기업의 정보보호 투자가 자기자본비용에 미치는 영향

초록

[Purpose] This study analyzes the relationship between a company's investment in information security and its cost of equity capital, and examines whether the presence of a Chief Information Security Officer (CISO) on the executive team differentially impacts this relationship. Through this study, we examine the impact of corporate investment in cybersecurity and the appointment of a CISO on the company's information risk. [Methodology] The research sample consists of 313 companies listed on the KOSPI and KOSDAQ from 2021 to 2023, when the mandatory information security disclosure was implemented. The independent variables are measured as the ratio of information security investment to the company's total information technology (IT) investment and the ratio of information security investment to sales. The dependent variable is the arithmetic mean of the cost of equity capital measured using the OJ model (Ohlson and Juettner 2005) and the PEG and MPEG models (Easton 2004). [Findings] The analysis results showed that the ratio of information security investment to IT investment and the ratio of information security investment to sales both showed a significant negative correlation with the arithmetic mean of the cost of equity capital for the following fiscal year. These results suggest that corporate cybersecurity investments in information security are associated with a reduction in information risks inherent in the corporate environment, ultimately leading investors to impose a lower risk premium. Furthermore, the negative association between the level of information security investment and the cost of equity capital was statistically significant only in companies where a CISO was appointed as an executive, suggesting that information security investment is more effective in increasing corporate value when companies prioritize information security work and assign accountability through the appointment of an executive. [Implications] This study suggests the usefulness of information security disclosures and suggests that such information can be evaluated and utilized as useful information for supervisory authorities and capital market participants.

키워드