Cybersecurity disclosure in the banking industry: a comparative study

The recurrence of cyberattacks on businesses in the last decade has attracted significant attention from policy makers and market participants to the importance of corporations’ responsibility and transparency on cybersecurity. In this study, we investigate cybersecurity disclosure made by the 48 largest Canadian and US banks from 2014 to 2020, using an exploratory qualitative approach. The banking industry has been a major target of cyberattacks due to the critical data that it contains. We first develop an index based on previous literature, current policies on cybersecurity disclosure and consultation with academics and practitioners. We then use the index to manually code bank reports related to cybersecurity. Afterward, we investigate the content of the disclosures in detail and discuss the level of compliance with the index. We then critically discuss banks’ disclosure behaviors using proprietary cost, signaling and legitimacy theories and provide recommendations for policy makers and other stakeholders.