Corporate management boards' information security orientation: an analysis of cybersecurity incidents in DAX 30 companies

Our study analyzes the impact of cybersecurity incidents (CSIs) at executive level in German blue-chip companies between 2005 and 2018. Using Upper Echelons Theory, we examine the effect of CSIs on both the composition of management boards as well as their members' profiles and related responsibilities, performing a qualitative in-depth analysis of the positive cases found. Our results show that while CSIs are a common problem for large German groups, only a few of them have addressed IT-related incidents directly through governance. Firms that reacted strongly went against the general trend, and either added a new functional unit to the management board or strengthened functions related to the issue. Our findings indicate that German blue-chip companies have not yet devised a common strategy to deal with CSIs. Firms that reshape their management boards tend instead to take a more compliance-oriented approach.