Gordon, L.A., Loeb, M.P., Lucyshyn, W. and Sohail, T. (2006) The Impact of the Sarbanes-Oxley Act on the Corporate Disclosures of Information Security Activities. Journal of Accounting and Public Policy, 25, 503-530.
https://doi.org/10.1016/j.jaccpubpol.2006.07.005

has been cited by the following article:

• TITLE: Empirical Evidence on the Determinants of Cybersecurity Investments in Private Sector Firms

  AUTHORS: Lawrence A. Gordon, Martin P. Loeb, William Lucyshyn, Lei Zhou

  KEYWORDS: Cybersecurity, Investment, Determinants, Survey

  JOURNAL NAME: Journal of Information Security, Vol.9 No.2, February 12, 2018

  ABSTRACT: Investments in cybersecurity are critical to the national and economic security of a nation. There is, however, a strong tendency for firms in the private sector to underinvest in cybersecurity activities. This paper reports the results of a survey designed to empirically assess whether treating cybersecurity as an important component of a firm’s internal control system for financial reporting purposes serves as a driver for private sector firms to invest in cybersecurity activities. The findings, in this regard, are significantly positive. The study also shows that a firm’s concern over the risk of incurring a large loss due to a cybersecurity breach and the degree the firm treats cybersecurity investments as generating a competitive advantage are drivers of the level of private sector investment in cybersecurity activities. The implications of the empirical results for designing public policies to mitigate the tendency of private sector firms to underinvest in cybersecurity are also explored.