Information security policy as a governance capability in politically complex legislative organizations: a tridimensional configurational model
This conceptual paper aims to examine information security policy (ISP) in Brazilian state legislative assemblies as a formal document that may operate as an institutional governance device and, under specific conditions, become a governance capability. The paper integrates sociological institutionalism, network governance and state-capacity perspectives, in dialogue with governance-oriented information security scholarship, to theorize the conditions under which ISP may become institutionalized. It develops the tridimensional model of legislative information governance (MTGIL), structured around institutional legitimacy, cross-functional coordination and political-administrative capacity and proposes three ideal-type configurations: symbolic compliance, institutional transition and substantive governance. Five testable propositions are derived. MTGIL is conceptual and untested. Its propositions, profile classifications and portability beyond Brazilian state legislative assemblies require comparative validation. MTGIL offers legislative organizations a diagnostic lens for comparing formal ISP adoption with observable evidence of sponsorship, cross-functional routines, reporting channels, training uptake and continuity mechanisms, thereby informing policy redesign, coordination and continuity planning. By treating ISP as a governance capability, the paper suggests how legislative organizations may diagnose vulnerabilities affecting citizens’ data rights, democratic accountability and the transparency-confidentiality balance. The paper distinguishes ISP as a formal document, an institutional governance device and a potential governance capability. MTGIL theorizes why similar policy documents, control frameworks or compliance scores may follow different institutionalization trajectories when legitimacy, coordination and capacity are configured differently.