With cyber-losses mounting worldwide, the need for effective cybersecurity governance has never been greater. The objective of this paper is to identify what is currently known about this important topic and what remains to be further investigated. We examine both the academic and industry literature and draw upon several recent cases involving malicious external attackers and loss of customers’ financial information, as these characteristics are associated with more significant loss of shareholder wealth. Section 1: Case Studies We discuss the following case studies: Equifax, Marriott, and two Canadian financial institutions (Bank of Montreal and Simplii, a subsidiary of CIBC). In the cases affecting a large number of customers (Equifax and Marriott), indirect costs dwarf the direct costs associated with the attack. Direct costs include investigating the attack, upgrading security after the attack, fines, and customer remediation. Indirect costs (sometimes called reputational costs) occur when customers and other stakeholders take their business elsewhere or demand a change in the terms of doing business. Section 2: What and Why of Cyber-Governance This section considers cyber governance in the broader context of risk governance. Drawing on existing research on risk governance, we identify key structural elements: effective board of directors with cybersecurity skills and an appropriate committee to focus on cybersecurity; specialist senior executive expertise with access to the board, such as a Chief Information Security Officer (CISO); risk, compliance, and assurance functions that are adequately resourced with cybersecurity expertise; executive accountability for cybersecurity, with appropriate rewards and sanctions; and disclosure of cybersecurity risks and risk management practices. Section 3: Disclosure of Cyber-Risk Evidence suggests that disclosure expands following a damaging cyber-attack. There is, however, no clear evidence to suggest that expanded disclosure of cyber-risk is associated either with greater likelihood of attack or with superior cyber resilience. Of our case study firms, the one with the most expansive cyber disclosure, Equifax, suffered the most severe cyber-attack. New research that uses machine-learning to analyse the text of cyber-disclosures and quarterly earnings calls offers some promise in this regard. Section 4: Board Structures/Committees and Cyber Risk The effectiveness of governance structures in relation to cyber-risk outcomes is not yet well understood. Very few papers have been published in this area and those that exist are quite recent. Kamiya et al. (2021) find that the existence of a board risk committee reduces the likelihood of an attack, although Akey et al. (2021) find no association. There is, however, good evidence to suggest that cyber risk governance is reformed following a cyber-attack. Risk governance is also transformed after cyber-attack in a peer firm. Section 5: Executive Compensation and Cyber Risk Analysis of the four cases reveals remarkably little executive accountability following even severe cyber-attacks. Lack of serious consequences for senior executives is a problem because it may encourage lack of diligence in cyber risk management processes. We also identify opportunities to better design executive compensation practices to promote better cyber risk management. Section 6: Cybersecurity Governance Scores. ESG ratings play an increasingly important role in the financial system. Within the broad ‘governance’ category, a number of providers now offer a cyber-security governance score. We conduct a preliminary investigation of the scoring system provided by S&P Global, considering large banks in Australia, Canada, the UK, and the US. We find that while cybersecurity governance scores are correlated with past cyber-attacks, they have no value for predicting future cyber-attacks. This raises questions about the methodologies used by ESG ratings providers that warrant further investigation.
Read full abstract
Oct 15, 2024
Milind Sathye 
Open Access