AIS Logo
Living knowledge for digital leadership
All AI Governance & Ethics Digital Transformation & Innovation Supply Chain & IoT SME & IT Management Platform Ecosystems & Strategy Cybersecurity & Risk AI Applications & Technologies Healthcare & Well-being Digital Work & Collaboration
Career Trajectory Analysis of Fortune 500 CIOs: A LinkedIn Perspective

Career Trajectory Analysis of Fortune 500 CIOs: A LinkedIn Perspective

Benjamin Richardson, Degan Kettles, Daniel Mazzola, Hao Li
This study analyzes the career paths of Chief Information Officers (CIOs) at Fortune 500 companies and compares them to other C-suite executives. Using career data from 2,821 executives on LinkedIn, supplemented by interviews with six Fortune 500 CIOs, the research identifies the unique demographic, educational, and professional characteristics that define a CIO's journey to the top.

Problem While the CIO role is critical for corporate success, there is limited comprehensive data on how individuals ascend to this position, especially compared to roles like CEO or CFO. Previous studies were often based on small sample sizes, creating a knowledge gap about the specific skills, experiences, and timelines necessary to become a CIO at a top-tier organization.

Outcome - Aspiring CIOs tend to be more racially diverse, work for more companies, and hold more positions over their careers compared to other C-suite executives.
- The path to becoming a Fortune 500 CIO is the longest among executive roles, averaging 23.5 years from career start.
- CIOs are more likely to have a technical undergraduate degree (70.7%) and pursue business-related education at the graduate level.
- Internal promotion is the most significant factor in accelerating a CIO's career, reducing the time to reach a top C-level position by nearly 2.5 years compared to external hires.
CIO, IT Leadership, Fortune 500, LinkedIn, Career Progression, Mixed Methods
Beyond Technology: A Multi-Theoretical Examination of Immersive Technology Adoption in Indian Healthcare

Beyond Technology: A Multi-Theoretical Examination of Immersive Technology Adoption in Indian Healthcare

Rajeev Kumar Ray, Navneet Kumar Singh, Shikha Gupta, Amit Singh, Devi Prasad Dash
This study examines the key factors driving the adoption of immersive technologies (like VR/AR) in the Indian healthcare sector. Using the Technology-Organization-Environment (TOE) and Diffusion of Innovation (DOI) theoretical frameworks, the research employs the grey-DEMATEL method to analyze input from healthcare experts and rank the facilitators of adoption.

Problem Healthcare systems in emerging economies like India face significant challenges, including resource constraints and infrastructure limitations, when trying to adopt advanced immersive technologies. This study addresses the research gap by moving beyond purely technological aspects to understand the complex interplay of organizational and environmental factors that influence the successful implementation of these transformative tools in a real-world healthcare context.

Outcome - Organizational and environmental factors are significantly more influential than technological factors in driving the adoption of immersive healthcare technologies.
- The most critical facilitator for adoption is 'Adaptability to change' within the healthcare organization, followed by 'Regulatory support' and 'Leadership support'.
- External factors, such as government support and partnerships, play a crucial role in shaping an organization's internal readiness for new technology.
- Technological aspects like user-friendliness and data security, while important, ranked lower in prominence, suggesting they are insufficient drivers of adoption without strong organizational and environmental backing.
Immersive Technology, Healthcare, Technology Adoption, Organizational Factors, Environmental Factors, Grey DEMATEL
Procuring Accessible Third-Party Web-Based Software Applications for Inclusivity: A Socio-technical Approach

Procuring Accessible Third-Party Web-Based Software Applications for Inclusivity: A Socio-technical Approach

Niamh Daly, Ciara Heavin, James Northridge
This study investigates how universities can improve their decision-making processes when procuring third-party web-based software to enhance accessibility for students and staff. Using a socio-technical systems framework, the research conducts a case study at a single university, employing qualitative interviews with procurement experts and users to evaluate current practices.

Problem The procurement process for web-based software in higher education often fails to adequately consider web accessibility standards. This oversight creates barriers for an increasingly diverse student population, including those with disabilities, and represents a failure to integrate equality, diversity, and inclusion into critical technology-related decisions.

