S. Gottwald, Study on Critical Dependencies of Energy, Finance and Transport Infrastructures on ICT Infrastructure European Commission, 2009.

F. Hare, The Cyber Threat to National Security Why Can't We Agree, Conference on Cyber Conflict Proceedings, 2010.

M. Gercke, Understanding Cybercrime: A Guide for Developing Countries, 2011.

V. Jr, R. B. Henning, R. Siraj, and A. , Information Assurance Measures and Metrics -State of Practice and Proposed Taxonomy, Proceedings of the 36th Annual Hawaii International Conference on System Sciences, p.10, 2003.

G. Fink, K. F. O-'donoghue, B. L. Chappell, and T. G. Turner, A Metrics-Based Approach to Intrusion Detection System Evaluation for Distributed Real-Time Systems, Proceedings of the 16th International Parallel and Distributed Processing Symposium, p.17, 2002.
DOI : 10.1109/ipdps.2002.1016475

E. W. Bernroider, S. Koch, and V. Stix, A Comprehensive Framework Approach using Content, Context, Process Views to Combine Methods from Operations Research for IT Assessments, Information Systems Management, vol.3, issue.4, pp.75-88, 2013.
DOI : 10.1111/j.1540-5915.1978.tb01378.x

T. Herath, H. Herath, and W. G. Bremser, Balanced Scorecard Implementation of Security Strategies: A Framework for IT Security Performance Management, Information Systems Management, vol.25, issue.1, pp.72-81, 2010.
DOI : 10.1016/S0167-9236(98)00086-4

R. S. Kaplan and D. P. Norton, The Balanced Scorecard -measures that drive performance, Harvard Business Review, vol.70, issue.8, 1992.

R. S. Kaplan and D. P. Norton, Putting the Balanced Scorecard to Work, Harvard Business Review, vol.71, p.14, 1993.
DOI : 10.1016/B978-0-7506-7009-8.50023-9

R. S. Kaplan and D. P. Norton, Balanced Scorecard, 1996.
DOI : 10.1007/978-3-8349-9320-5_12

S. Lawrence and U. Sharma, Commodification of Education and Academic LABOUR???Using the Balanced Scorecard in a University Setting, Critical Perspectives on Accounting, vol.13, issue.5-6, pp.661-677, 2002.
DOI : 10.1006/cpac.2002.0562

D. Protti, A proposal to use a balanced scorecard to evaluate Information for Health: an information strategy for the modern NHS (1998???2005), Computers in Biology and Medicine, vol.32, issue.3, pp.221-236, 1998.
DOI : 10.1016/S0010-4825(02)00017-3

K. Littler, P. Aisthorpe, R. Hudson, and K. Keasey, A new approach to linking strategy formulation and strategy implementation: an example from the UK banking sector, International Journal of Information Management, vol.20, issue.6, pp.411-428, 2000.
DOI : 10.1016/S0268-4012(00)00036-0

D. Irwin, Strategy mapping in the public sector, Long Range Planning, vol.35, issue.6, pp.637-647, 2002.
DOI : 10.1016/S0024-6301(02)00158-9

G. Southern, From Teaching to Practice, via Consultancy, and then to Research?, European Management Journal, vol.20, issue.4, pp.401-408, 2002.
DOI : 10.1016/S0263-2373(02)00060-9

H. Ahn, Applying the Balanced Scorecard Concept: An Experience Report, Long Range Planning, vol.34, issue.4, pp.441-461, 2001.
DOI : 10.1016/S0024-6301(01)00057-7

H. Norreklit, The balance on the balanced scorecard a critical analysis of some of its assumptions, Management Accounting Research, vol.11, issue.1, pp.65-88, 2000.
DOI : 10.1006/mare.1999.0121

M. Martinsons, R. Davison, and D. Tse, The balanced scorecard: a foundation for the strategic management of information systems, Decision Support Systems, vol.25, issue.1, pp.71-88, 1999.
DOI : 10.1016/S0167-9236(98)00086-4

M. Roseman and J. Wiese, Measuring the Performance of ERP Software ? a Balanced Scorecard Approach, Australasian Conference on Information Systems, vol.10, 1999.

V. Grembergen, The Balanced Scorecard and IT Governance, Information Systems Control, 2000.

E. W. Bernroider and A. Hampel, An Application of the Balanced Scorecard as a Strategic IT-Controlling Instrument for E-Business Development, International Conference on Electronic Business, 2003.

S. M. Huang, C. L. Lee, and A. C. Kao, Balancing performance measures for information security management, Industrial Management & Data Systems, vol.106, issue.2, pp.242-255, 2006.
DOI : 10.1108/02635570110390071

G. A. De-oliveira-alves, L. F. Da-costa-carmo, and A. C. Almeida, Enterprise Security Governance; A practical guide to implement and control Information Security Governance (ISG). Business-Driven IT Management BDIM '06. The First IEEE, pp.71-80, 2006.

D. Royer and M. Meints, Enterprise Identity Management ??? Towards a Decision Support Framework Based on the Balanced Scorecard Approach, Business & Information Systems Engineering, vol.44, issue.3, 2009.
DOI : 10.1007/BF03250934

P. Charuenporn and S. Intakosum, Qos-Security Metrics Based on ITIL and COBIT Standard for Measurement Web Services, Journal of Universal Computer Science, vol.18, p.24, 2012.

K. Peffers, T. Tuunanen, M. A. Rothenberger, and S. Chatterjee, A Design Science Research Methodology for Information Systems Research, Journal of Management Information Systems, vol.24, issue.3, pp.45-77, 2007.
DOI : 10.2753/MIS0742-1222240302
URL : http://www.sirel.fi/ttt/Downloads/Design Science Research Methodology 2008.pdf

A. R. Hevner, A three cycle view of design science research, Scandinavian journal of information systems, vol.19, issue.4, 2007.

E. W. Bernroider and J. Mitlöhner, Characteristics of the Multiple Attribute Decision Making Methodology in Enterprise Resource Planning Software Decisions, 2005.

M. Merz, Entwicklung einer indikatorenbasierten Methodik zur Vulnerabilitätsanalyse für die Bewertung von Risiken in der industriellen Produktion, 2011.

P. Atteslander, Methoden der empirischen Sozialforschung, 2008.

I. Iec, The ISMS family of standards (2700X) Joint Technical Committee ISO/IEC JTC 1, Information technology, 2014.

K. P. Yoon and C. Hwang, Multiple attribute decision making: An introduction. Sage University Paper series on Quantitative Applications in the Social Sciences, p.Sage, 1995.
DOI : 10.4135/9781412985161

E. W. Bernroider and V. Stix, Profile distance method???a multi-attribute decision making approach for information system investments, Decision Support Systems, vol.42, issue.2, pp.988-998, 2006.
DOI : 10.1016/j.dss.2005.02.006

S. Sahibudin, M. Sharifi, and M. Ayat, Combining ITIL, COBIT and ISO/IEC 27002 in Order to Design a Comprehensive IT Framework in Organizations, 2008 Second Asia International Conference on Modelling & Simulation (AMS), pp.749-753, 2008.
DOI : 10.1109/AMS.2008.145

P. Grimm, Social Desirability Bias Wiley International Encyclopedia of Marketing, 2010.