Information security policy as a governance capability in politically complex legislative organizations: a tridimensional configurational model
Elias Amaral dos Santos, Gabriel Oscar Cremona ParmaPurpose
This conceptual paper aims to examine information security policy (ISP) in Brazilian state legislative assemblies as a formal document that may operate as an institutional governance device and, under specific conditions, become a governance capability.
Design/methodology/approach
The paper integrates sociological institutionalism, network governance and state-capacity perspectives, in dialogue with governance-oriented information security scholarship, to theorize the conditions under which ISP may become institutionalized.
Findings
It develops the tridimensional model of legislative information governance (MTGIL), structured around institutional legitimacy, cross-functional coordination and political-administrative capacity and proposes three ideal-type configurations: symbolic compliance, institutional transition and substantive governance. Five testable propositions are derived.
Research limitations/implications
MTGIL is conceptual and untested. Its propositions, profile classifications and portability beyond Brazilian state legislative assemblies require comparative validation.
Practical implications
MTGIL offers legislative organizations a diagnostic lens for comparing formal ISP adoption with observable evidence of sponsorship, cross-functional routines, reporting channels, training uptake and continuity mechanisms, thereby informing policy redesign, coordination and continuity planning.
Social implications
By treating ISP as a governance capability, the paper suggests how legislative organizations may diagnose vulnerabilities affecting citizens’ data rights, democratic accountability and the transparency-confidentiality balance.
Originality/value
The paper distinguishes ISP as a formal document, an institutional governance device and a potential governance capability. MTGIL theorizes why similar policy documents, control frameworks or compliance scores may follow different institutionalization trajectories when legitimacy, coordination and capacity are configured differently.