digitallawJournal of Digital Technologies and LawJournal of Digital Technologies and Law2949-2483Kazan Innovative University named after V. G. Timiryasov10.21202/jdtl.2025.6xujvtmdigitallaw-512Research ArticleARTICLESСТАТЬИUniversal Information Security Governance System: Organizational and Legal PrinciplesУниверсальная система управления информационной безопасностью: организационно-правовые принципыhttps://orcid.org/0000-0002-3884-495XХадиМ. А.HadiM. A.

Хади Мусадак Ахмед – магистр наук (инженер систем управления), кафедра управления и системной инженерии

Аль-Вейда, г. Багдад

Musadaq Ahmed Hadi – MSc. (Control Engineer), Control and Systems Engineering Department

Al-Wehda, Baghdad

musadaq.ahmed@alshaab.edu.iqhttps://orcid.org/0009-0007-8441-3505АбдулредхаМ. Н.AbdulredhaM. N.

Абдулредха Мохаммед Наджм – магистр компьютерных наук, кафедра компьютерных наук

Аль-Джадрийя, г. Багдад

Mohammed Najm Abdulredha – MSc. (Computer Science), Department of Computer Science

Al-Jadriya, Baghdad

mohammed.najm.422@gmail.comТехнологический университетИракUniversity of TechnologyIraqБагдадский университетИракUniversity of BaghdadIraq20252703202531125–142Copyright © Hadi M.A., Abdulredha M.N., 20252025Хади М.А., Абдулредха М.Н.Hadi M.A., Abdulredha M.N.Данная работа распространяется под лицензией Creative Commons Attribution 4.0.This work is licensed under a Creative Commons Attribution 4.0 License.https://www.lawjournal.digital/jour/article/view/512Objective

Objective: to develop universal organizational and legal principles for building an information security governance system that will allow each organization to create its own effective information security governance system, taking into account its unique business goals and tasks.

Methods

Methods: the research integrates the key elements of information security governance, such as vision, strategy, goals, policies, standards, processes, and matrices. Vision and goals set the direction of an organization’s development; policies and standards provide a conceptual framework for information protection; processes allow for systematic achievement of objectives; and matrices provide tools for evaluating and monitoring the entire structure. The proposed principles are consistent with international 

standards, regulatory requirements, and best practices in the field of information security.

Results

Results: the research showed that the developed information security governance system allows for a clear distribution of roles and responsibilities among the employees, ensuring effective implementation of the governance system. The authors also analyzed the existing principles of information security, integrating them into a security strategy that meets the corporate goals. The proposed universal system complies with regulatory legal requirements and can be adapted for organizations of any scale and profile.

Scientific novelty

Scientific novelty: the paper represents a practical approach to the implementation of an information security governance system based on the authors’ experience, international standards, control systems and legal acts. Unlike existing approaches, the proposed system is flexible and can be adapted to any organization, which makes it a universal tool for information security governance.

Practical significance

Practical significance: the research provides a structured approach to creating a universal information security governance system that can be used by organizations lacking knowledge and resources to implement such initiatives. The authors propose a general structure that can be adapted depending on the organization’s assets, the employees’ training and awareness of information security issues. This makes the paper a valuable resource for professionals seeking to increase information security in their organizations.

Цель

Цель: разработка универсальных организационно-правовых принципов построения системы управления информационной безопасностью, которые позволят каждой организации создать собственную эффективную систему управления информационной безопасностью с учетом ее уникальных бизнес-целей и задач.

Методы

Методы: основаны на интеграции ключевых элементов управления информационной безопасностью, таких как видение, стратегия, цели, политики, стандарты, процессы и матрицы. Видение и цели задают направление развития организации, политики и стандарты обеспечивают концептуальную основу для защиты информации, процессы позволяют систематически достигать поставленных задач, а матрицы предоставляют инструменты для оценки и контроля всей структуры. Предложенные принципы согласуются с международными стандартами, нормативными требованиями и лучшими практиками в области информационной безопасности.

Результаты

Результаты: разработанная система управления информационной безопасностью позволяет четко распределить роли и обязанности среди сотрудников организации, обеспечивая эффективное внедрение системы управления. Авторы также анализируют существующие принципы безопасности информационных технологий, интегрируя их в стратегию безопасности, которая соответствует целям организации. Предложенная универсальная система соответствует нормативным правовым требованиям и может быть адаптирована для использования в организациях любого масштаба и профиля.

