Board liability for cyberattacks: The effects of a prior attack and implementing the AICPA’s cybersecurity framework

Abstract

A significant litigation trend is the rise in lawsuits filed against boards of directors following cybersecurity incidents. We perform an experiment to examine factors we predict will influence directors’ litigation risk. We examine whether jurors are more likely to hold directors liable when a company previously experienced an immaterial cyberattack, and whether subsequently implementing the American Institute of Certified Public Accountants’ cybersecurity risk management reporting and assurance framework (the “Framework”) can mitigate the effects of a prior attack. Consistent with counterfactual reasoning theory, we find jurors are more likely to hold directors liable for a cyberattack when a company previously experienced an attack. Importantly, we also find that directors can reduce this liability risk after a prior cyberattack by subsequently implementing the Framework, especially when they obtain external assurance. Our results have important implications for research, boards, regulators and public policymakers, audit firms, and attorneys who handle cybersecurity-related cases.