ISO27001對組織市場價值之影響－以台灣市場為例

ISO27001是一個近年來十分受到矚目的資訊安全管理制度(ISMS)標準，但實務上還很欠缺關於其效益的相關研究。因此，為了填補這個研究缺口，本研究採用事件研究法為主要研究方法，以財務指標探討ISO27001在取得認證的事件發生後，是否會帶來異常報酬。透過456家在台通過認證的組織，我們篩選出23家公開上市公司，並以統計方法驗證他們的股價和總資產報酬率(ROA) 在短期與長期上的表現。實驗結果指出，ISO27001的認證並無法帶來任何異常的財務表現，因此我們建議組織應重新評估導入認證的必要性，以找出更有效率的資訊安全管理方法，同時建議未來研究可更深入瞭解ISO27001對內部流程改善的效益，並擴展研究標的至其他層面的指標。

關鍵字

ISO27001 ；資訊安全管理制度；資訊安全標準；資訊安全認證；事件研究法

並列摘要

ISO27001 is a popular certification on Information Security Management System (ISMS). However, there are very few empirical studies investigating the market impact of ISO27001. In this research, we employed event study to analyze the financial impact of organizations after obtaining ISO 27001 certification in Taiwan. Among 456 certified organizations, we selected 23 public firms as samples and tested their stock price as well as ROA performance in both short-term and long-term. The results indicate that ISO27001 certification did not lead to significant abnormal performance. Hence, we argue that the necessity of certification should be reconsidered and future research can pay more attention on ISO27001 certification’s value in other dimensions and its contribution on internal improvement.

並列關鍵字

IS27001 ； Information Security Management System ； information security standard ； information security certification ； Event Study

參考文獻

TSEC 2001. 台灣股市相關政策對股市之影響.

ANDERSON, S., DALY, J. & JOHNSON, M. 1999. Why firms seek ISO 9000 certification: regulatory compliance or competitive advantage? Production and Operations Management, 8, 28-43.

ARMITAGE, S. 1995. Event study methods and evidence on their performance. Journal of Economic Surveys, 9, 25-52.

BACKHOUSE, J., HSU, C. & SILVA, L. 2006. Circuits of power in creating de jure standards: shaping an international information systems security standard. Management information systems quarterly, 30, 413.

BALL, R. & BROWN, P. 1968. An empirical evaluation of accounting income numbers. Journal of accounting research, 159-178.

國際替代計量

ISO27001對組織市場價值之影響－以台灣市場為例

全文下載

主題瀏覽