MedISA Logo

MedISA

Medical Centre Employee Centered Information Security Awareness

Katalog

Im Rahmen der MedISA-Forschung wurden verschiedene Messinstrumente zur Erfassung der Information Security Awareness in einem Katalog zusammengestellt, die für weitere Forschungsarbeiten und praktische Anwendungen genutzt werden können.

Die zusammengestellten Instrumente bieten Hinweise auf Reliabilität und Validität, die wissenschaftlichen Gütekriterien sind jedoch von unterschiedlicher Qualität. Weitere Hinweise entnehmen Sie den dazugehörigen Publikationen.

Katalog titles.catalogue | MedISA

SABS ISO/IEC 17799 Scale with Focus on Hospitals (SIIS)

Autoren: Aksu P. K., Kitapçi N. Ş., Çatar R. Ö., Mumcu G.
Titel der Veröffentlichung: An Evaluation of Information Security from the Users’ Perspective in Turkey.
DOI: https://www.cabidigitallibrary.org/doi/full/10.5555/20163074395
Jahr: 2015
Sprache der Items: Englisch
Anzahl an Items: 27
Reliabilität: Cronbach’s alpha (0.8157 - 0.9019)
Validität: Augenschein- und Konstruktvalidität


Antwort Spezifikation: Five-point Likert scale (1 = Strongly disagree, 2 = Disagree, 3 = Neutral, 4 = Agree, 5 = Strongly agree)

Item
Users may not logon / gain access to our systems without being formerly registered with their own user account.
We ensure that information processing facilities are only used for authorised business purposes.
Our organisation controls access to information via an access control policy which specifies which users have access to what data.
Despite being connected to public networks, we are confident that our systems are adequately protected by our internet service provider’s security and / or our own firewalling systems.
We are confident that our anti-virus systems are up to date and in the event of a virus outbreak, we should be able to protect our systems as best as possible.
In the event of a security incident, procedures clearly define what to do and who to call for assistance.
A password management system is in place which specifies the frequency of password changes as well as the minimum password complexity.
Appropriate mechanisms are in place to authenticate users logging onto our systems.
Item
There is a formal disciplinary process for employees who have violated our security policies and processes.
Staff have been trained to secure their computers at all times, when moving away from their work stations.
Staff are aware that security incidents must be reported to management immediately.
Expertise on information security is available internally and where not, external advice is sought.
We are confident that in the event of equipment failure, theft or site disaster, our data backups and storage would enable us to retrieve our information with minimal business interruption.
Item
Changes in the workflow with computer use, do not prevent the granting of the necessary importance to information security.
Information security process does not adversely affect the quality of service.
Information security is a priority issue among daily works.
Having more workload in a organisations does not prevent the granting of the necessary importance to information security
Item
A director (or equivalent) member of our staff has responsibility for information security.
There is a nominated person in our organisation who is expertise on information security.
Directors take care to improve information security in the organisation.
Staffs take care to improve information security in the organisation.
Staff are well informed as to what is considered to be acceptable and unacceptable usage of our information systems.
Item
Staff are aware of our information security policy.
We have a documented information security policy.
Roles and responsibilities for information security in our organization are well defined.
All staff are given adequate and appropriate information security education and training.