1.Introduction

Information is a critical asset in modern organizations, essential for operations and a key driver of competitiveness [1-2]. Given its pivotal role, it has become a primary target for cyber threats, from viruses and worms to data breaches. Statista’s 2023 report indicates that over 6 million data records were compromised in the first quarter alone, emphasizing the severity of these risks [3]. With U.S. data breaches averaging $9.48 million in damages [4], organizations face significant financial, legal, and reputational harm. The rapid growth of information technology further complicates security by expanding system access beyond IT professionals to unauthorized users, escalating the need for comprehensive security measures. Consequently, physical protection alone is insufficient. Organizations must implement an information security management system (ISMS) to protect all resources involved in information processing—facilities, personnel, computers, and media [5-6]. Information security management (ISM) refers to the processes, policies, and technical measures used to protect information systems and assets from unauthorized access, disruption, theft, or modification [7]. ISM helps mitigate various threats and share organizational information in a trustworthy way. As organizations increasingly rely on leveraging technological knowledge, effective information security management has become a strategic imperative, drawing increasing attention from practitioners and scholars, ensuring the protection of critical assets, and fostering sustainable organizational success.

In today’s academic landscape, information security management is essential for safeguarding sensitive data, intellectual property, and academic integrity. As universities expand digital communication and infrastructure (e.g., Brightspace, swipe card access systems), they face heightened risks of data breaches and privacy issues, particularly for academic and personal information [8]. Universities also possess assets that attract hackers, such as student personal data (e.g., SSNs), computational power for cryptocurrency mining, intellectual property, and valuable research data. The frequency of information security incidents in higher education is rising globally (see Table 1). In this digital age, robust information security management is critical for universities.

Table 1: Information security breaches at universities in 2023

(Source from Google)

Previous literature has primarily addressed information security management (ISM) as a technical issue [9], with a focus on technical solutions [10], information security policy development [11-13], and fostering a security-aware culture [14-16]. While these studies provide valuable insights for building a security-conscious workforce, they overlook academic institutions' unique cultural and structural dynamics. Although notable progress has been made in the technical, policy, and cultural dimensions of ISM, research addressing the managerial aspects of ISM in universities remains limited [17-19]. This study thus aims to explore the managerial dimensions of ISM within the university setting, where challenges such as open access, diverse users, and data sensitivity demand specialized approaches.

Scholarly research on university-specific information security management (ISM) remains relatively limited, though its importance has recently grown [20-21]. This review provides a comprehensive examination of ISM studies within academic institutions, highlighting the critical role of ISM in helping universities navigate digital complexities while protecting sensitive data and maintaining the integrity of their educational missions.

2.Methodology

This study applies a grounded theory approach [22] to synthesize existing knowledge on the role of management in information security within academic institutions. The methodology follows three key steps:

Step 1: Establish Research Questions: Based on the framework [23], we first developed research questions to guide our investigation of university information security management. The questions are as follows: (a) What are the primary topics explored in the research? (b) How is information security management studied in the literature in terms of year, location, sample, and methodologies? (c) Which topics are deemed essential or impactful for further study?

Step 2: Literature Search and Selection: We conducted a systematic literature search using keywords such as “information security management,” “cybersecurity management,” “university,” and “college” across multiple databases: Scopus, Web of Science, Google Scholar, AIS Library, and IEEE Xplore. To ensure relevance and rigor, we included only peer-reviewed articles published within the last ten years, resulting in a selection of 67 articles. The flowchart in Figure 1 illustrates the process of identifying qualified studies.

Step 3: Data Analysis: We analyzed the selected literature by applying grounded theory coding techniques to identify recurring themes and management roles within information security. That involves categorizing themes based on managerial practices, policy development, and cultural impact in academic settings. The analysis revealed that various managerial aspects significantly shape effective information security management in universities.

Figure 1: Procedural outline of literature selection

3.Results

The results comprehensively analyze key findings in university information security management (ISM) research, detailing core topics, geographic distribution, sample populations, and methodologies to understand ISM challenges unique to universities. This section highlights primary focus areas and identifies research gaps, offering insights into the current landscape and directions for future exploration in higher education.