Научная новизна

Научная новизна: заключается в представлении практического подхода к внедрению системы управления информационной безопасностью, основанного на опыте авторов, а также на мировых стандартах, системах контроля и правовых актах. В отличие от существующих подходов предлагаемая система является гибкой и может быть адаптирована под специфику любой организации, что делает ее универсальным инструментом для управления информационной безопасностью.

Практическая значимость

Практическая значимость: состоит в предоставлении структурированного подхода к созданию универсальной системы управления информационной безопасностью, который может быть использован организациями, испытывающими недостаток знаний и ресурсов для реализации подобных инициатив. Авторы предлагают общую структуру, которая может быть адаптирована в зависимости от активов организации, уровня подготовки сотрудников и их осведомленности в вопросах информационной безопасности. Это делает настоящую работу ценным ресурсом для специалистов, стремящихся повысить уровень защиты информации в своих организациях

законодательствозащита информацииинформационная безопасностьинформационные технологиикибербезопасностьорганизационная структураправоправовое регулированиеуправление информационной безопасностьюцифровые технологииcybersecuritydigital technologiesinformation protectioninformation security governanceinformation securityinformation technologieslawlegal regulationlegislationorganizational structureReferencesAl Neaimi, A., Ranginya, T., & Lutaaya, P. (2015). A framework for effectiveness of cyber security defenses, a case of the United Arab Emirates (UAE). International Journal of Cyber-Security and Digital Forensics, 4(1), 290–301. https://doi.org/10.17781/p001502Al Neaimi, A., Ranginya, T., & Lutaaya, P. (2015). A framework for effectiveness of cyber security defenses, a case of the United Arab Emirates (UAE). International Journal of Cyber-Security and Digital Forensics, 4(1), 290–301. https://doi.org/10.17781/p001502AlGhamdi, S., Win, K. T., & Vlahu-Gjorgievska, E. (2020). Information security governance challenges AND CRITICAL SUCCESS FACTORS: Systematic review. Computers & Security, 99, 102030. https://doi.org/10.1016/j.cose.2020.102030AlGhamdi, S., Win, K. T., & Vlahu-Gjorgievska, E. (2020). Information security governance challenges AND CRITICAL SUCCESS FACTORS: Systematic review. Computers & Security, 99, 102030. https://doi.org/10.1016/j.cose.2020.102030Bendovschi, A. (2015). Cyber-attacks – trends, patterns and security countermeasures. Procedia Economics and Finance, 28, 24–31. https://doi.org/10.1016/s2212-5671(15)01077-1Bendovschi, A. (2015). Cyber-attacks – trends, patterns and security countermeasures. Procedia Economics and Finance, 28, 24–31. https://doi.org/10.1016/s2212-5671(15)01077-1Bettwy, G., Beevers, M., & Williams, M. (2016). CISM Review Manual Certified Information Security manager. Rolling Meadows, Ill: ISACA.Bettwy, G., Beevers, M., & Williams, M. (2016). CISM Review Manual Certified Information Security manager. Rolling Meadows, Ill: ISACA.Carcary, M., Renaud, K., McLaughlin, S., & O’Brien, C. (2016). A framework for Information Security Governance and Management. IT Professional, 18(2), 22–30. https://doi.org/10.1109/mitp.2016.27Carcary, M., Renaud, K., McLaughlin, S., & O’Brien, C. (2016). A framework for Information Security Governance and Management. IT Professional, 18(2), 22–30. https://doi.org/10.1109/mitp.2016.27Carr, M., & Tanczer, L. M. (2018). UK cybersecurity industrial policy: An analysis of drivers, market failures and interventions. Journal of Cyber Policy, 3(3), 430–444. https://doi.org/10.1080/23738871.2018.1550523Carr, M., & Tanczer, L. M. (2018). UK cybersecurity industrial policy: An analysis of drivers, market failures and interventions. Journal of Cyber Policy, 3(3), 430–444. https://doi.org/10.1080/23738871.2018.1550523Corriss, L. (2010). Information security governance. Proceedings of the 2010 Workshop on Governance of Technology, Information and