J. Backhouse and G. Dhillon, Structures of responsibility and security of information systems, European Journal of Information Systems, vol.5, issue.1, pp.1-2, 1996.
DOI : 10.1057/ejis.1996.7

R. Baskerville, Semantic database prototypes, Information Systems Journal, vol.25, issue.2, pp.119-144, 1993.
DOI : 10.2307/2392581

R. Baskerville, The Second-Order Security Dilemma Information Technology and Changes in Organizational Work, pp.239-249, 1995.

R. Baskerville, Information Warfare: a comparative framework for Business Information Security, Journal of Information System Security, vol.1, pp.1-23, 2005.

R. Baskerville and V. Portougal, A Possibility Theory Framework for Security Evaluation in National Infrastructure Protection, Journal of Database Management, vol.14, issue.2, pp.1-13, 2003.
DOI : 10.4018/jdm.2003040101

G. D. Birch and N. A. Mcevoy, Risk analysis for Information Systems, Journal of Information Technology, vol.7, issue.1, pp.44-53, 1992.
DOI : 10.1057/jit.1992.7

F. Björck, Institutional theory: a new perspective for research into IS/IT security in organisations, 37th Annual Hawaii International Conference on System Sciences, 2004. Proceedings of the, pp.5-8, 2004.
DOI : 10.1109/HICSS.2004.1265444

J. Choobineh, G. Dhillon, M. Grimaila, and R. , Management Of Information Security: Challenges And Research Directions, Communications of the Association for Information Systems, vol.14, pp.958-971, 2007.

E. Monterio and S. K. , From Control to Drift, 2000.

M. M. Crossan and M. Sorrenti, Making Sense of Improvisation Advances in Strategic Management, pp.155-180, 1997.

M. Cunha and P. , Management Improvisation " FEUNL Working Paper No. 460 Available at SSRN: http://ssrn, p.882455, 2004.

G. Dhillon and J. Backhouse, Current Directions in IS Security Research: Toward Socioorganizational Perspectives, Information Systems Journal, vol.11, issue.2, 2001.

K. M. Eisenhardt, Building Theories from Case Study Research, Academy of Management Review, vol.14, pp.4-532, 1989.

K. Eisenhardt, M. Tabrizi, B. , and N. , Accelerating Adaptive Processes: Product Innovation in the Global Computer Industry, Administrative Science Quarterly, vol.40, issue.1, pp.84-110, 1995.
DOI : 10.2307/2393701

B. G. Glaser, Basics of Grounded Theory Analysis: Emergence Vs. Forcing, 1992.

B. G. Glaser and A. L. Strauss, The Discovery of Grounded Theory; Strategies for Qualitative Research, Nursing Research, vol.17, issue.4, 1967.
DOI : 10.1097/00006199-196807000-00014

S. T. Mcgann and K. Lyytinen, The Improvisation Effect: A Case Study of User Improvisation and Its Effects on Information System Evolution, Proceedings of the 29 th International Conference on Information Systems (ICIS), 2008.

C. Moorman and A. Miner, Organisational Improvisation and Organisational Memory, Academy of Management Review, vol.23, pp.698-723, 1998.

K. Njenga, Conceptualising Improvisation in Information Security Risk Management Activities, Doctoral Consortium) Proceedings of the 11 th Pacific Asia Conference on Information, 2007.

W. J. Orlikowski, CASE Tools as Organizational Change: Investigating Incremental and Radical Changes in Systems Development, MIS Quarterly, vol.17, pp.3-309, 1993.
DOI : 10.4135/9781849209687.n11

H. Saastamoinen, On the handling of exceptions in information systems, Computer Science, Economics and Statistics Jvaskyla, p.195, 1995.

A. Segars and V. Grover, Profiles of Strategic Information Systems Planning, Information Systems Research, vol.10, issue.3, pp.199-232, 1999.
DOI : 10.1287/isre.10.3.199

M. Siponen and J. Iivari, Six Design Theories for IS Security Policies and Guidelines, Journal of the Association for Information Systems, vol.77, pp.445-472, 2006.

A. Strauss, C. , and J. , Basics of qualitative research: Grounded theory procedures and techniques, 1990.

E. M. Trauth and L. M. Jessup, Understanding Computer-Mediated Discussions: Positivist and Interpretive Analyses of Group Support System Use, MIS Quarterly, vol.24, issue.1, pp.1-43, 2000.
DOI : 10.2307/3250979

K. Weick, Improvisation as a mindset for organizational analysis', Organization Science, pp.5-543, 1998.

T. Wiander, J. M. Holappa, J. , and M. , Theoretical framework of ISO 17799 compliant information security management system using novel ASD method " . proceedings of the IAEA Technical Meeting on Cyber Security of Nuclear Power Plant Instrumentation, Control and Information Systems, pp.17-20, 2006.

R. Yin and K. , Case Study Research, Design and Methods, 1994.