Information security policy as a governance capability in politically complex legislative organizations: a tridimensional configurational model

Abstract

Purpose This conceptual paper aims to examine information security policy (ISP) in Brazilian state legislative assemblies as a formal document that may operate as an institutional governance device and, under specific conditions, become a governance capability. Design/methodology/approach The paper integrates sociological institutionalism, network governance and state-capacity perspectives, in dialogue with governance-oriented information security scholarship, to theorize the conditions under which ISP may become institutionalized. Findings It develops the tridimensional model of legislative information governance (MTGIL), structured around institutional legitimacy, cross-functional coordination and political-administrative capacity and proposes three ideal-type configurations: symbolic compliance, institutional transition and substantive governance. Five testable propositions are derived. Research limitations/implications MTGIL is conceptual and untested. Its propositions, profile classifications and portability beyond Brazilian state legislative assemblies require comparative validation. Practical implications MTGIL offers legislative organizations a diagnostic lens for comparing formal ISP adoption with observable evidence of sponsorship, cross-functional routines, reporting channels, training uptake and continuity mechanisms, thereby informing policy redesign, coordination and continuity planning. Social implications By treating ISP as a governance capability, the paper suggests how legislative organizations may diagnose vulnerabilities affecting citizens’ data rights, democratic accountability and the transparency-confidentiality balance. Originality/value The paper distinguishes ISP as a formal document, an institutional governance device and a potential governance capability. MTGIL theorizes why similar policy documents, control frameworks or compliance scores may follow different institutionalization trajectories when legitimacy, coordination and capacity are configured differently.