Managing Information Risk and the Economics of Security

pp 165-177


The Value of Escalation and Incentives in Managing Information Access

  • Xia Zhao
  • , M. Eric Johnson

* Final gross prices may vary according to local VAT.

Get Access


Managing information access within large enterprises is increasingly challenging. With thousands of employees accessing thousands of applications and data sources, managers strive to ensure the employees can access the information they need to create value while protecting information from misuse. We examine an information governance approach based on controls and incentives, where employees’ self-interested behavior can result in firm-optimal use of information. Using insights gained from a game-theoretic model, we illustrate how an incentives-based policy with escalation can control both over and under-entitlementwhile maintaining the flexibility.