Outcome - Procurement processes often lack standardized, early-stage accessibility testing, with some evaluations occurring after the software has already been acquired.
- A significant misalignment exists between the accessibility testing practices of software vendors and the actual needs of the higher education institution.
- Individuals with disabilities are not typically involved in the initial evaluation phase, though their feedback might be sought after implementation, leading to reactive rather than proactive solutions.
- Accessible software directly improves student engagement and fosters a more inclusive campus environment, benefiting the entire university community.
- The research proposes using the SEIPS 2.0 model as a structured framework to map the procurement work system, improve accessibility evaluation, and better integrate diverse expertise into the decision-making process.
Web Accessibility (WA), Procurement, Web-Based Software, Socio-Technical Systems, Higher Education Institutions (HEIs)
Exploring the Role of Third Parties in Digital Transformation Initiatives: A Problematized Assumptions Perspective

Exploring the Role of Third Parties in Digital Transformation Initiatives: A Problematized Assumptions Perspective

Jack O'Neill, David Pidoyma, Ciara Northridge, Shivani Pai, Stephen Treacy, and Andrew Brosnan
This study investigates the role and influence of external partners in corporate digital transformation projects. Using a 'problematized assumptions' approach, the research challenges the common view that transformation is a purely internal affair by analyzing existing literature and conducting 26 semi-structured interviews with both client organizations and third-party service providers.

Problem Much of the existing research on digital transformation describes it as an initiative orchestrated primarily within an organization, which overlooks the significant and growing market for third-party consultants and services. This gap in understanding leads to problematic assumptions about how transformations are managed, creating risks and missed opportunities for businesses that increasingly rely on external expertise.

Outcome - A fully outsourced digital transformation is infeasible, as core functions like culture and change management must be led internally.
- Third parties play a critical role, far greater than literature suggests, by providing specialized expertise for strategy development and technical execution.
- The most effective approach is a bimodal model, where the organization owns the high-level vision and mission, while collaborating with third parties on strategy and tactics.
- Digital transformation should be viewed as a continuous process of socio-technical change and evolution, not a project with a defined endpoint.
- Success is more practically measured by optimizing operational components (Vision, Mission, Objectives, Strategy, Tactics - VMOST) rather than solely focusing on a reconceptualization of value.
Digital Transformation, Third Parties, Managed Services, Problematization, Outsourcing, IT Strategy, Socio-technical Change
Unveiling Enablers to the Use of Generative AI Artefacts in Rural Educational Settings: A Socio-Technical Perspective

Unveiling Enablers to the Use of Generative AI Artefacts in Rural Educational Settings: A Socio-Technical Perspective

Pramod K. Patnaik, Kunal Rao, Gaurav Dixit
This study investigates the factors that enable the use of Generative AI (GenAI) tools in rural educational settings within developing countries. Using a mixed-method approach that combines in-depth interviews and the Grey DEMATEL decision-making method, the research identifies and analyzes these enablers through a socio-technical lens to understand their causal relationships.

Problem Marginalized rural communities in developing countries face significant challenges in education, including a persistent digital divide that limits access to modern learning tools. This research addresses the gap in understanding how Generative AI can be practically leveraged to overcome these education-related challenges and improve learning quality in under-resourced regions.

Outcome - The study identified fifteen key enablers for using Generative AI in rural education, grouped into social and technical categories.
- 'Policy initiatives at the government level' was found to be the most critical enabler, directly influencing other key factors like GenAI training for teachers and students, community awareness, and school leadership commitment.
- Six novel enablers were uncovered through interviews, including affordable internet data, affordable telecommunication networks, and the provision of subsidized devices for lower-income groups.
- An empirical framework was developed to illustrate the causal relationships among the enablers, helping stakeholders prioritize interventions for effective GenAI adoption.
Generative AI, Rural, Education, Digital Divide, Interviews, Socio-technical Theory
Mehr als Vollzeit: Fractional CIOs in KMUs

Mehr als Vollzeit: Fractional CIOs in KMUs

Simon Kratzer, Markus Westner, Susanne Strahringer
This study investigates the emerging role of 'Fractional CIOs,' who provide part-time IT leadership to small and medium-sized enterprises (SMEs). It synthesizes findings from a research project involving 62 Fractional CIOs across 10 countries and contextualizes them for the German market through interviews with three local Fractional CIOs/CTOs. The research aims to define the role, identify different types of engagements, and uncover key success factors.

