Marko Ilmari Niemimaa

• Zimmer, Markus Philipp; Vassilakopoulou, Polyxeni; Grisot, Miria & Niemimaa, Marko Ilmari (2026). Embracing contrarian thinking: value-reflexive research for a better world. European Journal of Information Systems. ISSN 0960-085X. 35(2), p. 165–177. doi: 10.1080/0960085x.2026.2648981. Full text in Research Archive Show summary

  Scientific progress relies on contrarian thinking that questions assumptions shaping how scholars frame, study, or theorize phenomena. Unexamined, such assumptions perpetuate the same views, practices, and explanations, building entrenched research trajectories that limit scholarly debate on understanding the world. If we are interested in a healthy Information Systems (IS) discipline that contributes to a better world, we require precisely this openness to different understandings of the world. Therefore, for this special issue, we invited original submissions that embrace contrarian thinking and engage in value-reflexivity when investigating and theorizing about digital phenomena. In this editorial, we synthesize previous work to define contrarian thinking and link it to value-reflexivity. We then present how the special issue articles embrace such thinking through value-reflexivity. Our contribution to IS research is twofold: first, we illustrate the importance of such thinking for triggering and upholding vigorous debate on phenomena, research methods, and theory; second, we invite and encourage scholars to embrace contrarian thinking through value-reflexivity. By bringing contrarian thinking through value-reflexivity into explicit consideration, we hope to foster the boldness required for new, and even radical ideas for IS research to thrive and contribute to a better world.

• Adamu, Meseret Assefa; Niemimaa, Marko Ilmari & Spagnoletti, Paolo (2026). Temporality of Cybersecurity Culture Amid Rapid Digital Transformation: Evidence From an Ethiopian Bank. Electronic Journal of Information Systems in Developing Countries. 92(2). doi: 10.1002/isd2.70058. Full text in Research Archive Show summary

  Organizational reliance on emerging digital technologies that are transforming the work patterns has left organizations vulnerable to sophisticated cyber threats. Industry reports and incident cases indicate that the rapid pace of digital transformation exacerbates these issues, as organizations' cybersecurity posture must keep pace with the changing organizational and technological landscape. Prior literature suggests that fostering cybersecurity culture (CSC) is foundational for any cybersecurity effort. However, CSC tends to develop slowly and evolutionary, whereas rapid digital transformation (RDT) unfolds quickly and periodically, giving rise to temporal disparity. In this study, we adopt a case study methodology to examine how an Ethiopian bank addressed this temporal disparity and crafted strategies to align CSC with ongoing RDT. We build our analysis on a multilayer temporality model of CSC that draws on and extends Schein's organizational culture model. Our findings highlight the challenges engendered by temporal disparity and underscore the need for strategic organizational actions. The study provides a theoretical basis for fostering CSC amidst RDT and offers practical insights for developing countries, highly regulated sectors, and organizations undergoing RDT.

• Adamu, Meseret Assefa; Niemimaa, Marko Ilmari & Spagnoletti, Paolo (2025). Leadership Role in Fostering Cybersecurity Culture Amid Rapid Digital Transformation. AMCIS 2025 Proceedings. Full text in Research Archive Show summary

  The rapid pace of digital transformation exacerbates cyber risk, thereby necessitating the development of a cybersecurity culture (CSC). However, cultural development is inherently slower than technological change, making leadership a key factor in bridging this gap. This study empirically investigates how leaders develop a CSC amid RDT, drawing on qualitative data from semi-structured interviews, archival reports, and field observations within an Ethiopian bank undergoing digital transformation. The findings show that tailored leadership strategies and targeted interventions are critical in developing a CSC. This research contributes to the IS leadership literature by highlighting that, unlike traditional law enforcement leadership's hierarchical and protocol-driven nature, cybersecurity leadership must be adaptive and responsive to the pace of organizational transformation.

