Understanding organisational responses to regulative pressures in information security management: The case of a Chinese hospital

This paper advances existing theoretical understanding of the factors impacting upon organisational responses to regulative pressures in the process of information security management (ISM). Drawing on institutional theory, we conduct a case study of ISM in a Chinese hospital. A theoretical framework is presented, which proposes that organisational response strategies devised in response to regulative pressures are determined jointly by internal organisational incentives and external government supervision and enforcement. Practical implications for policymakers to promote organisational ISM are given and suggestions for future research based on the theoretical findings of the case study are provided.