INITIATION OF EGIT THROUGH THE SECURITY REVIEW PROCESS: A CASE STUDY OF KT&G CORPORATION

Within the rapidly changing technology environment, companies are under strong pressure to create a paradigm shift to technology-based management methods and new business models. Accordingly, the Enterprise Governance of IT (EGIT) is changing beyond the aspects of IT management and operation activities into priority activities of corporate business strategies. For this, various establishment approaches are being tried, but top-down forms of approaches, which are de facto best practices, are forming the mainstream in terms of effective control while, on the other hand, bottom-up EGIT approaches, which build a system step by step, are hard to find. Thus, the authors conducted a case study on KT&G Corporation, a Korean manufacturer that triggered a successful EGIT system by establishing a bottom-up EGIT system. According to the analysis, a “bottom-up EGIT System with a leverage of the security review process” designed by KT&G's information security manager and IT control manager was delivered from sub-organizations (departments) of the governance structure to higher organizations (institutions) to effectively structure the realization of EGIT across the enterprise through process control and communication. This approach also had the advantage that the company's entire organizations, including the security and control organization, could gradually understand EGIT and rapidly proceed with independent EGIT projects. Through the case analysis, four essential requirements for bottom-up EGIT system establishment are going to be presented.