Problem Small and medium-sized enterprises (SMEs) increasingly require sophisticated IT management to remain competitive, yet often lack the resources or need to hire a full-time Chief Information Officer (CIO). This gap leaves them vulnerable, as IT responsibilities are often handled by non-experts, leading to potential productivity losses and security risks. The study addresses this challenge by exploring a flexible and cost-effective solution.

Outcome - The study defines the 'Fractional CIO' role as a flexible, part-time IT leadership solution for SMEs, combining the benefits of an internal executive with the flexibility of an external consultant.
- Four distinct engagement types are identified for Fractional CIOs: Strategic IT Management, Restructuring, Rapid Scaling, and Hands-on Support, each tailored to different business needs.
- The most critical success factors for a successful engagement are trust between the company and the Fractional CIO, strong support from the top management team, and the CIO's personal integrity.
- While the Fractional CIO model is not yet widespread in Germany, the study concludes it offers significant potential value for German SMEs seeking expert IT leadership without the cost of a full-time hire.
- Three profiles of Fractional CIOs were identified based on their engagement styles: Strategic IT-Coaches, Full-Ownership-CIOs, and Change Agents.
Fractional CIO, Fractional CTO, Part-Time Interim Management, SMEs, IT Management, Chief Information Officer
Setting Priorities for Exploiting and Exploring Digital Capabilities in a Crisis

Setting Priorities for Exploiting and Exploring Digital Capabilities in a Crisis

Sultana Lubna Alam, Kristijan Mirkovski, Rens Scheepers, Dilal Saundage
This study investigates how organizations should prioritize their digital investments during a crisis. Based on an in-depth analysis of 18 Australian organizations' responses to the COVID-19 pandemic, the paper provides a framework for IT leaders to decide whether to exploit existing digital capabilities or explore new ones.

Problem In times of crisis, organizations rely heavily on their digital capabilities for survival and adaptation. However, IT leaders face the critical dilemma of whether to focus limited resources on making the most of current technologies (exploitation) or investing in new, innovative solutions (exploration), with little guidance on how to make this choice effectively.

Outcome - Organizations should assess their 'starting position' at the onset of a crisis across five key factors: people, cultural, technical, managerial, and financial.
- Based on this assessment, one of three crisis responses should be pursued: 'Survive', 'Survive and Thrive', or 'Thrive and Drive'.
- For a 'Survive' response, organizations should focus exclusively on exploiting existing digital capabilities to maintain operations.
- A 'Survive and Thrive' response requires initially exploiting current capabilities, followed by a later shift toward exploring new ones.
- Organizations in a strong position can pursue a 'Thrive and Drive' response, concurrently exploiting and exploring capabilities, with an increasing focus on exploration as the crisis progresses.
crisis management, digital capabilities, exploitation, exploration, organizational ambidexterity, IT leadership, COVID-19
Process science: the interdisciplinary study of socio-technical change

Process science: the interdisciplinary study of socio-technical change

Jan vom Brocke, Wil M. P. van der Aalst, Nicholas Berente, Boudewijn van Dongen, Thomas Grisold, Waldemar Kremser, Jan Mendling, Brian T. Pentland, Maximilian Roeglinger, Michael Rosemann and Barbara Weber
This paper introduces and defines "Process science" as a new interdisciplinary field for studying socio-technical processes, which are the interactions between humans and digital technologies over time. It proposes a framework based on four key principles, leveraging digital trace data and advanced analytics to describe, explain, and ultimately intervene in how these processes unfold.

