Governing the fiduciary relationship in information security services

We propose a model of security governance that draws upon agency theory to conceptualize the InfoSec function as a fiduciary for business users. We introduce a ternary typology of governance and test the efficacy of governance on goal congruence and information asymmetry. Our survey of information security managers finds that: (1) governance enhances goal congruence but does not impact information asymmetry, and (2) perceived information security service effectiveness is positively related to both information asymmetry and goal congruence. Contrary to what agency theory suggests, in the InfoSec context, information asymmetry can be exactly what is needed to enhance the principal's welfare. We conclude with a discussion of the theoretical and managerial implications of these findings. •Develop a theory of Information Security (InfoSec) governance and effectiveness•Examine roles of information asymmetry (IA) and goal congruence (GC) in one model•Introduce a ternary typology of InfoSec governance mechanisms and test its efficacy•Find that governance enhances GC but not IA; larger IA can be beneficial to InfoSec•Results based on data collected from organizations from a wide array of industries