Cybersecurity and cyber risk in integrated and management reports of key service operators

Abstract

Purpose: The scope of interactive information processed and exchanged through cyberspace has grown exponentially. Therefore, there is a need to develop cybersecurity that protects this space against both internal and external threats, as well as to work out an appropriate reporting system on the cybersecurity model operating in the company. The aim of the paper is to identify and assess the disclosures on cybersecurity and cyber risk in the integrated and management reports of selected companies listed on the Warsaw Stock Exchange. Methodology: The study focused on the integrated and management reports of 17 selected companies identified as operators of so-called key services. The representative sample was chosen through purposive sampling. This process was preceded by a preliminary analysis of companies listed in the WIG 30 Index, drawing on the number of integrated reports prepared by the operators of key services. The research involved an analysis of the literature and legal regulations, as well as the structure and scope of information on cybersecurity reported by the surveyed companies, along with the deductive method. The results of the analysis showed that only some companies present information on existing cyber risks and cybersecurity, while information is scattered in different parts of the business reports and non-comparable due to the lack of a unified data structure. It was noted that the reports do not contain detailed information on the activities in the field of cybersecurity, which makes it impossible to perform a multifaceted and multisectoral assessment of the results reported by the entities. Originality: The paper builds on and thus complements the scientific achievements in the field of non-financial reporting, including the business model, by identifying the shortcomings related to reporting on how to protect companies against the risk related to cyber threats in the reports to date. The study also confirms the need to improve the content of business reports with quantitative and qualitative information in this regard