Abstract
Information technology and systems (IT/S) risk management is about the survival of organizations in the turbulent digital world. Complementary to the existing knowledge on enterprise risk management and IT/S risk management, our study proposes that organizations should be equipped with IT/S risk management (ITSRM) agility to readily address threats related to IT/S, while at the same time grasping opportunities out of the threats, that aims to create, preserve, and realize value to the organization through IT/S. We develop a conceptual definition of IT/S risk management agility. Then we conduct a multiple case study in four companies with potentially high ITSRM agility to investigate the meaning of ITSRM agility. The content of the construct and preliminary findings are discussed.