An exploratory study of organizational cyber resilience, its precursors and outcomes

ABSTRACT Evidence shows that it is paramount for stakeholders to understand the cybersecurity of relevant organizations. However, the secrecy surrounding cyber attacks and how organizations manage their cyber resilience make it impossible for stakeholders to develop this understanding. This paper analyzes organizational cyber resilience, its contextual factors and its impact on the outcomes of cyber attacks based on publicly available data. Using the PRISMA methodology, we collated and analyzed a dataset of 1,145 publicly known cyber attacks. We conceptualize and operationalize cyber resilience from a governance perspective. Our findings indicate that organizations that suffered cyber attacks had the following cyber resilience characteristics: a relatively low level of cyber resilience reflected in the low frequency of cybersecurity roles, low reliance on cybersecurity frameworks, and relatively low strength of prevention, detection, and recovery controls. Cyber resilience is found to be associated with the sector, size, and digital intensity. Linear regression indicates that, expectedly, stronger prevention, detection, and recovery processes are related to lower breach severity and occurrence of investigations or penalties, but contrary to expectations, cybersecurity roles and frameworks are not. Furthermore, better organizational responses are associated with higher breach severity but they are not found to have an impact on the level of investigations, fines, and penalties imposed. We discuss our findings and their implications for cyber resilience regulation, future research, and sector cooperation.