Taking a sequential qualitative-quantitative methodological approach, we propose and test a theoretical model that includes four variables through which top management can positively influence security effectiveness: user training, security culture, policy relevance, and policy enforcement. During the qualitative phase of the study, we generated the model based on textual responses to a series of questions given to a sample of 220 information security practitioners. During the quantitative phase, we analyzed survey data collected from a sample of 740 information security practitioners. After data collection, we analyzed the survey responses using structural equation modeling and found evidence to support the hypothesized model. We also tested an alternative, higher-order factor version of the original model that demonstrated an improved overall fit and general applicability across the various demographics of the sampled data. We then linked the finding of this study to existing top management support literature, general deterrence theory research, and the theoretical notion of the dilemma of the supervisor.

Purpose This study proposes to put forward and test a theoretical model that demonstrates the influence of top management support on an organization's security culture and level of security policy enforcement. Design/methodology/approach The project used a combination of qualitative and quantitative techniques. The grounded theory approach was used to analyze responses to open‐ended questions answered by 220 certified information system security professionals. Using these responses, a survey instrument was developed. Survey results were analyzed using structural equation modeling. Findings Evidence suggests that top management support is a significant predictor of an organization's security culture and level of policy enforcement. Research limitations/implications During instrument validation, a special effort removed survey items that appeared overly intrusive to the respondents. In this endeavor, an expert panel of security practitioners evaluated all candidate items on a willingness‐to‐answer scale. While especially helpful in security, this scale may be used in other research domains. Practical implications Practitioners should understand the impact of top management support on achieving security effectiveness. Based on the findings of this study, low levels of executive support will produce an organizational culture less tolerant of good security practices. Low levels of support will diminish the level of enforcement of existing security policies. Originality/value Researchers developed original scales to measure levels of top management support, policy enforcement, and organizational culture. The scales demonstrated acceptable reliability and validity scores.

This correspondence is a response to "Comments on Factors that Impact Implementing a System Development Methodology," by Yadav et al. [24]. We are gratified to see that researchers are closely examining our work. However, we must take issue with the theoretical and methodological issues raised by Yadav et at. [24]. Simply put, the issues raised do not adversely affect our study, its theoretical foundation, its research methodology, its statistical methodology, or its results.

Presents the findings of empirical research from 61 companies, mostly from the USA, to identify the factors that may impact implementation of a system development methodology (SDM). The study uses a survey instrument to identify the SDM implementation factors. The survey focused on the perspective of the primary constituents: functional managers, information systems managers, system personnel and external consultants. The study uses an exploratory factor analysis that identifies five factors important to implementing an SDM: organizational SDM transition, functional management involvement/support, SDM transition, the use of models and external support. The research findings have important implications for further research and the practice of system development. For researchers, it points to important measures in the implementation and use of SDMs that may be further verified and extended in subsequent research. For practitioners, it provides a general guide to the important aspects to consider in the implementation and use of an SDM.