Outsource or not?Jelovčan, Luka (Avtor) Mihelič, Anže (Avtor) Prislan Mihelič, Kaja (Avtor) information securitydecision modelanalytic hierarchy processAHPmanagementoutsourcingPurpose: Outsourcing information security has proven to be an efficient solution for information security management; however, it may not be the most suitable approach for every organization. This research aimed to develop a multi-criteria decision-making model that would enable organizations to determine which approach to information security management (outsourcing or internal management) is more suitable for their needs and capabilities. Methods: Our study utilized several different research methods. First, the decision criteria were identified by reviewing related work and then selected by information security experts in a focus group. Second, a survey was conducted among information security practitioners to assign the criteria weights. Third, four use cases were conducted with four real-world organizations to assess the usability, ease of use, and usefulness of the developed model. Results: We developed a ten-criteria model based on the analytic hierarchy process. The survey results promote performance-related criteria as more important than efficiency-focused criteria. Evidence from use cases proves that the decision model is useful and appropriate for various organizations. Conclusion: To make informed decisions on approaching information security management, organizations must first conduct a thorough analysis of their capabilities and needs and investigate potential external contractors. In such a case, the proposed model can serve as a useful support tool in the decision-making process to obtain clear recommendations tailored to factual circumstances.Moderna organizacija20222024-06-24 10:05:37Znanstveno delo89184UDK: 004.056:621.39COBISS_ID: 109986819DOI: 10.2478/orga-2022-0010ISSN pri članku: 1318-5454sl