The effect of information security certification announcements on the market value of the firm

Jason K. Deane, David M. Goldberg (), Terry R. Rakes and Loren P. Rees
Additional contact information
Jason K. Deane: Virginia Tech
David M. Goldberg: Virginia Tech
Terry R. Rakes: Virginia Tech
Loren P. Rees: Virginia Tech

Information Technology and Management, 2019, vol. 20, issue 3, No 1, 107-121

Abstract: Abstract Information security management has increasingly been recognized as one of the major business challenges of the last decade. While security research has widely recognized that breaches are detrimental to business value, the other side of the equation has received little attention. The literature on the value impact of proactive financial investments into information security management infrastructure and policy is very limited. Unlike most information technology investments, reinforcements to information security management programs suggest a reduction of a firm’s risk of damages in future attacks rather than an improvement in a firm’s revenue generation. Furthermore, contemporary information security management represents a process-based shift in a firm’s operations. In light of the unique information security risks faced by modern firms, we posit several hypotheses related to the value created from information security management program investments. We then present an empirical examination of the effects of information security management program investments on shareholder value. We use a firm’s successful completion of the ISO 27001 certification requirements as evidence of its commitment to developing a robust information security management program. Based on 111 public announcements, we find that the associated abnormal stock market reaction is both positive and statistically significant. We further control for firms’ industries, sizes, and dates of certification, and we find that they all affect the mean abnormal returns observed. This study demonstrates the capacity for information security management program investments to generate value for firms and further offers guidance for practitioners seeking to maximize shareholder value.

Keywords: Information security; Event study; Security investments; Cybersecurity; ISO 27001 (search for similar items in EconPapers)
Date: 2019
References: View references in EconPapers View complete reference list from CitEc
Citations: View citations in EconPapers (9)

Downloads: (external link)
http://link.springer.com/10.1007/s10799-018-00297-3 Abstract (text/html)
Access to the full text of the articles in this series is restricted.

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:spr:infotm:v:20:y:2019:i:3:d:10.1007_s10799-018-00297-3

Ordering information: This journal article can be ordered from
http://www.springer.com/journal/10799

DOI: 10.1007/s10799-018-00297-3

Access Statistics for this article

Information Technology and Management is currently edited by Raymond Patterson and Erik Rolland

More articles in Information Technology and Management from Springer
Bibliographic data for series maintained by Sonal Shukla () and Springer Nature Abstracting and Indexing ().