• Adamu, Meseret Assefa; Spagnoletti, Paolo & Niemimaa, Marko Ilmari (2025). Fostering Organizational Cybersecurity Culture Amid Rapid Digital Transformation: A Case Study from Ethiopia. In Tursunbayeva, Aizhan; Virili, Francesco & Braccini, Alessio Maria (Ed.), Technology-Driven Transformation: The Future of Work and Organizations. Springer Nature Switzerland. ISSN 9783032013958. p. 205–222. doi: 10.1007/978-3-032-01396-5_12. Full text in Research Archive Show summary

  Digital transformation introduces significant cybersecurity challenges for organizations, with its rapid pace further complicating the development of a robust cybersecurity culture (CSC). While previous studies have focused on building, developing, and conceptualizing CSC under relatively stable conditions, they often overlook the challenges posed by rapid digital transformation (RDT) and lack detailed insights into the initiatives and key factors that promote a desirable CSC amid RDT. This study employs a qualitative research methodology, collecting data from a financial institution undergoing RDT through semi-structured interviews and archival documents. The findings provide empirical insights into the cybersecurity challenges RDT presents and identify critical factors that contribute to cultivating a desired CSC in such a dynamic context. Theoretically, this research demonstrates that organizations can develop a desired CSC through deliberate actions, such as regular training, leadership initiatives, and updating policies and guidelines, even amid rapid organizational changes. Practically, it deepens the understanding of CSC in dynamic settings and provides strategies to enhance security and address cybersecurity challenges in times of rapid transformation.

• Adamu, Meseret Assefa; Niemimaa, Marko Ilmari & Spagnoletti, Paolo (2025). Towards a Three-Tiered Framework for Fostering Organizational Cybersecurity Culture. Lecture Notes in Business Information Processing. ISSN 1865-1348. 536, p. 313–324. doi: 10.1007/978-3-031-81325-2_22. Full text in Research Archive Show summary

  Cybersecurity is an increasing concern for organizations. Reports indi-cate that most incidents stem from human factors and, fostering a desired cyberse-curity culture (CSC) is a crucial strategy to minimize the risk. Research suggests that exploring CSC in an organizational context requires a theoretical foundation, with numerous theories offering diverse perspectives on studying CSC in vari-ous organizational contexts. Previous studies have proposed and utilized Schein’s organizational culture framework to conceptualize, analyze, and understand orga-nizational CSC. However, these studies have not addressed the dynamics of the framework’s levels for fostering a desired CSC within an organizational context. The present study addresses this gap by adapting a framework based on Schein’s organizational culture framework to use it as a foundation for fostering a desired cybersecurity culture in organizations. The adapted framework is structured into three interconnected levels (tiers): 1) Operations 2) Principles 3) Mindset. The study also explores the interplay of the adapted concepts to foster the desired CSC in an organization. The adapted framework provides a theoretical basis to explore CSC and insights for practitioners on shaping and sustaining a culture that prioritizes cybersecurity.

• Niemimaa, Anna Elina; Niemimaa, Marko Ilmari & jarvelainen, Jonna (2024). Too Small to Comply? Information Security Management Standardization of a Cybersecurity Startup. Proceedings of the International Conference on Information Systems (ICIS). Full text in Research Archive Show summary

  CyberApp, a small cybersecurity startup, is about to finalize a contract with a strategic new partner – but only if they can convince the customer’s auditors their own security is up to standard. Noticing how laboursome and time-consuming the process seems, CyberApp needs a way to avoid going through the same process with every potential new customer. The solution – get certified against a recognized information security management (ISM) standard to get third-party accreditation. However, are they not too small to comply with a standard that is geared toward larger organizations? This real-life teaching case addresses the importance of ISM standardization, and the challenges an organization may face in the process. The students will learn how to implement ISM standard, and how to adapt the generic standard requirements to a specific context which requires creativity and innovation. The case can also be used in courses dealing with organizational compliance in general.

• Aanestad, Margunn; Hanseth, Ole; Monteiro, Eric; Niemimaa, Marko Ilmari & Ribes, David (2024). From Methodological Symmetry to Gaia: Latour’s Legacy and Untapped Potential for IS Research. Journal of the AIS. 25(2), p. 182–195. doi: 10.17705/1jais.00881. Full text in Research Archive Show summary

  A defining concern for information systems (IS) is how to theorize its primary object of study, the digital artifact. Historically, approaches in IS have oscillated between technological determinist and social determinist ones. Bruno Latour’s works contributed to recalibrating a more symmetrical treatment of the two, and he played a distinctive role in stimulating the evolution of empirically committed, process-oriented theorizing in the IS field. We commemorate Latour’s work by revisiting his early influence on IS research and discuss some of the direct and indirect influences on contemporary IS, such as infrastructure studies and sociomateriality. With the interest in agentic technologies via AI, Latour’s perspectives on technological agency are more relevant than ever. In addition, we explore ideas that are relevant to IS but have yet to be taken up, thus representing untapped theoretical and methodological potential for future IS research—for example, approaching data as circulating reference or how his work could contribute to sustainability discussions in IS.

