The Impact of Executives’ IT Expertise on Reported Data Security Breaches

2021/03/11 by Jacob Haislip, Jacob Z. Haislip, Jee-Hae Lim +2
Computer Science · #Cybercrime and Law Enforcement Studies #Digital and Cyber Forensics #Information and Cyber Security

paper · doi:10.1287/isre.2020.0986

openalex publication_date 2021/03/11 · openalex created_date 2025/10/10 · openalex updated_date 2026/08/02

Abstract

Data security breaches (DSBs) are increasing investor and regulator pressure on firms to improve their IT governance (ITG) in an effort to mitigate the related risk. We argue that DSB risk cannot be mitigated by one executive alone, but, rather, is a shared leadership responsibility of the top management team (TMT) (i.e., Chief Executive Officer [CEO], Chief Financial Officer [CFO], and Chief Information Officer [CIO]). Our results suggest that IT-savvy CEOs see technologies related to mitigating DSBs as a top-three most important type of digital methodology for their firm. Similarly, the results related to CFOs with IT expertise single out the critical investment in controls designed to prevent DSBs. Our strong findings for CIOs on the TMT add to the related guidance from COBIT 5 for information security and consistently suggest that they are the key executive for securing IT systems. Finally, our granular explanation of each executive’s DSB-related responsibility could potentially provide firms the start of a governance-led roadmap for compliance to the Securities and Exchange Commission’s and Justice Department’s cyber regulations.

Citations

• Managing Employee Compliance with Information Security Policies: The Critical Role of Top Management and Organizational Culture*
• Information Technology Assimilation in Firms: The Influence of Senior Leadership and IT Infrastructures
• A Coefficient of Agreement for Nominal Scales
• A Heteroskedasticity-Consistent Covariance Matrix Estimator and a Direct Test for Heteroskedasticity
• Sample Selection Bias as a Specification Error
• Digital Business Strategy: Toward a Next Generation of Insights
• Entropy Balancing for Causal Effects: A Multivariate Reweighting Method to Produce Balanced Samples in Observational Studies
• Propensity Score Matching in Accounting Research

Related

• Where is IT in Information Security? The Interrelationship among IT Investment, Security Awareness, and Data Breaches
• The Role of Peer Events in Corporate Governance: Evidence from Data Breaches
• Data Driven Approaches to Cybersecurity Governance for Board Decision-Making -- A Systematic Review
• The Signalgate Case is Waiving a Red Flag to All Organizational and Behavioral Cybersecurity Leaders, Practitioners, and Researchers: Are We Receiving the Signal Amidst the Noise?
• Data Protection and Corporate Reputation Management in the Digital Era