Policies (pp. 35–41). https://doi.org/10.1145/1920320.1920326Corriss, L. (2010). Information security governance. Proceedings of the 2010 Workshop on Governance of Technology, Information and Policies (pp. 35–41). https://doi.org/10.1145/1920320.1920326Creemers, R. (2023). Cybersecurity law and regulation in China: Securing the smart state. China Law and Society Review, 6(2), 111–145. https://doi.org/10.1163/25427466-06020001Creemers, R. (2023). Cybersecurity law and regulation in China: Securing the smart state. China Law and Society Review, 6(2), 111–145. https://doi.org/10.1163/25427466-06020001Fazlida, M. R., & Said, J. (2015). Information security: Risk, governance and implementation setback. Procedia Economics and Finance, 28, 243–248. https://doi.org/10.1016/s2212-5671(15)01106-5Fazlida, M. R., & Said, J. (2015). Information security: Risk, governance and implementation setback. Procedia Economics and Finance, 28, 243–248. https://doi.org/10.1016/s2212-5671(15)01106-5Hadi, M. A., Abdulredha, M. N., & Hasan, E. (2023). Introduction to ChatGPT: A new revolution of artificial intelligence with machine learning algorithms and cybersecurity. Science Archives, 04(04), 276–285. https://doi.org/10.47587/sa.2023.4406Hadi, M. A., Abdulredha, M. N., & Hasan, E. (2023). Introduction to ChatGPT: A new revolution of artificial intelligence with machine learning algorithms and cybersecurity. Science Archives, 04(04), 276–285. https://doi.org/10.47587/sa.2023.4406Johnston, A. C., & Hale, R. (2009). Improved security through information security governance. Communications of the ACM, 52(1), 126–129. https://doi.org/10.1145/1435417.1435446Johnston, A. C., & Hale, R. (2009). Improved security through information security governance. Communications of the ACM, 52(1), 126–129. https://doi.org/10.1145/1435417.1435446Moulton, R., & Coles, R. S. (2003). Applying information security governance. Computers & Security, 22(7), 580–584. https://doi.org/10.1016/s0167-4048(03)00705-3Moulton, R., & Coles, R. S. (2003). Applying information security governance. Computers & Security, 22(7), 580–584. https://doi.org/10.1016/s0167-4048(03)00705-3Nicho, M. (2018). A process model for implementing Information Systems Security governance. Information & Computer Security, 26(1), 10–38. https://doi.org/10.1108/ics-07-2016-0061Nicho, M. (2018). A process model for implementing Information Systems Security governance. Information & Computer Security, 26(1), 10–38. https://doi.org/10.1108/ics-07-2016-0061Ohki, E., Harada, Y., Kawaguchi, Sh., Shiozaki, T., & Kagaya, T. (2009). Information security governance framework. Proceedings of the first ACM workshop on Information security governance (pp. 1–6). https://doi.org/10.1145/1655168.1655170Ohki, E., Harada, Y., Kawaguchi, Sh., Shiozaki, T., & Kagaya, T. (2009). Information security governance framework. Proceedings of the first ACM workshop on Information security governance (pp. 1–6). https://doi.org/10.1145/1655168.1655170Priyadarshini, I., & Cotton, C. (2022). Cyber laws in the United States. Cybersecurity (pp. 157–237). https://doi.org/10.1201/9781003187127-6Priyadarshini, I., & Cotton, C. (2022). Cyber laws in the United States. Cybersecurity (pp. 157–237). https://doi.org/10.1201/9781003187127-6Rao, U. H., & Nayak, U. (2014). History of computer security. The InfoSec Handbook (pp. 13–25). https://doi.org/10.1007/978-1-4302-6383-8_2Rao, U. H., & Nayak, U. (2014). History of computer security. The InfoSec Handbook (pp. 13–25). https://doi.org/10.1007/978-1-4302-6383-8_2Rastogi, R., & von Solms, R. (2005). Information security governance – a re-definition. Security Management, Integrity, and Internal Control in Information Systems (pp. 223–236). https://doi.org/10.1007/0-38731167-x_14Rastogi, R., & von Solms, R. (2005). Information security governance – a re-definition. Security Management, Integrity, and Internal Control in Information Systems (pp. 223–236). https://doi.org/10.1007/0-38731167-x_14Rebollo, O., Mellado, D., Fernández-Medina, E., & Mouratidis, H. (2015). Empirical