org/I155173764"]}],"countries":["US"],"is_corresponding":true,"raw_author_name":"Biju B Varghese","raw_affiliation_strings":["Rochester Institute of Technology, 105 Lomb Memorial Drive, Rochester, NY 14623, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Rochester Institute of Technology, 105 Lomb Memorial Drive, Rochester, NY 14623, USA","institution_ids":["https://openalex.org/I155173764"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5135623491","display_name":"Quang Bui","orcid":null},"institutions":[{"id":"https://openalex.org/I155173764","display_name":"Rochester Institute of Technology","ror":"https://ror.org/00v4yb702","country_code":"US","type":"education","lineage":["https://openalex.org/I155173764"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Quang Neo Bui","raw_affiliation_strings":["Rochester Institute of Technology, 105 Lomb Memorial Drive, Rochester, NY 14623, USA"],"raw_orcid":"https://orcid.org/0000-0003-0319-5934","affiliations":[{"raw_affiliation_string":"Rochester Institute of Technology, 105 Lomb Memorial Drive, Rochester, NY 14623, USA","institution_ids":["https://openalex.org/I155173764"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5123484449"],"corresponding_institution_ids":["https://openalex.org/I155173764"],"apc_list":{"value":3190,"currency":"USD","value_usd":3190},"apc_paid":{"value":3190,"currency":"USD","value_usd":3190},"fwci":5.5238,"has_fulltext":false,"cited_by_count":1,"citation_normalized_percentile":{"value":0.95314427,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":94,"max":97},"biblio":{"volume":"168","issue":null,"first_page":"104957","last_page":"104957"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.7059999704360962,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.7059999704360962,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11800","display_name":"User Authentication and Security Systems","score":0.006899999920278788,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T13585","display_name":"Technostress in Professional Settings","score":0.005100000184029341,"subfield":{"id":"https://openalex.org/subfields/3207","display_name":"Social Psychology"},"field":{"id":"https://openalex.org/fields/32","display_name":"Psychology"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/systematic-review","display_name":"Systematic review","score":0.7689999938011169},{"id":"https://openalex.org/keywords/information-security","display_name":"Information security","score":0.5515999794006348},{"id":"https://openalex.org/keywords/risk-assessment","display_name":"Risk assessment","score":0.36010000109672546},{"id":"https://openalex.org/keywords/information-security-management","display_name":"Information security management","score":0.3467000126838684},{"id":"https://openalex.org/keywords/security-information-and-event-management","display_name":"Security information and event management","score":0.3287999927997589},{"id":"https://openalex.org/keywords/information-system","display_name":"Information system","score":0.32850000262260437},{"id":"https://openalex.org/keywords/information-security-audit","display_name":"Information security audit","score":0.2962000072002411}],"concepts":[{"id":"https://openalex.org/C189708586","wikidata":"https://www.wikidata.org/wiki/Q1504425","display_name":"Systematic review","level":3,"score":0.7689999938011169},{"id":"https://openalex.org/C527648132","wikidata":"https://www.wikidata.org/wiki/Q189900","display_name":"Information security","level":2,"score":0.5515999794006348},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5400000214576721},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.4916999936103821},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3779999911785126},{"id":"https://openalex.org/C12174686","wikidata":"https://www.wikidata.org/wiki/Q1058438","display_name":"Risk assessment","level":2,"score":0.36010000109672546},{"id":"https://openalex.org/C56739046","wikidata":"https://www.wikidata.org/wiki/Q192060","display_name":"Knowledge management","level":1,"score":0.34790000319480896},{"id":"https://openalex.org/C148976360","wikidata":"https://www.wikidata.org/wiki/Q1662500","display_name":"Information