In the current landscape of evolving cyber-threats and limited resources, effective cybersecurity decision-making is critical for organizational resilience. Yet, decision-making in this domain remains challenging. The impact and effectiveness of cybersecurity measures are difficult to quantify, information asymmetries exist between providers and consumers of cybersecurity services, and decisions are frequently made under conditions of uncertainty and limited empirical guidance. Against this backdrop, our research examines the industry-, organizational-, team-, and individual-level factors that cybersecurity professionals across strategic, tactical, and operational roles perceive as shaping effective cybersecurity decision-making, and explores how these factors intersect across levels in practice. Drawing on semi-structured interviews with 36 cybersecurity professionals across six organizations – including operational security roles, governance, risk, and compliance specialists, senior executives and board members – we conducted reflexive thematic analysis to identify key factors shaping decision-making. The findings support several factors previously identified in the literature while also revealing a set of novel decision-shaping factors, including intrinsic motivation, teamwork, user experience beliefs, and confidence. Importantly, the analysis indicates that many factors operate across multiple organizational levels rather than being confined to a single locus of influence. We integrate these insights into a cross-level conceptual model that highlights the intersections of decision-shaping factors across industry, organizational, team, and individual levels. By reframing effective cybersecurity decision-making as a contextually embedded and multi-level process, this study deepens understanding of the factors shaping these decisions in practice, and offers a foundation for future research and reflective organizational practice.

Although sport has become an important topic in management research, academics have not fully examined the area of cybersecurity and its strategic relevance in sports management, in particular in and for sports events. In the present study, we examined the relationship between sports and cybersecurity and conducted an integrative literature review that categorizes the research that has been published to date, based on technology-organisation-environment (TOE) framework. The findings show that the role of cybersecurity in and for sports events is a heavily under-researched area that provides an abundance of scientific opportunities. It is also one that deserves further attention, because cyber-attacks on sports events and associated organisations are increasing. Our integrative literature review offers a more structured understanding of this field of investigation and led to the development of a comprehensive research agenda at the intersection between sports management and information security. As one of the first studies to use a literature review that specifically focuses on cybersecurity in and for sports events, we advance the state-of-the-art scholarship in this critical space, and we take the first step to disseminate best practices in cybersecurity and sports management.

Enterprise risk management frameworks have gained popularity after the Global Financial Crisis for companies to be more in control of their risks. Since then, the Three Lines of Defence model (based on defence-in-depth approaches) has become one of the primary risk management frameworks in the Western world. Yet, its application in the cybersecurity space, one of the fastest-growing areas of risk for modern organisations, has been fragmented at best. In this article, we conducted a systematic literature review on the application of the Three Lines of Defence model in cybersecurity. The model has been recently renamed the Three Lines Model. After the seminal publication by the Institute of Internal Auditors in 2013, academics and practitioners have either referenced this model as the primary governance framework for risk management or analysed it in depth in various areas. To the best of our knowledge, this is the first systematic literature review on the topic. We have performed a methodical analysis of existing research using best practices in the field and adopted the grounded theory approach as the theoretical underpinning of our investigation. This way, we unraveled details, critiques and possible alternatives to the Three Lines Model in cybersecurity. Our study expands our understanding of the Three Lines Model and its application in cybersecurity, highlighting the status quo of research in the space and offering practical recommendations for organisations interested in exploring its implementation to mitigate the impact of cyber-risks.

Purpose Boards of Directors and other organisational leaders make decisions about the information security governance systems to implement in their companies. The increasing number of cyber-breaches targeting businesses makes this activity inescapable. Recently, researchers have published comprehensive lists of recommended cyber measures, specifically to inform organisational boards. However, the young cybersecurity industry has still to confirm and refine these guidelines. As a starting point, it would be helpful for organisational leaders to know what other organisations are doing in terms of using these guidelines. In an ideal world, bespoke surveys would be developed to gauge adherence to guidelines, but this is not always feasible. What we often do have is data from existing cybersecurity surveys. The authors argue that such data could be repurposed to quantify adherence to existing information security guidelines, and this paper aims to propose, and test, an original methodology to do so. Design/methodology/approach The authors propose a quantification mechanism to measure the degree of adherence to a set of published information security governance recommendations and guidelines targeted at organisational leaders. The authors test their quantification mechanism using a data set collected in a survey of 156 Italian companies on information security and privacy. Findings The evaluation of the proposed mechanism appears to align with findings in the literature, indicating the validity of the present approach. An analysis of how different industries rank in terms of their adherence to the selected set of recommendations and guidelines confirms the usability of our repurposed data set to measure adherence. Originality/value To the best of the authors’ knowledge, a quantification mechanism as the one proposed in this study has never been proposed, and tested, in the literature. It suggests a way to repurpose survey data to determine the extent to which companies are implementing measures recommended by published cybersecurity guidelines. This way, the proposed mechanism responds to increasing calls for the adoption of research practices that minimise waste of resources and enhance research sustainability.