How the three lines of defense can contribute to public firms’ cybersecurity effectiveness

IF 2.9 Q2 MANAGEMENT International Journal of Disclosure and Governance Pub Date : 2024-02-23 DOI:10.1057/s41310-024-00226-7

{"title":"How the three lines of defense can contribute to public firms’ cybersecurity effectiveness","authors":"","doi":"10.1057/s41310-024-00226-7","DOIUrl":null,"url":null,"abstract":"<h3>Abstract</h3> <p>This interpretative field study examines how public firms deal with cybersecurity-related issues, emphasizing how the three lines of defense can contribute to cybersecurity effectiveness. Sixteen interviews were conducted with 18 participants, including 13 executives/senior managers in internal audit, information technology (IT), and information security (IS) in 13 different public firms. The many cybersecurity structures, processes, or relational mechanisms established by the three lines of defense in the participating organizations are identified. These governance mechanisms are used as a baseline for analyzing how teams in internal audit, IT, IS, cybersecurity, legal, finance, corporate communications, and environmental, social and governance (ESG) are engaged and collaborate in dealing with cybersecurity-related issues. This study entered into the “black box” to document how different organizational functions are involved in IT/IS governance mechanisms associated with cybersecurity. Findings can help board of directors and management reflect on the nature of cybersecurity activities that could be implemented to enhance cybersecurity effectiveness. Regulators may consider the issues raised by participants to clarify regulations about cybersecurity disclosure.</p>","PeriodicalId":45050,"journal":{"name":"International Journal of Disclosure and Governance","volume":"70 1","pages":""},"PeriodicalIF":2.9000,"publicationDate":"2024-02-23","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":"0","resultStr":null,"platform":"Semanticscholar","paperid":null,"PeriodicalName":"International Journal of Disclosure and Governance","FirstCategoryId":"1085","ListUrlMain":"https://doi.org/10.1057/s41310-024-00226-7","RegionNum":0,"RegionCategory":null,"ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":null,"EPubDate":"","PubModel":"","JCR":"Q2","JCRName":"MANAGEMENT","Score":null,"Total":0}

引用次数: 0

Abstract

This interpretative field study examines how public firms deal with cybersecurity-related issues, emphasizing how the three lines of defense can contribute to cybersecurity effectiveness. Sixteen interviews were conducted with 18 participants, including 13 executives/senior managers in internal audit, information technology (IT), and information security (IS) in 13 different public firms. The many cybersecurity structures, processes, or relational mechanisms established by the three lines of defense in the participating organizations are identified. These governance mechanisms are used as a baseline for analyzing how teams in internal audit, IT, IS, cybersecurity, legal, finance, corporate communications, and environmental, social and governance (ESG) are engaged and collaborate in dealing with cybersecurity-related issues. This study entered into the “black box” to document how different organizational functions are involved in IT/IS governance mechanisms associated with cybersecurity. Findings can help board of directors and management reflect on the nature of cybersecurity activities that could be implemented to enhance cybersecurity effectiveness. Regulators may consider the issues raised by participants to clarify regulations about cybersecurity disclosure.

查看原文

微信好友朋友圈 QQ好友复制链接

本刊更多论文

三道防线如何促进公共企业网络安全的有效性

摘要本解释性实地研究探讨了公共公司如何处理网络安全相关问题，强调了三道防线如何促进网络安全的有效性。我们对 18 名参与者进行了 16 次访谈，其中包括 13 家不同上市公司的内部审计、信息技术（IT）和信息安全（IS）部门的 13 名高管/高级经理。确定了参与组织的三道防线所建立的许多网络安全结构、流程或关系机制。这些治理机制被用作分析内部审计、IT、IS、网络安全、法律、财务、企业沟通以及环境、社会和治理 (ESG) 团队如何参与并合作处理网络安全相关问题的基准。本研究进入 "黑箱"，记录不同组织职能如何参与与网络安全相关的 IT/IS 治理机制。研究结果有助于董事会和管理层反思网络安全活动的性质，从而提高网络安全的有效性。监管机构可考虑参与者提出的问题，以明确有关网络安全披露的规定。

本文章由计算机程序翻译，如有差异，请以英文原文为准。

求助全文

约1分钟内获得全文去求助

来源期刊

International Journal of Disclosure and Governance MANAGEMENT-

CiteScore

4.80

自引率

11.10%

发文量

期刊介绍： The International Journal of Disclosure and Governance publishes a balance between academic and practitioner perspectives in law and accounting on subjects related to corporate governance and disclosure. In its emphasis on practical issues, it is the only such journal in these fields. All rigorous and thoughtful conceptual papers are encouraged. To date, International Journal of Disclosure and Governance has published articles by a former general counsel and a former commissioner of the SEC, practitioners from Cleary Gottlieb, Skadden Arps, Wachtell Lipton, and Latham & Watkins as well as articles by academics from Harvard, Yale and NYU. The readership of the journal includes lawyers, accountants, and corporate directors and managers.