Information security risk items and management practices for mobile payment using non-financial-institution service providers: An exploratory study

Mobile payment has become increasingly popular in recent years. However, concerns remain about the information security risk management practices implemented by non-financialinstitution mobile payment service providers, such as mobile phone carriers and technology companies, using tokenization systems and encryption mechanisms. Using the modified Delphi method and building on the COBIT 2019 framework, this study explores and suggests how these non-financial-institution mobile payment service providers can consider a more holistic list of information security risk items and their corresponding management practices. We believe the proposed practices will help non-financial-institution mobile payment service providers focus on the valuable aspects of information security risks.