Problem Many contemporary phenomena, from business operations to societal movements, are complex, dynamic processes rather than static entities. Traditional scientific approaches often fail to capture this continuous change, creating a gap in our ability to understand and influence the evolving world, especially in an era rich with digital data.

Outcome - Defines Process Science as the interdisciplinary study of socio-technical processes, focusing on how coherent series of changes involving humans and technology occur over time.
- Proposes four core principles for the field: (1) centering on socio-technical processes, (2) using scientific investigation, (3) embracing multiple disciplines, and (4) aiming to create real-world impact.
- Emphasizes the use of digital trace data and advanced computational techniques, like process mining, to gain unprecedented insights into process dynamics.
- Argues that the goal of Process Science is not only to observe and explain change but also to actively shape and intervene in processes to solve real-world problems.
Process science, Socio-technical processes, Digital trace data, Interdisciplinary research, Process mining, Change management, Computational social science
Navigating Generative AI Usage Tensions in Knowledge Work: A Socio-Technical Perspective

Navigating Generative AI Usage Tensions in Knowledge Work: A Socio-Technical Perspective

Anna Gieß, Sofia Schöbel, and Frederik Möller
This study explores the complex challenges and advantages of integrating Generative Artificial Intelligence (GenAI) into knowledge-based work. Using socio-technical systems theory, the researchers conducted a systematic literature review and qualitative interviews with 18 knowledge workers to identify key points of conflict. The paper proposes solutions like human-in-the-loop models and robust AI governance policies to foster responsible and efficient GenAI usage.

Problem As organizations rapidly adopt GenAI to boost productivity, they face significant tensions between efficiency, reliability, and data privacy. There is a need to understand these conflicting forces to develop strategies that maximize the benefits of GenAI while mitigating risks related to ethics, data protection, and over-reliance on the technology.

Outcome - Productivity-Reflection Tension: GenAI increases efficiency but can lead to blind reliance and reduced critical thinking on the content it generates.
- Availability-Reliability Contradiction: While GenAI offers constant access to information, its output is not always reliable, increasing the risk of misinformation.
- Efficiency-Traceability Dilemma: Content is produced quickly, but the lack of clear source references makes verification difficult in professional settings.
- Usefulness-Transparency Tension: The utility of GenAI is limited by a lack of transparency in how it generates outputs, which reduces user trust.
- Convenience-Data Protection Tension: GenAI simplifies tasks but creates significant concerns about the privacy and security of sensitive information.
Generative AI, Knowledge work, Tensions, Socio-technical systems theory
Revisiting the Responsibility Gap in Human-AI Collaboration from an Affective Agency Perspective

Revisiting the Responsibility Gap in Human-AI Collaboration from an Affective Agency Perspective

Jonas Rieskamp, Annika Küster, Bünyamin Kalyoncuoglu, Paulina Frieda Saffer, and Milad Mirbabaie
This study investigates how responsibility is understood and assigned when artificial intelligence (AI) systems influence decision-making processes. Using qualitative interviews with experts across various sectors, the research explores how human oversight and emotional engagement (affective agency) shape accountability in human-AI collaboration.

Problem As AI systems become more autonomous in fields from healthcare to finance, a 'responsibility gap' emerges. It becomes difficult to assign accountability for errors or outcomes, as responsibility is diffused among developers, users, and the AI itself, challenging traditional models of liability.

Outcome - Using AI does not diminish human responsibility; instead, it often intensifies it, requiring users to critically evaluate and validate AI outputs.
- Most professionals view AI as a supportive tool or 'sparring partner' rather than an autonomous decision-maker, maintaining that humans must have the final authority.
- The uncertainty surrounding how AI works encourages users to be more cautious and critical, which helps bridge the responsibility gap rather than leading to blind trust.
- Responsibility remains anchored in human oversight, with users feeling accountable not only for the final decision but also for how the AI was used to reach it.
Artificial Intelligence (AI), Responsibility Gap, Responsibility in Human-AI collaboration, Decision-Making, Sociomateriality, Affective Agency
Trapped by Success – A Path Dependence Perspective on the Digital Transformation of Mittelstand Enterprises

Trapped by Success – A Path Dependence Perspective on the Digital Transformation of Mittelstand Enterprises

Linus Lischke
This study investigates why German Mittelstand enterprises (MEs), or mid-sized companies, often implement incremental rather than radical digital transformation. Using path dependence theory and a multiple-case study methodology, the research explores how historical success anchors strategic decisions in established business models, limiting the pursuit of new digital opportunities.

