How the three lines of defense can contribute to public firms’ cybersecurity effectiveness

Abstract

This interpretative field study examines how public firms deal with cybersecurity-related issues, emphasizing how the three lines of defense can contribute to cybersecurity effectiveness. Sixteen interviews were conducted with 18 participants, including 13 executives/senior managers in internal audit, information technology (IT), and information security (IS) in 13 different public firms. The many cybersecurity structures, processes, or relational mechanisms established by the three lines of defense in the participating organizations are identified. These governance mechanisms are used as a baseline for analyzing how teams in internal audit, IT, IS, cybersecurity, legal, finance, corporate communications, and environmental, social and governance (ESG) are engaged and collaborate in dealing with cybersecurity-related issues. This study entered into the “black box” to document how different organizational functions are involved in IT/IS governance mechanisms associated with cybersecurity. Findings can help board of directors and management reflect on the nature of cybersecurity activities that could be implemented to enhance cybersecurity effectiveness. Regulators may consider the issues raised by participants to clarify regulations about cybersecurity disclosure.