Mala Kaul

Genres of inquiry in design-science research: justification and evaluation of knowledge production

Recognizing that design is at the core of information systems development has led to a design-science research paradigm where differing kinds of knowledge goals give form to differing kinds of knowledge processes within a single study. This paper analyzes knowledge production in design-science research to explain how an endogenous form of pluralism characterizes such studies, making it problematic to associate any design-science study with a single view of knowledge production. Instead, a design-science research study exhibits up to four different modes of reasoning, called genres of inquiry. These genres are derived from two dualities that contrast differing knowledge goals and differing knowledge scope in the knowledge production process. The first duality arises from the sometimes seemingly contradictory knowledge goals of science versus design. The second duality reflects the contradiction between the scope of the knowledge produced, which may be idiographic or nomothetic. The evolutionary and iterative nature of a design-science study compels different knowledge goals and scope at different moments throughout a project. Because of this momentary nature, a single design-science study can be associated with multiple genres of inquiry. This understanding of the variety in the genres of inquiry advances the discourse on the nature of design-science research and the justification and evaluation of its outcomes. Consequently, a corresponding set of criteria for knowledge justification and evaluation is provided for each genre of inquiry.

Information Security Control Theory: Achieving a Sustainable Reconciliation Between Sharing and Protecting the Privacy of Information

Abstract Contemporary organizations operate in highly interconnected environments where they are frequently confronted by the challenge of balancing the protection of information resources with the need for sharing information. This tension between the expected benefits and the potential security risks inherent in the information sharing process, exists in many domains, including business, health care, law enforcement, and military—yet it is not well-understood. We propose an information security control theory to explain and manage this tension. We evaluate this theory through a longitudinal case study of the iterative development of the information security policies for a health information exchange in the western United States. Our study shows that the theory offers a good framework through which to understand the information security policy development process, and a way to reconcile the tension between information sharing and information protection. The theory has practical applicability to many business domains.

A Framework for Managing Complexity in Information Systems

A particularly difficult, but important, challenge in the design and development of contemporary information systems is dealing with complexity. Although complexity has been richly discussed from various perspectives in the literature, there is limited guidance on how to address complexity in information systems design. This research analyzes different approaches to handling complexity and finds that there exists a plurality of ways in which to address complexity that are dependent upon the given situation. This analysis results in the derivation of a framework for addressing complexity in information systems. The framework explicitly recognizes implications and limitations of decomposition, inner-outer environments, abstractions, and decentralization, and the role of Ontology. Application of the framework is intended to enable information researchers to identify and adapt applicable strategies for managing complexity in any domain.

A Framework for Evaluating the Tension between Sharing and Protecting Health Information

Health information exchange (HIE) is expected to improve the quality and cost of healthcare but sustained use of HIE by providers has been difficult to achieve. A number of factors play a role in that process including concern for the security and privacy of the exchanged information. This tension between the expected benefits of HIE resulting from collaboration and information sharing on the one hand, and the potential security risks inherent in the exchange process on the other hand, is not well understood. We propose an information security control theory to explain this tension. We evaluate this theory through a case study of the iterative development of the information security policy for an HIE in the western United States. We find that the theory offers a good framework through which to understand the information security policy development process.

Designing Artifacts for Systems of Information

This paper reports an exploratory study of information systems (IS) design professionals that offers insight into the evolution of the systems concept in systems design practice. The analysis distinguishes the current object of this design effort as systems of information (SI). SI differs from IS in that SI seeks to maintain the necessary degree of integrated systematicity while retaining or acquiring the necessary technology. IS, in the past, had an implied capacity to build a complete system from the ground up. SI has an implied constraint that certain technological components must be “taken as given” and the design problem becomes one of maintaining an ideal socio-technical system as the various technologies evolve within and around the system.