Problem Successful mid-sized companies are often cautious when it comes to digital transformation, preferring minor upgrades over fundamental changes. This creates a research gap in understanding why these firms remain on a slow, incremental path, even when faced with significant digital opportunities that could drive growth.

Outcome - Successful business models create a 'functional lock-in,' where companies become trapped by their own success, reinforcing existing strategies and discouraging radical digital change.
- This lock-in manifests in three ways: ingrained routines (normative), deeply held assumptions about the business (cognitive), and investment priorities that favor existing operations (resource-based).
- MEs tend to adopt digital technologies primarily to optimize current processes and enhance existing products, rather than to create new digital business models.
- As a result, even promising digital innovations are often rejected if they do not seamlessly align with the company's traditional operations and core products.
Digital Transformation, Path Dependence, Mittelstand Enterprises
Designing Digital Service Innovation Hubs: An Ecosystem Perspective on the Challenges and Requirements of SMEs and the Public Sector

Designing Digital Service Innovation Hubs: An Ecosystem Perspective on the Challenges and Requirements of SMEs and the Public Sector

Jannika Marie Schäfer, Jonas Liebschner, Polina Rajko, Henrik Cohnen, Nina Lugmair, and Daniel Heinz
This study investigates the design of a Digital Service Innovation Hub (DSIH) to facilitate and orchestrate service innovation for small and medium-sized enterprises (SMEs) and public organizations. Using a design science research approach, the authors conducted 17 expert interviews and focus group validations to analyze challenges and derive specific design requirements. The research aims to create a blueprint for a hub that moves beyond simple networking to actively manage innovation ecosystems.

Problem Small and medium-sized enterprises (SMEs) and public organizations often struggle to innovate within service ecosystems due to resource constraints, knowledge gaps, and difficulties finding the right partners. Existing Digital Innovation Hubs (DIHs) typically focus on specific technological solutions and matchmaking but fail to provide the comprehensive orchestration needed for sustained service innovation. This gap leaves many organizations unable to leverage the full potential of collaborative innovation.

Outcome - The study identifies four key challenge areas for SMEs and public organizations: exogenous factors (e.g., market speed, regulations), intraorganizational factors (e.g., resistant culture, outdated systems), knowledge and skill gaps, and partnership difficulties.
- It proposes a set of design requirements for Digital Service Innovation Hubs (DSIHs) centered on three core functions: (1) orchestrating actors by facilitating matchmaking, collaboration, and funding opportunities.
- (2) Facilitating structured knowledge transfer by sharing best practices, providing tailored content, and creating interorganizational learning formats.
- (3) Ensuring effective implementation and provision of the hub itself through user-friendly design, clear operational frameworks, and tangible benefits for participants.
service innovation, ecosystem, innovation hubs, SMEs, public sector
Design Principles for SME-focused Maturity Models in Information Systems

Design Principles for SME-focused Maturity Models in Information Systems

Stefan Rösl, Daniel Schallmo, and Christian Schieder
This study addresses the limited practical application of maturity models (MMs) among small and medium-sized enterprises (SMEs). Through a structured analysis of 28 relevant academic articles, the researchers developed ten actionable design principles (DPs) to improve the usability and strategic impact of MMs for SMEs. These principles were subsequently validated by 18 recognized experts to ensure their practical relevance.

Problem Maturity models are valuable tools for assessing organizational capabilities, but existing frameworks are often too complex, resource-intensive, and not tailored to the specific constraints of SMEs. This misalignment leads to low adoption rates, preventing smaller businesses from effectively using these models to guide their transformation and innovation efforts.

