Public Companies' Cybersecurity Risk Disclosures from 2007 to 2017

• In Event: Potpourri II

Abstract

Companies are facing unprecedented threats from cyber security incidents. In response to the increased cybersecurity threats, the SEC issued cybersecurity risk disclosure guidance in 2011 and an updated guidance in February 2018 requiring public companies to disclose material cybersecurity risks and cyber incidents. While cybersecurity risk disclosure receives increasing attention from regulators and practitioners, there is currently limited empirical research on the cybersecurity risk disclosure practices of public companies. Yet, cybersecurity risks are significant and could materially affect business operations as well as the integrity of financial and other reports issued by a company. In this study, we investigate the content and linguistic characteristics of cybersecurity risk disclosure practices of 56 public companies from 2007 to 2017. We first identify trends and patterns in public companies’ cybersecurity risk disclosures, and then we investigate factors that drive the changes of cybersecurity disclosure practices over the years. Results show that the two most commonly faced cybersecurity risks over the years are risks of service/operation disruption and risks of data breach. Item 1A of the 10-K Report filed with the SEC is the most used location to disclose all types of cybersecurity disclosures except the disclosure related to cybersecurity procedures, which is mostly disclosed in Item 7. Our results show that the increase in cybersecurity risk disclosures are driven by the SEC’s 2011 Guidance, industry, the overall level of cybersecurity risks in the general economy, company size, and prior cyber breach incidents. The overall disclosure readability decreased after companies experienced cyber breach incidents. We discuss implications for regulatory agencies, public companies and scholars who may wish to research cyber risk disclosures.

Authors

• Lei Gao, University of Akron

• Thomas G Calderon, University of Akron

• Fengchun Tang, Virginia Commonwealth University