This reporting template was developed at the Center for Long-Term Cybersecurity and EM Strasbourg Business School to supply board of directors, security executives, investors and companies with an instrument for monitoring, disclosing, and evaluating risks and opportunities related to cybersecurity. This template is designed to be applied across industries, internationally following IFRS principles. However, local requirements may apply.
Please note: The template is still in a draft status and subject to further validation. As the study is still under investigation, additional positions or alterations may occur as new version will be published.
Watch a presentation of “Closing the Gap: Monetary Quantification of Cybersecurity for the Board” from the RSA Conference 2024
For providing input or feedback on the template please use the following link to our study:Â
The spreadsheet includes a set of financial statements each presented in one tab. Three use cases shall assist companies to use the financial statements according to their needs for reporting cybersecurity incidents, optimise investment, and/or decide on cybersecurity disclosure. A fourth tab (“Definitions”) suggests how the positions in the statements can be developed or what they may include. Prompts were chosen through a consensus-building process that used a Delphi technique to guide experts to identify a set of critical disclosures.
The template is built to meet the following objectives:
For companies:
- Report companies’ risks and opportunities related to cybersecurity to investors and other stakeholders.
- Optimize and calibrate investments into operations and disclosures in line with concerns about risks concerning financial materiality, or to company equity taking multiple stakeholder perspectives.
- Showcase responsible digital technology through disclosure of information in monetary terms using a value-based approach.
For investors:
- Provide information about security risks and opportunities relevant to financial materiality and credibility.
- Boost consistent reporting for companies for comparability across firms.
- Propel disclosure of information that can lead to more effective dialogue and engagement between companies and investors.
Note: The information contained in this spreadsheet is informational only and not intended to be advice for investment, legal, tax, or other purposes. Its intended purpose is to be auxiliary, not a determinant for decision-making.
We encourage companies to seek legal advice if they have questions or concerns about disclosing information deploying this template.
For questions or comments beyond the before mentioned study please contact Dr. Laura Georg-Schaffner: Laura.g.schaffner@em-strasbourg.eu