Outcome - The study developed and validated ten actionable design principles (DPs) for creating maturity models specifically tailored for Small and Medium-sized Enterprises (SMEs).
- These principles, confirmed by experts as highly useful, provide a structured foundation for researchers and designers to build MMs that are more accessible, relevant, and usable for SMEs.
- The research bridges the gap between MM theory and real-world applicability, enabling the development of tools that better support SMEs in strategic planning and capability improvement.
Design Principles, Maturity Model, Capability Assessment, SME, Information Systems, SME-specific MMs
Taking a Sociotechnical Perspective on Self-Sovereign Identity – A Systematic Literature Review

Taking a Sociotechnical Perspective on Self-Sovereign Identity – A Systematic Literature Review

Lukas Florian Bossler, Teresa Huber, and Julia Kroenung
This study provides a comprehensive analysis of academic literature on Self-Sovereign Identity (SSI), a system that aims to give individuals control over their digital data. Through a systematic literature review, the paper identifies and categorizes the key sociotechnical challenges—both technical and social—that affect the implementation and widespread adoption of SSI. The goal is to map the current research landscape and highlight underexplored areas.

Problem As individuals use more internet services, they lose control over their personal data, which is often managed and monetized by large tech companies. While Self-Sovereign Identity (SSI) is a promising solution to restore user control, academic research has disproportionately focused on technical aspects like security. This has created a significant knowledge gap regarding the crucial social challenges, such as user acceptance, trust, and usability, which are vital for SSI's real-world success.

Outcome - Security and privacy are the most frequently discussed challenges in SSI literature, often linked to the use of blockchain technology.
- Social factors essential for adoption, including user acceptance, trust, usability, and control, are significantly overlooked in current academic research.
- Over half of the analyzed papers discuss SSI in a general sense, with a lack of focus on specific application domains like e-government, healthcare, or finance.
- A potential mismatch exists between SSI's privacy needs and the inherent properties of blockchain, suggesting that alternative technologies should be explored.
- The paper concludes there is a strong need for more domain-specific and design-oriented research to address the social hurdles of SSI adoption.
self-sovereign identity, decentralized identity, blockchain, sociotechnical challenges, digital identity, systematic literature review
Managing IT Challenges When Scaling Digital Innovations

Managing IT Challenges When Scaling Digital Innovations

Sara Schiffer, Martin Mocker, Alexander Teubner
This paper presents a case study on 'freeyou,' the digital innovation spinoff of a major German insurance company. It examines how the company successfully transitioned its online-only car insurance product from an initial 'exploring' phase to a profitable 'scaling' phase. The study highlights the necessary shifts in IT approaches, organizational structure, and data analytics required to manage this transition.

Problem Many digital innovations fail when they move from the idea validation stage to the scaling stage, where they need to become profitable and handle large volumes of users. This study addresses the common IT-related challenges that cause these failures and provides practical guidance for managers on how to navigate this critical transition successfully.

Outcome - Prepare for a significant cultural shift: Management must explicitly communicate the change in focus from creative exploration and prototyping to efficient and profitable operations to align the team and manage expectations.
- Rearchitect IT systems for scalability: Systems built for speed and flexibility in the exploration phase must be redesigned or replaced with robust, efficient, and reliable platforms capable of handling a large user base.
- Adjust team composition and skills: The transition to scaling requires different expertise, shifting from IT generalists who explore new technologies to specialists focused on process automation, data analytics, and stable operations. Companies must be prepared to bring in new talent and restructure teams accordingly.
digital innovation, scaling, IT management, organizational change, case study, insurtech, innovation lifecycle
Identifying and Addressing Senior Executives' Different Perceptions of the Value of IT Investments

Identifying and Addressing Senior Executives' Different Perceptions of the Value of IT Investments

Alastair Tipple, Hameed Chughtai, Jonathan H. Klein
This study explores how Chief Information Officers (CIOs) can uncover and manage differing opinions among senior executives regarding the value of IT investments. Using a case study at a U.K. firm, the researchers applied a method based on Repertory (Rep) Grid analysis and heat maps to make these perception gaps visible and actionable.

