Main Article Content


This study aims to reveal the reality of the Human Resources Management Units contribution to achieving information security at Saudi government universities by examining their compliance with the international standard of the Information Security Management System (ISO/IEC 27002:2013).

The study was based on qualitative research methods, where a checklist was designed to collect the data needed for the study, using semi-structured interviews, direct observation, and documents examination which used in Human Resources management units. The gap analysis method has also been used to analyse data in order to determine range of the compliance of the Universities Human Resources Management Units that participated in the study to the information security controls provided by the international standard (ISO/IEC 27002:2013).

The study reached a number of results, the most important of which was the commitment of the participating universities in different rates ranging from medium to high in the application of international standard (ISO/IEC 27002:2013) controls concerning human resources management processes (prior to employment, during employment, termination or change of employment).

In the light of those findings, the study made several recommendations that guide universities towards full compliance with controls of that international standard in order to raise the level of the contribution of human resources management processes to achieve a full information security.

JEL Classification: M15.


Human recourse management Information Security International Standard: ISO/IEC 27002:2013

Article Details

Author Biographies

Mo'ath Y. Al-Thunaibat, Taif University (Saudi Arabia)

PhD in Management Information Systems, Associate Professor

Adnan A . Al-shawabkeh, Taif University (Saudi Arabia)

PhD in Management Information Systems, Associate Professor

Khiro K . Al-baqor, Taif University (Saudi Arabia)

PhD in Management Information Systems, Associate Professor

How to Cite
Al-Thunaibat, M. Y., Al-shawabkeh, A. A. ., & Al-baqor, K. K. . (2020). The Role of Human Resource Management Processes in Achieving of Information Security: An applied Study of Saudi Government Universities. Management & Economics Research Journal, 2(3), 1-23.
Cited by


  1. Al-Arabi, A. O., Miayar almunadhama adwliya litawhid alkiassi ISO 27002: lisyasat amn almaaloumat dirassa wasfiua tahliliya limawaki aljamiaat alarabiya. Majalat jamiat taiba lioulom w aladab, 7, 661-738. [In Arabic]
  2. Alshehri, M., , Drew, S., & Alfarraj, O. (2012). A Comprehensive Analysis of E-government services adoption in Saudi Arabia: Obstacles and Challenges. (IJACSA) International Journal of Advanced Computer Science and Applications, 3(2), 1-6.
  3. Ansen, J. B. (2014). Information Security Management in a Human Resource Information System of a Selected University of Technology. (master), Cape Peninsula University of Technology of South Africa,
  4. Beirami, N., Modiri, N., & Eshlaghi, A. T. (2016). Reviewing the Implementation of Information Security Management System
  5. Requirements in Hospitals in Tabriz in East Azarbaijan. Journal of Management and Accounting Studies, 4(1), 74-80.
  6. Bongiovanni, I. (2019). The least secure places in the universe? A systematic literature review on information security management in higher education. Computers & Security, 86, 350-357.
  7. Calder., A., & Watkins. (2008). IT Governance – A Manager’s Guide to Data Security and ISO 27001 and ISO 27002 (4th edition. ed.): Kogan Page.
  8. Da Veiga, A. (2016). Comparing the information security culture of employees who had read the information security policy and those who had not. Information & Computer Security, 24(2), 139-151.
  9. Daniel, A. U. (2019). Human factor security: evaluating the cybersecurity capacity of the industrial workforce. Journal of Systems and Information Technology, 21(1), 2-35.
  10. Hina, S., & & Dominic, D. D. (2016). Information security policies: Investigation of compliance in universities. Paper presented at the the 2016 3rd International Conference on Computer and Information Sciences.
  11. Kehoe, D. (2016). The Role of Human Resources in Managing Cybersecurity. Retrieved from
  12. Kumah, P., Winfred, Y., & Charles, B.-A. (2018). Identifying HRM Practices for Improving Information Security Performance: An Importance-Performance Map Analysis. International Journal of Human Capital and Information Technology Professionals (IJHCITP), 9(4), 23-43.
  13. Kumah, P., Yaokumah, W., & Okai, E. (2019). A conceptual model and empirical assessment of HR security risk management. information and Computer Security, 27(3), 411-433.
  14. Li, Y., & S, S., M. (2011). A Call for Research on Home Users' Information Security Behavior. Paper presented at the Pacific Asia Conference on Information Systems, Brisbane, Queensland, Australia.
  15. Ma, Q., Schmidth, M. B., & Pearson, J. M. (2009). An integrated framework of information security management. Review of Business, 30(1), 58–69.
  16. Malekolkalami, K. (2014). Evaluation of the central libraries information security management at governmental universities located in Tehran, according to the international standard ISO/IEC 27002 Journal of Information Processing and Management, 28(4), 895-916.
  17. Sewuster, P. (2012). Information security in practice : The practice of using ISO 27002 in the public sector (master master), University of Nijmegen,
  18. Shaaban, H. K. (2014). Enhancing The Governance Of Information Security In Developing Countries: The Case Of Zanzibar,. (Doctor Doctor ), University of Bedfordshire, UK.
  19. Singh, A.N,, & Gupta, M. P. (2019). Information Security Management Practices: Case Studies from India. Global Business Review, 20(1), 253-271.
  20. Stewart, H. (2017). Information security management and the human aspect in organizations. Information & Computer Security, 25(5), 494-534.
  21. Susanto, H., Almunawar, M. N., & Tuan, Y. C. (2011). Information Security Management System Standards: A Comparative Study of the Big Five. International Journal of Electrical & Computer Sciences, 11(5), 23-29.
  22. Topa, I., & Karyda, M. (2019). From theory to practice: guidelines for enhancing information security management. Information & Computer Security, 27(3), 326-342.
  23. Tsohou, A. (2010). A security standards' framework to facilitate best practices' awareness and conformity. Information Management & Computer Security, 18(5), 350-365.
  24. Wipawayangkool, K. (2010, 12-15 August). Strategic Role of Human Resource Management in Information Security Management. Paper presented at the the Sixteenth Americas Conference on Information Systems, Lima, Peru.