3.1.Key Topics in University ISM Research

The study summarizes the primary topics and patterns in information security management (ISM) research related to universities. The analysis shows that 42% of the studies focus on risk management frameworks and principles within colleges, highlighting a strong emphasis on strategies to mitigate institutional risks. In contrast, only 5% of the center of the paper is on governance-related aspects of ISM, such as information security policies, cyber behaviors, risk management frameworks or standards, culture or awareness, etc. See Table 2 for further details. Additionally, an assessment of recurrent keywords across the reviewed papers reveals key topical patterns, including "information security," "information security policy," "information security management system," "security threat," and "university." This clustering of keywords suggests that these themes are central to university-focused ISM research. Interestingly, only three papers specifically address cybersecurity breaches, demonstrating a relatively low focus on this area and a diversity of subtopics. This finding suggests that cybersecurity breaches may be an underexplored topic in the context of university ISM research.

Table 2: The main topics in the literature [35]

3.2.Analysis of Trends, Populations, and Methodologies

Figure 2 shows a steady increase in scholarly publications on information security management (ISM) in universities over recent years, reflecting growing interest in this area. Geographic Distribution: The studies demonstrate significant geographic diversity, with the majority conducted in the US (6 studies), followed by Malaysia (4), China (4), Indonesia (3), Canada (2), and New Zealand (2). Sample Populations: The literature utilizes a range of sample populations, including students, IT staff, and administrative personnel. Notably, 25 studies evaluated ISM effectiveness, 7 analyzed students' unsafe behaviors, and 5 focused on university information systems. Research Methodologies: Methodological approaches are varied. Conceptual frameworks are the most common, complemented by descriptive statistics (e.g., assessing guideline implementation), regression analysis, and structural equation modeling. Data collection methods primarily include surveys, questionnaires, interviews, and laboratory tests, allowing for in-depth analysis of ISM practices in higher education institutions. These findings underscore the diversity of ISM research in universities, highlighting a range of geographic, demographic, and methodological approaches used to explore information security in academic settings.

Figure 2: Number of publications per year with trend

3.3.Strategic Challenges of ISM in Universities

The findings reveal that much of the ISM literature in universities has a limited focus on the strategic significance of managing information security in academic settings. Notably, 13 studies recognize universities as knowledge-intensive organizations with high complexity, which increases their susceptibility to cyberattacks and poses potential financial risks. Several researchers also utilized 'vulnerability' as a key indicator to examine ISM challenges in these institutions, emphasizing areas where universities may be especially exposed. Additionally, four studies highlight the strategic value of safeguarding academic achievements and intellectual property, such as patents, in university settings. Other papers explore aspects unique to ISM in higher education, including the widespread adoption of BYOD (Bring Your Own Device) and the openness of universities as multimodal learning and innovation hubs.

4.Discussion

This study investigates information security management (ISM) in universities, where organizational and managerial aspects are increasingly emphasized. Consistent with broader literature [7], universities are applying structured security architectures to protect data and teaching systems, highlighting the importance of ISM in academia. Additionally, our review suggests a complex ISM environment within universities, characterized by varied perspectives among students, faculty, and administrators, which introduces unique cultural dynamics around information security. Exploring these diverse viewpoints—such as differing levels of awareness, perceptions, and behaviors—presents an intriguing area for future research.

The literature review reveals that ISM in universities is an emerging topic with many gaps in empirical testing, conceptual frameworks, and robust quantitative methods, supporting the need for further research. Southeast Asian scholars, alongside U.S. researchers, have contributed significantly to this area, with 13 studies focused on university ISM. However, some information-sharing barriers remain across regions (e.g., limited use of open-access databases). Some researchers have attributed the limited focus on university ISM to the traditionally open, collaborative architecture of higher education institutions, which facilitates information exchange and connects vast IT systems. However, the expanding value of universities as repositories of intellectual property (IP) and personal data, along with their culture of academic innovation, makes them increasingly attractive targets for cyber threats.

Significant gaps in university ISM literature remain. Critical areas for future research include examining information security culture within academic institutions, mainly how awareness and attitudes vary among students, faculty, and administrators. Comparative studies across different regional and international universities would also provide valuable insights. Practically advancing this research would benefit professionals such as Chief Information Security Officers (CISOs), Certified Information Systems Auditors (CISAs), and university end-users by informing ISM practices tailored to the unique environment of higher education institutions.

5.Conclusion

This study uses a grounded theory approach to analyze information security management (ISM) in universities, emphasizing the unique managerial complexities these institutions face in addressing information security challenges, such as academic information breaches. Our analysis identified several key topics within the literature, revealing that ISM research in universities is still in its early stages, having only begun to develop significantly since 2014. That highlights an urgent need for further exploration and novel research. In summary, universities' open architecture, diverse organizational cultures, and varied end-users pose unique challenges for ISM. This study provides IT staff and university information security professionals with a holistic overview of the current research landscape, offering valuable insights to guide future improvements in information security practices within higher education institutions.