The Effects of IT Management Certification Type and Corporate Social Responsibility Performance on Investors’ Responses to Cybersecurity Breaches

ABSTRACT We investigate the joint effects of IT management certification type (for example, International Organization for Standardization (ISO) 27001 certification, the certification of a company’s Information Security Management System against the ISO 27001 standard, the leading international standard focused on information security) and CSR performance on investors’ responses to cybersecurity breaches. We find that the ISO 27001 certificate issued by an independent certification body serves as a proactive remedial strategy for reputation management and attenuates investors’ negative reactions following data breaches. However, the connection between the certification body that issues the certificate and the financial audit firm of the audited company may impair the effectiveness of the certificate serving as a remedial strategy for cybersecurity breaches. Similarly, superior CSR performance provides insurance-like protection and spillovers to reduce investors’ negative responses to cybersecurity breaches. We also provide some evidence suggesting that IT management certification type and CSR performance are likely substitutive mechanisms.