• Niemimaa, Marko Ilmari (2024). Incorrect compliance and correct noncompliance with information security policies: A framework of rule-related information security behaviour. Computers & Security. ISSN 0167-4048. 145. doi: 10.1016/j.cose.2024.103986. Full text in Research Archive
• Niemimaa, Marko Ilmari; Schultze, Ulrike & Heuvel, Gijs van den (2023). Methodological practices for enacting “strong” sociomateriality in qualitative IS research. In Davison, Robert M. (Eds.), Handbook of Qualitative Research Methods for Information Systems. Edward Elgar Publishing. ISSN 9781802205381. p. 182–196. doi: 10.4337/9781802205398.00017. Full text in Research Archive
• Nwachukwu, Uchechukwu; Vidgren, Jiri; Niemimaa, Marko Ilmari & Järveläinen, Jonna (2023). Do SETA Interventions Change Security Behavior? : A Literature Review. Proceedings of the Annual Hawaii International Conference on System Sciences (HICSS). ISSN 1530-1605. p. 6300–6309. Full text in Research Archive
• Tokerud, Simen; Jansen, Jarand; Niemimaa, Marko Ilmari & Järveläinen, Jonna (2023). Designing Extended Zero Trust Maturity Model – From Technical to Socio-Technical. In Rahul, De´ (Eds.), ICIS 2023 Proceedings. Association for Information Systems (AIS). ISSN 9781958200070. Full text in Research Archive
• Niemimaa, Marko Ilmari (2023). Evaluating compliance for organizational information security and business continuity: three strata of ventriloqual agency. Information Technology and People. ISSN 0959-3845. doi: 10.1108/ITP-03-2022-0156. Full text in Research Archive Show summary

  Purpose The purpose of this research is to study how compliance evaluation becomes performed in practice. Compliance evaluation is a common practice among organizations that need to evaluate their posture against a set of criteria (e.g. a standard, legislative framework and “best practices”). The results of these evaluations have significant importance for organizations, especially in the context of information security and continuity. The author argues that how these evaluations become performed is not merely a “social” activity but shaped by the materiality of the evaluation criteria Design/methodology/approach The authors adopt a sociomaterial practice-based view to study the compliance evaluation through in situ participant observations from compliance evaluation workshops to evaluate organizational compliance against a information security and business continuity criteria. The empirical material was analyzed to construct vignettes that serve to illustrate the practice of compliance evaluation. Findings The research analysis shows how the information security and business continuity criteria themselves partake in the compliance evaluations by operating through (ventriloqually) the evaluators on three strata: the material, the textual and the structural. The author also provides a conceptualization of a hybrid agency. Originality/value This research contributes to lack of studies on the organizational-level compliance. Further, the research is an original contribution to information security and business continuity management by focusing on the practices of compliance evaluation. Further, the research has theoretical novelty by adopting the ventriloqual agency as a hybrid agency to study the sociomateriality of a phenomenon.

• Zimmer, Markus Philipp; Vasilakopoulou, Polyxeni; Grisot, Miria & Niemimaa, Marko Ilmari (2023). Criticality and Values in Digital Transformation Research: Insights from a Workshop. Communications of the Association for Information Systems. 53, p. 964–983. doi: 10.17705/1CAIS.05341. Full text in Research Archive
• Niemimaa, Marko Ilmari & Zimmer, Markus Philipp (2022). Are We Discovering or Making Concepts? Performativity in Concept Defining. Pacific Asian Conference on Information Systems (PACIS). Full text in Research Archive Show summary

  Alongside the emergence of new technologies and management trends, new concepts such as Artificial Intelligence, Digital Transformation and Cybersecurity appear. Once introduced, scholars debate these concepts’ definitions. Often, a uniform definition remains elusive in these debates but several different - sometimes conflicting - definitions result. In this short paper, we take a philosophical perspective to concept defining and ask why is it that we end up in these situations where a plurality of definitions exists? We outline two perspectives to concept defining: 1) concept-discovery; and 2) concept-making. We argue that concept defining is largely ill-conceived as an activity of concept-discovery according to which concepts are mirrors of the outside world. In contrast, we argue that viewing concept defining as an act of concept-making will sensitize IS researchers on the practices and processes which make concepts and their ethical as well as political implications.

