DDBA 9000 Week 2 Ethics Board Application Example

Ethics Board Application for a Study of Cybersecurity Strategies at Small Credit Unions: Plain-Language Description, Recruitment That Protects Voluntariness, and Safeguards for Information Sensitive to Both the Managers and Their Institutions

Student Name

Walden University

DDBA 9000: Doctoral Study Completion

Instructor Name

Month Day, Year

Ethics Board Application for a Study of Cybersecurity Strategies at Small Credit Unions: Plain-Language Description, Recruitment That Protects Voluntariness, and Safeguards for Information Sensitive to Both the Managers and Their Institutions

Study Description

The study asks what strategies information technology managers at small credit unions use to protect member data from cyberattacks. I will interview one manager at each of four credit unions in Ohio with fewer than fifty employees and review documents the managers choose to share, such as policy summaries and training schedules. Each interview will last about an hour, by video call, and will be recorded with permission.

Participants and Recruitment

Participants are adults employed as the person responsible for information technology at their credit union. Recruitment begins with a letter to each credit union's chief executive asking permission for the institution to take part and the name of the manager responsible for information technology. I will then send that manager a separate invitation directly. Because the invitation follows a superior's naming, there is a risk that the manager feels obliged to agree. To protect voluntariness, the invitation states that the chief executive will not be told whether the manager agreed or declined, that declining has no consequence and that the manager may withdraw at any time before publication. I will not report participation back to the executive.

Foreseeable Risks

Two kinds of harm are foreseeable. First, to the manager: describing weaknesses in their institution's security could embarrass them or affect their standing at work if attributed to them. Second, to the institution: details of security practices could help an attacker if disclosed. The study is minimal risk only if both are controlled, so the application states how.

Safeguards

Credit unions and managers will be identified by codes, such as CU1 and P1, in all notes and the published study. The study will report strategies at a level of generality that does not reveal specific system names, configurations, vulnerabilities or vendors. Documents will be reviewed on screen during the interview where possible and not retained; any copies will be stored encrypted and destroyed after the study is approved. Recordings will be deleted after transcription and verification. Before publication, each manager will review the passages drawn from their interview to confirm that nothing identifies the institution or exposes a vulnerability.

The safeguards follow the principle of respect for persons, which requires informed and voluntary participation, and of beneficence, which requires minimizing possible harms, as set out in the Belmont Report (National Commission for the Protection of Human Subjects of Biomedical and Behavioral Research, 1979).

Consent

The consent form explains the purpose, procedures, risks, safeguards, voluntary nature of participation and right to withdraw in plain language at about an eighth-grade reading level. It includes contact information for me, my chair and the university's research ethics office.

Data Management

Recordings, transcripts and the code key will sit on encrypted storage the university provides for the five years its policy requires, and will be deleted after that. Only my committee and I will see identifiable data. Yin (2018) noted that case study researchers must protect participants through informed consent and confidentiality, especially when cases involve organizations as well as individuals.

Member Checking

Managers will review summaries of their interviews. Birt et al. (2016) noted that returning interpretations to participants can strengthen credibility, and here it also lets managers remove sensitive details.

References

Birt, L., Scott, S., Cavers, D., Campbell, C., & Walter, F. (2016). Member checking: A tool to enhance trustworthiness or merely a nod to validation? Qualitative Health Research, 26(13), 1802-1811. https://doi.org/10.1177/1049732316654870

National Commission for the Protection of Human Subjects of Biomedical and Behavioral Research. (1979). The Belmont report: Ethical principles and guidelines for the protection of human subjects of research. U.S. Department of Health, Education, and Welfare.

Yin, R. K. (2018). Case study research and applications: Design and methods (6th ed.). SAGE Publications.