How Situated Organizational Information Security Practices Emerge in Subsidiary Companies: a case study

Abstract

Information security at subsidiaries has rarely been studied. This is surprising, considering that subsidiaries are a common form of business. This study examines the information security practices of subsidiaries and their development. A qualitative exploratory case study was conducted to examine the impact of various factors, such as organizational structure and institutional pressures, on the development of information security practices in subsidi-aries. The case study is an organization operating in Finland that is a subsidiary of a European company operating in several European countries. The study was conducted in one phase between February and May 2025. The study used documentation from the case organization as material, and additional data was obtained through semi-structured interviews and participatory observation. The study found that organizational structure has a strong influence on the formation of information security practices. It was also found that institutional pressures do not affect subsidiaries as much as independent companies in the formation of information security practices. Information security in subsidiaries is an area of research offering new and exciting opportunities for re-searchers interested in organizational information security. The topic is also becoming increasingly relevant.