Formulating Cybersecurity Strategies in Corporate Management: Business Strategy and Cybersecurity

Abstract

In recent years, the landscape surrounding cyberattacks has been steadily becoming more sophisticated and cunning. Amidst this situation, companies, particularly operating companies, need to advance countermeasures against cyberattacks, yet it is difficult to say that cybersecurity measures are necessarily robust. On the other hand, a survey on the actual state of information security measures among small and medium-sized enterprises (SMEs), published by the Information-technology Promotion Agency (IPA), an external organization of the Ministry of Economy, Trade and Industry (METI) which oversees Japan's information security sector, also reports that implementing countermeasures has reduced the damage from cyberattacks. Under this situation, cybersecurity must be recognized as a “management issue.” This paper focuses on the fact that while cybersecurity has become a critical risk issue in corporate management, there are few frameworks to advance countermeasures. It employs the concept of the Balanced Scorecard, a management evaluation method used in corporate management. The Balanced Scorecard holds that financial management alone cannot accurately evaluate business performance; it incorporates non-financial elements to appropriately assess corporate management. Similarly, in cybersecurity, promoting countermeasures based solely on the financial perspective of countermeasure costs is difficult. Therefore, this paper proposes a methodology using the concept of a “Balanced Scorecard.” Furthermore, to bridge the gap between management and security personnel in the cybersecurity field, it proposes solutions through two distinct approaches.

Keywords: Cybersecurity, Business Strategy, Investment

DOI: 10.54941/ahfe1007276