On Information Systems Security and when it Matters to Collectively Improvise: A Case in South Africa

Research regarding information systems security concerns in organizations constantly focuses on the ‘hard’, rational and objective approaches to managing and mitigating security risks. Such research is often devoid of utilizing the ‘soft’ qualitative social-constructive approaches to understanding risk. This article attempts to fill this gap and presents interesting insights where these ‘soft’ approaches can be used as lenses to understand the management of information security. The phenomenon of improvisation and specifically collective improvisation is introduced. The research problem is that little is known about how collective improvisation is manifested in organizational settings and more importantly, how collective improvisation assists in managing information security risks. A qualitative research was therefore undertaken in South Africa, using a single case study to resolve this. Qualitative data was collected and hermeneutical exegesis techniques employed to analyses and interpret data. The key findings reveal that indeed collective improvisation was present in the case selected and manifested in unique ways that were aimed at unravelling conflicting information security challenges that this organization faced. The article discusses what these findings mean to the scholarly and practice community.