• Järveläinen, Jonna; Zimmer, Markus Philipp & Niemimaa, Marko Ilmari (2022). The Importance of Business Continuity for Making Business: The Case of Design Kitchen. Proceedings of the International Conference on Information Systems (ICIS). Full text in Research Archive Show summary

  Design Kitchen is a typical, small business about to secure a major deal with a prospective customer. The crux of this deal: Design Kitchen’s ability to work as a reliable subcontractor. Business continuity (BC) teaching cases usually describe a disruption that requires reaction. This teaching case elucidates the importance of BC for making business. It provides a rich description of Design Kitchen receiving an audit, and posits the task of creating a BC plan based on this audit’s findings. Completing this case, students will learn how to analyze and identify BC risks; how to craft a BC plan; and about the complications stirring when top management is not engaged in BC. While fictional, the case description presents a composite narrative based on empirical studies of several companies’ BC risks. Besides teaching BC, lecturers can use the case text for courses of information security management or business process modeling.

• Järveläinen, Jonna; Niemimaa, Marko Ilmari & Zimmer, Markus Philipp (2022). Designing a Thrifty Approach for SME Business Continuity: Practices for Transparency of the Design Process. Journal of the AIS. 23(6), p. 1557–1602. doi: 10.17705/1jais.00771. Full text in Research Archive Show summary

  Business continuity (BC) management is an organizational approach to preparing information systems (IS) for incidents, but such approaches are uncommon among small and medium-sized enterprises (SMEs). Past research has indicated a gap in approaches that are designed for SMEs since BC management approaches tend to originate from larger organizations and SMEs lack the resources to implement them. To fill this gap, and to respond to a practical need by an IT consultancy company, we employed design science research (DSR) to develop a BC approach for SMEs coined as the thrifty BC management approach. Jointly with the company’s practitioners, we developed a set of meta-requirements for BC approaches for SMEs anchored in prior BC literature, practitioners’ practical expertise, and the theories of collective mindfulness and sociotechnical systems. We evaluated our thrifty BC management approach with multiple SMEs. These evaluations suggest that the designed approach mostly meets the defined meta-requirements. Moreover, the evaluations offered ample opportunities for learning. The design process, unfolding in a real-world setting, was precarious, rife with contingencies and ad hoc decisions. To render the design process transparent, we adapted four writing conventions from the confessional research genre familiar to ethnographic research but novel to DSR. We offer a threefold contribution. First, we contribute to SMEs’ BC with meta-requirements and their instantiation in a new BC approach (artifact); second, we contribute with four practices of confessional writing for transparency of DSR research; and third, we contribute with reflections on our theoretical learning from throughout the design process.

• Schultze, Ulrike; Heuvel, Gijs van den & Niemimaa, Marko Ilmari (2020). Enacting Accountability in IS Research after the Sociomaterial Turn(ing). Journal of the AIS. doi: 10.17705/1jais.00620. Full text in Research Archive
• Zimmer, Markus Philipp & Niemimaa, Marko Ilmari (2020). Cultivating a ‘Digital Jungle’ : Toward a Hybrid Governance Perspective on InfrastructureEvolution, Proceedings of the 23rd Pacific Asia Conference on Information Systems (PACIS). Association of Information Systems. ISSN 9781733632539. Full text in Research Archive
• Schultze, Ulrike; Heuvel, Gijs van den & Niemimaa, Marko Ilmari (2020). Enacting Accountability in IS Research after the Sociomaterial Turn(ing). Journal of the AIS. 21(4), p. 811–835. doi: 10.17705/1jais.00620. Full text in Research Archive
• Zimmer, Markus Philipp & Niemimaa, Marko Ilmari (2019). Navigating in the Digital Jungle: Articulating Combinatory Affordances of Digital Infrastructures for Collaboration. Pacific Asian Conference on Information Systems (PACIS). Full text in Research Archive Show summary

  During digital transformation, companies integrate digital technologies creating large and complex digital infrastructures. These digital infrastructures hold combinatory affordances enabling companies to achieve outcomes that are more than the sum of their parts (i.e., the individual digital technologies). Owing to the complexity of digital infrastructures, these combinatory affordances are ever-present but hidden in the thicket of the infrastructure making their effective use a challenge. We report on an ethnographic study of a large German car manufacturer (Car Inc.) that increasingly integrated digital technologies into its infrastructure as part of its digital transformation strategy. With its infrastructure growing into a ‘digital jungle’, the combinatory affordances remained hidden impeding the infrastructure’s effective use. To facilitate effective use of their infrastructure, that is, support employees to navigate the digital jungle, Car Inc. created a digital compass as a tool to articulate the affordances hidden in the thickets of the digital jungle.

View all works in NVA