Governing the fiduciary relationship in information security services

We propose a model of security governance that draws upon agency theory to conceptualize the InfoSec function as a fiduciary for business users. We introduce a ternary typology of governance and test the efficacy of governance on goal congruence and information asymmetry. Our survey of information security managers finds that: (1) governance enhances goal congruence but does not impact information asymmetry, and (2) perceived information security service effectiveness is positively related to both information asymmetry and goal congruence. Contrary to what agency theory suggests, in the InfoSec context, information asymmetry can be exactly what is needed to enhance the principal's welfare. We conclude with a discussion of the theoretical and managerial implications of these findings.