evaluation of a cloud computing information security governance framework. Information and Software Technology, 58, 44–57. https://doi.org/10.1016/j.infsof.2014.10.003Rebollo, O., Mellado, D., Fernández-Medina, E., & Mouratidis, H. (2015). Empirical evaluation of a cloud computing information security governance framework. Information and Software Technology, 58, 44–57. https://doi.org/10.1016/j.infsof.2014.10.003Rocha Flores, W., Antonsen, E., & Ekstedt, M. (2014). Information security knowledge sharing in organizations: Investigating the effect of behavioral information security governance and national culture. Computers & Security, 43, 90–110. https://doi.org/10.1016/j.cose.2014.03.004Rocha Flores, W., Antonsen, E., & Ekstedt, M. (2014). Information security knowledge sharing in organizations: Investigating the effect of behavioral information security governance and national culture. Computers & Security, 43, 90–110. https://doi.org/10.1016/j.cose.2014.03.004Shingarev, A., & Kazakova, A. (2021). The Russian Federation’s approach to Cybersecurity. The Oxford Handbook of Cyber Security (pp. 672–684). https://doi.org/10.1093/oxfordhb/9780198800682.013.44Shingarev, A., & Kazakova, A. (2021). The Russian Federation’s approach to Cybersecurity. The Oxford Handbook of Cyber Security (pp. 672–684). https://doi.org/10.1093/oxfordhb/9780198800682.013.44Singh, H. P., & Alshammari, T. S. (2020). An institutional theory perspective on developing a cyber security legal framework: A case of Saudi Arabia. Beijing Law Review, 11(03), 637–650. https://doi.org/10.4236/blr.2020.113039Singh, H. P., & Alshammari, T. S. (2020). An institutional theory perspective on developing a cyber security legal framework: A case of Saudi Arabia. Beijing Law Review, 11(03), 637–650. https://doi.org/10.4236/blr.2020.113039Tan, T. C., Ruighaver, A. B., & Ahmad, A. (2010). Information security governance: When compliance becomes more important than security. Security and Privacy – Silver Linings in the Cloud (pp. 55–67). https://doi.org/10.1007/978-3-642-15257-3_6Tan, T. C., Ruighaver, A. B., & Ahmad, A. (2010). Information security governance: When compliance becomes more important than security. Security and Privacy – Silver Linings in the Cloud (pp. 55–67). https://doi.org/10.1007/978-3-642-15257-3_6Ula, M., Ula, M., & Fuadi, W. (2017). A method for Evaluating Information Security Governance (ISG) components in banking environment. Journal of Physics: Conference Series, 812, 012031. https://doi.org/10.1088/17426596/812/1/012031Ula, M., Ula, M., & Fuadi, W. (2017). A method for Evaluating Information Security Governance (ISG) components in banking environment. Journal of Physics: Conference Series, 812, 012031. https://doi.org/10.1088/17426596/812/1/012031Von Solms, S. H., & von Solms, R. (2010). Information security governance. New York, United States: Springer.Von Solms, S. H., & von Solms, R. (2010). Information security governance. New York, United States: Springer.Von Solms, R., Thomson, K.-L., & Maninjwa, P. M. (2011). Information security governance control through comprehensive policy architectures. Information Security for South Africa (pp. 1–6). https://doi.org/10.1109/issa.2011.6027522Von Solms, R., Thomson, K.-L., & Maninjwa, P. M. (2011). Information security governance control through comprehensive policy architectures. Information Security for South Africa (pp. 1–6). https://doi.org/10.1109/issa.2011.6027522Wu, M., Aranovich, R., & Filkov, V. (2021). Evolution and differentiation of the cybersecurity communities in three social question and answer sites: A mixed-methods analysis. PLOS ONE, 16(12). https://doi.org/10.1371/journal.pone.0261954Wu, M., Aranovich, R., & Filkov, V. (2021). Evolution and differentiation of the cybersecurity communities in three social question and answer sites: A mixed-methods analysis. PLOS ONE, 16(12). https://doi.org/10.1371/journal.pone.0261954

The authors declare that there are no conflicts of interest present.