An analysis of cybersecurity in Dutch annual reports of listed companies

Eva Eijkelenboom*, Bernold Nieuwesteeg*

*Corresponding author for this work

Research output: Contribution to journalArticleAcademicpeer-review

5 Citations (Scopus)
176 Downloads (Pure)


In this paper we study the disclosure of cybersecurity information in Dutch annual reports, such as cybersecurity measures and cyber incidents, from a financial law and economics perspective. We start our discussion with an analysis of the requirements in financial law to disclose cybersecurity information in annual reports. Hereafter, we discuss the incentives for the board regarding disclosing cybersecurity related information and its effect on stakeholders and shareholders. We draft hypotheses regarding the actual disclosure of cybersecurity information and propose a research design of an exploring empirical study. The results of our study show that although there is no strict legal obligation to do so, 87% of the companies mention cybersecurity or similar words in their annual report in 2018. However, only 4 out of 75 companies disclosed more than six specific cybersecurity measures, while openness would generate the highest surplus for society from a social welfare perspective. Some major Dutch banks and employment agencies did not disclose any specific information with regard to their cybersecurity strategy, while those companies are highly vulnerable for cybersecurity incidents. This hampers the protection of creditors, investors and other stakeholders. Our analysis aims to propel the debate on stimulation of self-regulation or possible obligations in financial law concerning cybersecurity in annual reports.

Original languageEnglish
Article number105513
JournalComputer Law and Security Review
Publication statusPublished - Apr 2021

Bibliographical note

Publisher Copyright:
© 2020 B.F.H. Nieuwesteeg

Research programs

  • SAI 2008-06 BACT


Dive into the research topics of 'An analysis of cybersecurity in Dutch annual reports of listed companies'. Together they form a unique fingerprint.

Cite this