Mandatory cybersecurity disclosure: Early evidence from 10-K reports
Lopullinen julkaistu versio - 2.23 MB
https://creativecommons.org/licenses/by/4.0/
Lataukset2
Pysyvä osoite
Kuvaus
© 2026 The Author(s). Published by Elsevier Inc. This is an open access article under the CC BY license
(http://creativecommons.org/licenses/by/4.0/).
This study provides early evidence on U.S. public companies’ responses to the SEC’s 2023 rule requiring detailed annual disclosures on cybersecurity risk management and governance. Using textual analysis of 3,440 Item 1C disclosures in 10-K filings from 2024, we investigate the determinants of these newly required disclosure characteristics and assess market reactions. Results show variation in disclosure quality—proxied by length, redundancy, and specificity—primarily driven by firm size, financial performance, auditor quality, cybersecurity and litigation risk exposures, and peer practices, though these factors collectively explain only moderate variance. Past cyber incidents, firm digitalization, material IT weaknesses, and tech-firm status show no influence, suggesting strategic discretion persists even under a mandate. Additional analyses show that Item 1C represents new disclosure content rather than a relocation of existing risk disclosures. To assess market reactions, we utilize event studies, analyze cybersecurity-related discussions in earnings call transcripts, and examine investor attention through filing download activity. The results indicate a minimal response from both investors and analysts to these newly mandated disclosures. These insights hold important implications for policymakers regarding the balance between regulatory burden and informational value, as jurisdictions globally adopt similar cybersecurity disclosure policies.
Emojulkaisu
ISBN
ISSN
1873-4723
1467-0895
1467-0895
Aihealue
Kausijulkaisu
International journal of accounting information systems|57
OKM-julkaisutyyppi
A1 Alkuperäisartikkeli tieteellisessä aikakauslehdessä (vertaisarvioitu)