Abstract:Information security management has increasingly been recognized as one of the major business challenges of the last decade. While security research has widely recognized that breaches are detrimental to business value, the other side of the equation has received little attention. The literature on the value impact of proactive financial investments into information security management infrastructure and policy is very limited. Unlike most information technology investments, reinforcements to information security management programs suggest a reduction of a firm’s risk of damages in future attacks rather than an improvement in a firm’s revenue generation. Furthermore, contemporary information security management represents a process-based shift in a firm’s operations. In light of the unique information security risks faced by modern firms, we posit several hypotheses related to the value created from information security management program investments. We then present an empirical examination of the effects of information security management program investments on shareholder value. We use a firm’s successful completion of the ISO 27001 certification requirements as evidence of its commitment to developing a robust information security management program. Based on 111 public announcements, we find that the associated abnormal stock market reaction is both positive and statistically significant. We further control for firms’ industries, sizes, and dates of certification, and we find that they all affect the mean abnormal returns observed. This study demonstrates the capacity for information security management program investments to generate value for firms and further offers guidance for practitioners seeking to maximize shareholder value.

The value of the CIO in the top management team on performance in the case of information security breaches

The Value of the Structural Power of the Chief Information Officer in Enhancing Forward-Looking Firm Performance*

The Role of Corporate Reputation and Crisis Response Strategies in Data Breach Management.

Differential Market Reaction to Data Security Breaches: A Screening Perspective

Understanding the Cost associated with Data Security Breaches.

The Relationship Between Cio'S Presence in the Top Management Team and It'S Contribution to Corporate Innovation: an Empirical Study

Determinants and Consequences of Chief Information Officer Equity Incentives

Aligning With Metrics: Differential Impact of IT and Organizational Metrics on Cognitive Coordination in Top Management Teams

The Moderating Effect of A Chief Information Officer's Competence on IT Investment and Firm Performance.

The Interactive Effect of Board Monitoring and Chief Information Officer Presence on Information Technology Investment

Focusing on the Fundamentals? an Investigation of the Relationship Between Corporate Social Irresponsibility and Data Breach Risk

Where is IT in Information Security? The Interrelationship among IT Investment, Security Awareness, and Data Breaches

The Chief Information Officer and Chief Financial Officer Dyad in the Public Sector: How an Effective Relationship Impacts Individual Effectiveness and Strategic Alignment

The effect of information security certification announcements on the market value of the firm

The Chief Information Officer: A Study of Managerial Roles

The Roles of IT Strategies and Security Investments in Reducing Organizational Security Breaches

Innovative Usage of Information Systems: Does Cio Role Effectiveness Matter?

Making Digital Innovation Happen: A Chief Information Officer Issue Selling Perspective

Evaluating the adoption of cybersecurity and its influence on organizational performance

Information security breaches and IT security investments: Impacts on competitors

The importance of information security for organizations