IS Risk Management in Morocco: Between regulatory ambitions and cultural challenges - A critical analysis of the current situation

Abstract

This study critically assesses Information Systems (IS) risk management in Morocco, examining the interactions between the regulatory framework, national standards, and cultural and organizational factors. The objective is to evaluate the current system's effectiveness and identify challenges specific to the Moroccan context. The methodology relies on an in-depth documentary analysis of legislative texts, national guidelines, and scientific publications, complemented by a comparative analysis with international standards. The results reveal an ambitious regulatory framework but a limited adoption of IS risk management practices, particularly among SMEs. The study highlights the significant influence of cultural factors, such as attitude to risk and resistance to change, on implementing IS risk management strategies effectively. These findings underscore the need to adapt risk management approaches to the local context and intensify awareness and training efforts to improve the maturity of IS risk management in Morocco.

Keywords: IS Risk Management, Cybersecurity in Morocco, Regulatory Framework, IS Governance, Cultural Factors

JEL Classification: M15; G32

Paper type: Exploratory Research