Board of directors’ attributes and aspects of cybersecurity disclosure

Sylvie Héroux () and Anne Fortin ()
Additional contact information
Sylvie Héroux: Université du Québec à Montréal
Anne Fortin: Université du Québec à Montréal

Journal of Management & Governance, 2024, vol. 28, issue 2, No 1, 359-404

Abstract: Abstract As cybersecurity is a critical risk issue for organizations, cybersecurity disclosure is important for financial regulators, financial analysts, shareholders, and other stakeholders. Organizations face challenges when deciding whether, what, and when cybersecurity-related information should be disclosed. Prior studies have contributed few insights regarding the potential determinants of cybersecurity disclosure. Furthermore, their findings are based on a general or narrow measurement of this disclosure. This study draws on upper echelons and signaling theories to examine the association between various board of directors’ characteristics and extent of overall cybersecurity disclosure and its individual aspects. Extent of cybersecurity disclosure is measured based on a content analysis of annual financial regulatory filings of the 250 companies listed on the S&P/TSX Composite Index, using a scoring grid of 40 items grouped into seven categories representing different aspects of cybersecurity disclosure. This expanded disclosure measurement provides original insights for firms and their stakeholders. The main findings indicate that the presence of a committee responsible for cybersecurity on the board of directors is key to increasing cybersecurity disclosure. With or without such a committee, board IT expertise, board tenure, board independence, women directors, and board age are associated with the extent of total cybersecurity disclosure or some of its specific aspects, particularly cybersecurity risk mitigation. These findings contribute to the cybersecurity literature by examining which board of directors’ characteristics influence the extent of specific aspects of cybersecurity disclosure. They also complement results from upper echelons-based studies on corporate reporting determinants and prior IT governance studies.

Keywords: Board of directors’ attributes; Cybersecurity disclosure; Upper echelons theory; Signaling theory; Cybersecurity governance; IT governance (search for similar items in EconPapers)
Date: 2024
References: View references in EconPapers View complete reference list from CitEc
Citations:

Downloads: (external link)
http://link.springer.com/10.1007/s10997-022-09660-7 Abstract (text/html)
Access to full text is restricted to subscribers.

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:kap:jmgtgv:v:28:y:2024:i:2:d:10.1007_s10997-022-09660-7

Ordering information: This journal article can be ordered from
http://www.springer. ... 29/journal/10997/PS2

DOI: 10.1007/s10997-022-09660-7

Access Statistics for this article

Journal of Management & Governance is currently edited by Lino Cinquini

More articles in Journal of Management & Governance from Springer, Accademia Italiana di Economia Aziendale (AIDEA) Contact information at EDIRC.
Bibliographic data for series maintained by Sonal Shukla () and Springer Nature Abstracting and Indexing ().