The Research Problem
This study investigates the relationship between board commitment to cybersecurity governance (BCCG) and corporate cybersecurity disclosures (CSD) in the UK. It focuses on how the UK's Network and Information Systems (NIS) 2018 regulation influences this relationship, considering cyber threats’ rising complexity and frequency. Motivation
With the digital age’s escalating cybersecurity threats, strong cybersecurity governance and transparent disclosure practices have become crucial. The study seeks to understand whether a board's commitment to cybersecurity, particularly in the context of the NIS regulation, affects the extent of a company's CSD. The Test Hypotheses
This study tests two hypotheses. The first hypothesis posits a positive association between BCCG and the extent of CSD. The second hypothesis contends that the UK's NIS 2018 regulation positively moderates the relationship between board commitment and CSD. Target Population
This study should be of interest to boards of directors, policymakers, regulators, and various stakeholder groups. Adopted Methodology
The study employed textual analysis using Python to analyze corporate disclosures, fixed effect regressions, Difference-in-Differences (DID), and Propensity Score Matching analyses. Analyses
We examined the relationship between BCCG and CSD against the backdrop of the UK's NIS 2018 regulation. We first assessed the extent of CSD in the UK FTSE 350 firms using Python-based textual analysis. Then, we conducted a regression analysis to assess the impact of BCCG on CSD and the moderating effect of the NIS regulation. This was complemented by a DiD analysis to evaluate the changes in CSD before and after the introduction of the NIS regulation. Findings
We find that BCCG is positively associated with the extent of CSD, and that the NIS regulation positively moderates this relationship. Our evidence suggests that firms with a greater focus on cybersecurity governance at the board level (e.g., directors with IT expertise, the presence of IT committees and cybersecurity policies) demonstrate a higher commitment to managing and reporting cybersecurity risks and solutions. Moreover, using DiD analysis, we find a significant increase in CSD levels among firms subjected to NIS regulation compared to control firms, post-NIS regulation. Overall, our study suggests that the interplay of BCCG and macro-social factors, such as NIS regulation, enhances firms’ sensitivity to institutional and stakeholder pressures, leading them to increase their corporate CSD. |