security management","level":5,"score":0.3467000126838684},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.3386000096797943},{"id":"https://openalex.org/C103377522","wikidata":"https://www.wikidata.org/wiki/Q3493999","display_name":"Security information and event management","level":4,"score":0.3287999927997589},{"id":"https://openalex.org/C180198813","wikidata":"https://www.wikidata.org/wiki/Q121182","display_name":"Information system","level":2,"score":0.32850000262260437},{"id":"https://openalex.org/C39358052","wikidata":"https://www.wikidata.org/wiki/Q2578632","display_name":"Information security audit","level":5,"score":0.2962000072002411},{"id":"https://openalex.org/C47309137","wikidata":"https://www.wikidata.org/wiki/Q7598357","display_name":"Standard of Good Practice","level":5,"score":0.28929999470710754},{"id":"https://openalex.org/C32896092","wikidata":"https://www.wikidata.org/wiki/Q189447","display_name":"Risk management","level":2,"score":0.2865999937057495},{"id":"https://openalex.org/C80212096","wikidata":"https://www.wikidata.org/wiki/Q1975416","display_name":"Systematic risk","level":2,"score":0.2856999933719635},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.27390000224113464},{"id":"https://openalex.org/C180823521","wikidata":"https://www.wikidata.org/wiki/Q1662502","display_name":"Certified Information Security Manager","level":5,"score":0.26179999113082886},{"id":"https://openalex.org/C10511746","wikidata":"https://www.wikidata.org/wiki/Q899388","display_name":"Data security","level":3,"score":0.2583000063896179},{"id":"https://openalex.org/C168167062","wikidata":"https://www.wikidata.org/wiki/Q1117970","display_name":"Component (thermodynamics)","level":2,"score":0.25049999356269836}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1016/j.cose.2026.104957","is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.cose.2026.104957","pdf_url":null,"source":{"id":"https://openalex.org/S12529635","display_name":"Computers & Security","issn_l":"0167-4048","issn":["0167-4048","1872-6208"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Computers & Security","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1016/j.cose.2026.104957","is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.cose.2026.104957","pdf_url":null,"source":{"id":"https://openalex.org/S12529635","display_name":"Computers & Security","issn_l":"0167-4048","issn":["0167-4048","1872-6208"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Computers & Security","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":221,"referenced_works":["https://openalex.org/W1418086826","https://openalex.org/W1482734477","https://openalex.org/W1494380913","https://openalex.org/W1533444565","https://openalex.org/W1562591834","https://openalex.org/W1602619638","https://openalex.org/W1767272795","https://openalex.org/W1901676853","https://openalex.org/W1968259381","https://openalex.org/W1970809283","https://openalex.org/W1977934076","https://openalex.org/W1980867644","https://openalex.org/W1983107693","https://openalex.org/W1987708126","https://openalex.org/W1988269019","https://openalex.org/W1994065885","https://openalex.org/W1994736698","https://openalex.org/W1997368701","https://openalex.org/W1997603734","https://openalex.org/W2002554683","https://openalex.org/W2003325641","https://openalex.org/W2005115103","https://openalex.org/W2006553501","https://openalex.org/W2008556210","https://openalex.org/W2010130012","https://openalex.org/W2010219174","https://openalex.org/W2010902645","https://openalex.org/W2012270501","https://openalex.org/W2022556651","https://openalex.org/W2033213440","https://openalex.org/W2038889476","https://openalex.org/W2039649206","https://openalex.org/W2041531944","https://openalex.org/W2044935933","https://openalex.org/W2047078960","https://openalex.org/W2049561176","https://openalex.org/W2052202336","https://openalex.org/W2055083533","https://openalex.org/W2055228381","https://openalex.org/W2058012887","https://openalex.org/W2058640412","https://openalex.org/W2068448350","https://openalex.org/W2069