Background and experience
I am interested in cybersecurity management practices and the related organizational change. My research has two key themes: a) studies on crafting and implementation of cybersecurity policies and strategies, and b) studies on cybersecurity management practices’ impact on organizations.
Theory-wise, I have been particularly excited about practice theories and how practices are enacted, changed, and translated in real time and over time as well as how the detailed organizational activity and societal context are closely linked. Research methods-wise, I believe qualitative methods are particularly suitable for studying complex IS and cybersecurity management phenomena. I have employed ethnography and participant observation in varied contexts and have also experience from case studies and clinical research.
Teaching
I am teaching in graduate programs:
- IS-500 IT Management
- IS-429 Human and social aspects of cybersecurity
- IS-509 Strategy and governance of cybersecurity
- IS-510 Secure software development and project management
and supervising master’s degree theses.
Background
I have over 15 years industry background as a practitioner in consulting and business leadership roles (2007-2025). I have consulted companies from startups to publicly traded corporations on cybersecurity leadership, risk and privacy management, secure procurement and outsourcing. I have had leadership responsibilities related to business strategy development and implementation as well as overseeing of business operations, investments and people and resolving issues when necessary.
- Dr. Tech., Department of Information and Knowledge Management, Tampere University of Technology, Finland (2017)
- MSc, Department of Computer Science, Electrical and Space Engineering, Luleå University of Technology, Sweden (2011)
Publishing
I have published in leading IS journals and conferences. Detailed list of publications is presented below.
Niemimaa, E, Niemimaa, M, & Jarvelainen, J. 2024, 'Too Small to Comply? Information Security Management Standardization of a Cybersecurity Startup', ICIS 2024 Proceedings.
Hurmelinna-Laukkanen, P., Niemimaa, E., Rantakari, A., & Helander, N. 2023, 'In the riptide of control and trust: emergence of control practices, suspicion, and distrust in new technology deployment', Journal of Management Studies, vol. 60, no. 8, pp. 1986-2021.
Niemimaa, M. & Niemimaa, E. 2019, 'Abductive innovations in information security policy development: an ethnographic study', European Journal of Information Systems, vol. 28, no. 5, pp. 566-589.
Niemimaa, E. 2017, 'Crafting organizational information security policies', thesis for the degree of Doctor of Science in Technology. Tampere University of Technology. ISBN 978-952-15-4037-0.
Niemimaa, E. & Niemimaa, M. 2017, 'Information systems security policy implementation in practice: from best practices to situated practices', European Journal of Information Systems, vol. 25, no. 1, pp. 1-20.
Niemimaa, E. 2016, 'Crafting an information security policy: insights from an ethnographic study', ICIS 2016 Proceedings, pp. 1-16.
Niemimaa, E. 2016, 'Legitimising information security policy during policy crafting: exploring legimitising strategies', Proceedings of the 27th Australasian Conference on Information Systems (ACIS 2016), pp. 1-11.
Niemimaa, E. 2016, 'A practice lens for understanding the organizational and social challenges of information security management', Proceedings of the 20th Pacific Asia Conference on Information Systems (PACIS 2016).
Niemimaa, M. & Niemimaa, E. 2016, 'Analyzing the relationship between workspace and smart infrastructure reliability and continuity: An ethnography of technicians’ work', Proceedings of the 20th Pacific Asia Conference on Information Systems (PACIS 2016).
Niemimaa, M. & Laaksonen, A. E. 2015, 'Enacting information security policies in practice: three modes of policy compliance', in F.-X. de Vaujany, N. Mitev, G. F. Lanzara & A. Mukherjee (eds.), Materiality, Rules and Regulation: New Trends in Management and Organization Studies, Palgrave Macmillan.
Niemimaa, M., Laaksonen, E. & Harnesk, D. 2013, 'Interpreting information security policy outcomes: a frames of reference perspective', 46th Hawaii International Conference on System Sciences, pp. 4541-4550.
Lindström, J., Harnesk, D., Laaksonen, E. & Niemimaa, M. 2012, 'A methodology for inter-organizational emergency management continuity planning', Managing Crises and Disasters with Emerging Technologies: Advancements, pp. 197-215.