Development of the modified cybersecurity information disclosure index from the resource-based view perspective

As cyber threats escalate, managers and stakeholders face growing information asymmetry that leads to increased demand for credible cybersecurity disclosure. Utilising the resource-based view, this study develops and establishes the content validity of a Modified Cybersecurity Information Disclosure Index (MoCSiDi) through expert validation that systematically measures cybersecurity disclosure practices among Malaysian publicly listed companies. A thorough multi-stage instrument development process was followed. Disclosure items were adapted from Malaysian and international cybersecurity governance frameworks, past empirical literature, as well as content analysis of the annual reports for the 2024 National Annual Corporate Report Awards winners. This went through several iterations to consolidate overlaps, eliminate redundancies, clarify wording, and enhance thematic classification. To ensure theoretical alignment and industry relevance, content validity was established through expert evaluation from both academics and industry practitioners. The final Modified Cybersecurity Information Disclosure Index comprises 57 items across nine thematic categories: governance and strategic oversight, asset and information management, risk identification and assessment, risk management and mitigation, incident disclosure, disclosure transparency, stakeholder engagement and culture, financial and regulatory implications, and information sharing network. Based on the resource-based view, cybersecurity disclosure is operationalised by the index as a signal of valuable cyberinfrastructure resources. Modified Cybersecurity Information Disclosure Index provides regulators, boards and investors with a structured benchmarking tool to assess the adequacy and comparability of cybersecurity disclosures, helping to enhance governance oversight and transparency. This study develops a theory-based, content-validated cybersecurity disclosure index for emerging economies for future research into the determinants and consequences of cybersecurity disclosure.