Because of the lack of information security management theory, there are few empirical studies conducted to examine the effectiveness of management strategies and tools. Thus, the authors would like to combine five related theories - information policy theory, risk management theory, control and audit theory, management system theory, and contingency theory - to develop an integrated theory of information security management (ISM) which may be used as a foundation for