Problem The full benefits of IT investments are often not realized because senior leaders lack a shared understanding of their value and effectiveness. This misalignment can undermine project support and success, yet CIOs typically lack practical tools to objectively identify and resolve these hidden differences in perception within the management team.

Outcome - Repertory (Rep) Grids combined with heat maps are a practical and effective technique for making executives' differing perceptions of IT value explicit and visible.
- The method provides a structured, data-driven foundation for CIOs to have tailored, objective conversations with individual leaders to build consensus.
- By creating a common set of criteria for evaluation, the process helps align the senior management team and fosters a shared understanding of IT's strategic contribution.
- The visual nature of heat maps helps focus discussions on specific points of disagreement, reducing emotional conflict and accelerating the path to a common ground.
- The approach allows CIOs to develop targeted action plans to address specific gaps in understanding, ultimately improving support for and the realization of value from IT investments.
IT investment value, senior management perception, Repertory Grid, heat maps, CIO, strategic alignment, social alignment
How to Successfully Navigate Crisis-Driven Digital Transformations

How to Successfully Navigate Crisis-Driven Digital Transformations

Ralf Plattfaut, Vincent Borghoff
This study investigates how digital transformations initiated by a crisis, such as the COVID-19 pandemic, differ from transformations under normal circumstances. Through case studies of three German small and medium-sized organizations (the 'Mittelstand'), the research identifies challenges to established transformation 'logics' and provides recommendations for successfully managing these events.

Problem While digital transformation is widely studied, there is little understanding of how the process works when driven by an external crisis rather than strategic planning. The COVID-19 pandemic created an urgent, unprecedented need for businesses to digitize their operations, but existing frameworks were ill-suited for this high-pressure, uncertain environment.

Outcome - The trigger for digital transformation in a crisis is the external shock itself, not the emergence of new technology.
- Decision-making shifts from slow, consensus-based strategic planning to rapid, top-down ad-hoc reactions to ensure survival.
- Major organizational restructuring is deferred; instead, companies form small, agile steering groups to manage the transformation efforts.
- Normal organizational barriers like inertia and resistance to change significantly decrease during the crisis due to the clear and urgent need for action.
- After the crisis, companies must actively work to retain the agile practices learned and manage the potential re-emergence of resistance as urgency subsides.
Digital Transformation, Crisis Management, Organizational Change, German Mittelstand, SMEs, COVID-19, Business Resilience
How Large Companies Can Help Small and Medium-Sized Enterprise (SME) Suppliers Strengthen Cybersecurity

How Large Companies Can Help Small and Medium-Sized Enterprise (SME) Suppliers Strengthen Cybersecurity

Jillian K. Kwong, Keri Pearlson
This study investigates the cybersecurity challenges faced by small and medium-sized enterprise (SME) suppliers and proposes actionable strategies for large companies to help them improve. Based on interviews with executives and cybersecurity experts, the paper identifies key barriers SMEs encounter and outlines five practical actions large firms can take to strengthen their supply chain's cyber resilience.

Problem Large companies increasingly require their smaller suppliers to meet the same stringent cybersecurity standards they do, creating a significant burden for SMEs with limited resources. This gap creates a major security vulnerability, as attackers often target less-secure SMEs as a backdoor to access the networks of larger corporations, posing a substantial third-party risk to entire supply chains.

Outcome - SME suppliers are often unable to meet the security standards of their large partners due to four key barriers: unfriendly regulations, organizational culture clashes, variability in cybersecurity frameworks, and misalignment of business processes.
- Large companies can proactively strengthen their supply chain by providing SMEs with the resources and expertise needed to understand and comply with regulations.
- Creating incentives for meeting security benchmarks is more effective than penalizing suppliers for non-compliance.
- Large firms should develop programs to help SMEs elevate their cybersecurity culture and align security processes with their own.
- Coordinating with other large companies to standardize cybersecurity frameworks and assessment procedures can significantly reduce the compliance burden on SMEs.
Cybersecurity, Supply Chain Management, Third-Party Risk, Small and Medium-Sized Enterprises (SMEs), Cyber Resilience, Vendor Risk Management
Load More Showing 18 of 19