Implementing a Framework to Manage Cybersecurity Risk: The Case of Harper, Inc.

Accounting professionals play a critical role in assessing cyber risks. This case challenges students to analyze controls at Harper Inc. as it prepares to adopt the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF). Students apply the framework to identify Harper’s existing IT controls in each of the core NIST functions: Governance, Identify, Protect, Detect, Respond, and Recover. Students also determine Harper’s current Implementation Tier and Current and Target Profiles. The case provides students with practical, real-world experience in using a structured framework to identify and organize cybersecurity controls and best practices. It is well suited for undergraduate or graduate IT-related accounting courses. Learning outcomes include understanding the elements of cybersecurity risk, analyzing internal controls through the lens of a cybersecurity framework, and developing technical knowledge and critical-thinking skills through the application of a cybersecurity framework to modern information security challenges. JEL Classifications: M15; M41; M42; D81.