245363","https://openalex.org/W2069700160","https://openalex.org/W2077186047","https://openalex.org/W2078862361","https://openalex.org/W2081046118","https://openalex.org/W2081526168","https://openalex.org/W2082000139","https://openalex.org/W2083449279","https://openalex.org/W2087952459","https://openalex.org/W2088489410","https://openalex.org/W2088949480","https://openalex.org/W2093675962","https://openalex.org/W2093847211","https://openalex.org/W2105992541","https://openalex.org/W2108752510","https://openalex.org/W2110107793","https://openalex.org/W2115747715","https://openalex.org/W2118686998","https://openalex.org/W2122413203","https://openalex.org/W2123258673","https://openalex.org/W2123709218","https://openalex.org/W2136557300","https://openalex.org/W2144958981","https://openalex.org/W2145780580","https://openalex.org/W2149739119","https://openalex.org/W2157635163","https://openalex.org/W2164539034","https://openalex.org/W2167857801","https://openalex.org/W2171848390","https://openalex.org/W2181301463","https://openalex.org/W2194585282","https://openalex.org/W2208596391","https://openalex.org/W2224736605","https://openalex.org/W2228454395","https://openalex.org/W2256804265","https://openalex.org/W2279335550","https://openalex.org/W2300663785","https://openalex.org/W2419134065","https://openalex.org/W2464676481","https://openalex.org/W2484621096","https://openalex.org/W2522809986","https://openalex.org/W2523582669","https://openalex.org/W2528464937","https://openalex.org/W2568368320","https://openalex.org/W2586235276","https://openalex.org/W2592485682","https://openalex.org/W2618836391","https://openalex.org/W2635209627","https://openalex.org/W2741843521","https://openalex.org/W2750549214","https://openalex.org/W2767228426","https://openalex.org/W2769702554","https://openalex.org/W2771171736","https://openalex.org/W2772187867","https://openalex.org/W2774443158","https://openalex.org/W2775217505","https://openalex.org/W2775363016","https://openalex.org/W2791256229","https://openalex.org/W2792347597","https://openalex.org/W2792367957","https://openalex.org/W2793040514","https://openalex.org/W2794377947","https://openalex.org/W2800109782","https://openalex.org/W2800303425","https://openalex.org/W2811298882","https://openalex.org/W2887214859","https://openalex.org/W2902249052","https://openalex.org/W2910462204","https://openalex.org/W2912138667","https://openalex.org/W2914361790","https://openalex.org/W2918538338","https://openalex.org/W2921968294","https://openalex.org/W2942627819","https://openalex.org/W2949728573","https://openalex.org/W2949753004","https://openalex.org/W2952139221","https://openalex.org/W2952851936","https://openalex.org/W2953283735","https://openalex.org/W2953546037","https://openalex.org/W2960346492","https://openalex.org/W2964308319","https://openalex.org/W2964377962","https://openalex.org/W2969293349","https://openalex.org/W2969616889","https://openalex.org/W2972615700","https://openalex.org/W2980376449","https://openalex.org/W2980954528","https://openalex.org/W2981056651","https://openalex.org/W2982102463","https://openalex.org/W2982205235","https://openalex.org/W2995282616","https://openalex.org/W3006161904","https://openalex.org/W3023334423","https://openalex.org/W3026414489","https://openalex.org/W3048380493","https://openalex.org/W3081158861","https://openalex.org/W3100572823","https://openalex.org/W3107036873","https://openalex.org/W3111685778","https://openalex.org/W3118615836","https://openalex.org/W3119385088","https://openalex.org/W3125354632","https://openalex.org/W3125949797","https://openalex.org/W3132822841","https://openalex.org/W3134754575","https://openalex.org/W3134966463","https://openalex.org/W3140039291","https://openalex.org/W3146559281","https://openalex.org/W3159273989","https://openalex.org/W3159576697","https://openalex.org/W3172479169","https://openalex.org/W3186154954","https://openalex.org/W3204475660","https://openalex.org/W3206387060","https://openalex.org/W3212315332","https://openalex.org/W3215879207","https://openalex.org/W4200121490","https://openalex.org/W4200596777","https://openalex.org/W4206128287","https://openalex.org/W4210773992","https://openalex.org/W4210871527","https://openalex.org/W4225420285","https://openalex.org/W4225422860","https://openalex.org/W4229375717","https://openalex.org/W4231759480","https://openalex.org/W4238226847","https://openalex.org/W4238779927","https://openalex.org/W4249649471","https://openalex.org/W4281838014","https://openalex.org/W4282564355","https://openalex.org/W4285155372","https://openalex.org/W4286509932","https://openalex.org/W4288434504","https://openalex.org/W4292541737","https://openalex.org/W4293083238","https://openalex.org/W4293213168","https://openalex.org/W4294192137","https://openalex.org/W4298110867","https://openalex.org/W4302307770","https://openalex.org/W4306973757","https://openalex.org/W4307162417","https://openalex.org/W4308340166","https://openalex.org/W4318337934","https://openalex.org/W4319593278","https://openalex.org/W4321480393","https://openalex.org/W4322622874","https://openalex.org/W4362635414","https://openalex.org/W4377823785","https://openalex.org/W4378594123","https://openalex.org/W4385562826","https://openalex.org/W4385755118","https://openalex.org/W4386356462","https://openalex.org/W4387341418","https://openalex.org/W4387428525","https://openalex.org/W4388019211","https://openalex.org/W4388197773","https://openalex.org/W4390941783","https://openalex.org/W4391179367","https://openalex.org/W4391934842","https://openalex.org/W4392849751","https://openalex.org/W4394812907","https://openalex.org/W4396626004","https://openalex.org/W4396835078","https://openalex.org/W4396851448","https://openalex.org/W4401750943","https://openalex.org/W4403924938","https://openalex.org/W4404619565","https://openalex.org/W4406088155","https://openalex.org/W4406109322","https://openalex.org/W4406632554","https://openalex.org/W4407246124","https://openalex.org/W4407610936","https://openalex.org/W4407792200","https://openalex.org/W4407909867","https://openalex.org/W4409535409","https://openalex.org/W4411343132","https://openalex.org/W4412648645","https://openalex.org/W4412650851","https://openalex.org/W4414348565"],"related_works":[],"abstract_inverted_index":{"Driven":[0],"by":[1],"escalating":[2],"threats":[3],"and":[4,36,45,66,101,114,136],"regulatory":[5],"scrutiny,":[6],"information":[7],"security":[8],"risk":[9],"management":[10],"(ISRM)":[11],"is":[12],"now":[13],"a":[14,74,84],"strategic":[15,137],"imperative":[16],"for":[17],"organizations":[18],"across":[19,59],"the":[20,129],"industrial":[21],"spectrum.":[22],"Although":[23],"prior":[24],"literature":[25,58,77],"reviews":[26,50],"offer":[27],"valuable":[28],"insights":[29],"into":[30,104],"ISRM":[31,57],"subdomains,":[32],"they":[33],"remain":[34],"fragmented":[35],"overly":[37],"reliant":[38],"on":[39],"manual":[40],"methods,":[41],"limiting":[42],"their":[43],"scope":[44],"scalability.":[46],"Additionally,":[47],"only":[48],"limited":[49],"have":[51],"been":[52],"able":[53],"to":[54,124],"comprehensively":[55],"synthesize":[56],"its":[60],"three":[61,109],"foundational":[62],"pillars:":[63],"processes,":[64],"governance,":[65],"strategy.":[67],"To":[68],"address":[69],"this":[70],"gap,":[71],"we":[72],"conduct":[73],"large-scale":[75],"systematic":[76],"review":[78],"of":[79,131],"623":[80],"ISRM-related":[81],"articles":[82],"using":[83],"mixed-methods":[85],"approach":[86],"which":[87],"combines":[88],"natural":[89],"language":[90],"processing":[91],"techniques":[92],"with":[93],"thematic":[94,99],"analysis.":[95],"We":[96],"identify":[97],"22":[98],"clusters":[100],"aggregate":[102],"them":[103],"an":[105],"integrated":[106,119],"framework":[107,120],"comprising":[108],"interdependent":[110],"perspectives:":[111],"Technical,":[112],"Socio-Behavioral,":[113],"Strategic":[115],"&":[116],"Governance.":[117],"Our":[118],"bridges":[121],"disciplinary":[122],"silos":[123],"inform":[125],"research":[126],"opportunities":[127],"at":[128],"intersection":[130],"technical":[132],"controls,":[133],"human":[134],"behavior,":[135],"oversight.":[138]},"counts_by_year":[{"year":2026,"cited_by_count":1}],"updated_date":"2026-08-13T07:04:57.449891","created_date":"2026-05-08T00:00:00"}