How the three lines of defense can contribute to public firms’ cybersecurity effectiveness

Sylvie Héroux () and Anne Fortin ()
Additional contact information
Sylvie Héroux: Université du Québec à Montréal (ESG-UQAM)
Anne Fortin: Université du Québec à Montréal (ESG-UQAM)

International Journal of Disclosure and Governance, 2025, vol. 22, issue 2, No 5, 377-396

Abstract: Abstract This interpretative field study examines how public firms deal with cybersecurity-related issues, emphasizing how the three lines of defense can contribute to cybersecurity effectiveness. Sixteen interviews were conducted with 18 participants, including 13 executives/senior managers in internal audit, information technology (IT), and information security (IS) in 13 different public firms. The many cybersecurity structures, processes, or relational mechanisms established by the three lines of defense in the participating organizations are identified. These governance mechanisms are used as a baseline for analyzing how teams in internal audit, IT, IS, cybersecurity, legal, finance, corporate communications, and environmental, social and governance (ESG) are engaged and collaborate in dealing with cybersecurity-related issues. This study entered into the “black box” to document how different organizational functions are involved in IT/IS governance mechanisms associated with cybersecurity. Findings can help board of directors and management reflect on the nature of cybersecurity activities that could be implemented to enhance cybersecurity effectiveness. Regulators may consider the issues raised by participants to clarify regulations about cybersecurity disclosure.

Keywords: Cybersecurity; IIA’s three lines model; Cybersecurity governance; IT governance; Internal audit (search for similar items in EconPapers)
Date: 2025
References: View references in EconPapers View complete reference list from CitEc
Citations:

Downloads: (external link)
http://link.springer.com/10.1057/s41310-024-00226-7 Abstract (text/html)
Access to the full text of the articles in this series is restricted.

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:pal:ijodag:v:22:y:2025:i:2:d:10.1057_s41310-024-00226-7

Ordering information: This journal article can be ordered from
https://www.palgrave.com/gp/journal/41310

DOI: 10.1057/s41310-024-00226-7

Access Statistics for this article

International Journal of Disclosure and Governance is currently edited by Michael Alles

More articles in International Journal of Disclosure and Governance from Palgrave Macmillan
Bibliographic data for series maintained by Sonal Shukla () and Springer Nature Abstracting and Indexing ().