Assessing the Current Status of Information Security Risk Management at Vietnamese Enterprises

Abstract

With the growing pace of digital transformation in Vietnam, enterprises are subjected to more and more complex cybersecurity threats that should be managed via the ISRM discipline. Although the internationally accepted norms and standard frameworks such as ISO/IEC 27001:2022, as well as the NIST Cybersecurity Framework (CSF) 2.0 are available, there is no empirical study investigating the status of the ISRM execution of Vietnamese enterprises. This study uses a mixed-method design, mainly based on a structured survey of 120 enterprises from six industry sectors, complemented by semi-structured interviews and an expert Delphi validation procedure. 65.8% of the enterprises are positioned at ISRM Maturity Level 1 or 2 and the overall mean maturity index is 2.51 on a scale from 0 to 5 (SD = 0.86). The Banking & Finance industry has the best maturity level (M = 3.19), whereas Retail (M = 1.56) and Manufacturing (M = 2.14) industries are grouped into the Initial and Developing phases. The lack of qualified staff (M = 4.43, 100% of the respondents rated it High/Very High) and limited resources of budget (M = 4.48) are the most important barriers of adoption, followed by the low awareness of the management (M = 4.24). An ISRM four-phase maturation (Foundation, Structuring, Maturing and Optimizing phases) based ISRM improvement roadmap is developed and validated by experts review. The results offer practical guidance for enterprise security managers, policy makers, and researchers interested in improving cybersecurity governance in Vietnam and similar developing nations.