\documentclass[11pt,twoside]{article}\makeatletter

\IfFileExists{xcolor.sty}%
  {\RequirePackage{xcolor}}%
  {\RequirePackage{color}}
\usepackage{colortbl}
\usepackage{wrapfig}
\usepackage{ifxetex}
\ifxetex
  \usepackage{fontspec}
  \usepackage{xunicode}
  \catcode`⃥=\active \def⃥{\textbackslash}
  \catcode`❴=\active \def❴{\{}
  \catcode`❵=\active \def❵{\}}
  \def\textJapanese{\fontspec{Noto Sans CJK JP}}
  \def\textChinese{\fontspec{Noto Sans CJK SC}}
  \def\textKorean{\fontspec{Noto Sans CJK KR}}
  \setmonofont{DejaVu Sans Mono}
  
\else
  \IfFileExists{utf8x.def}%
   {\usepackage[utf8x]{inputenc}
      \PrerenderUnicode{–}
    }%
   {\usepackage[utf8]{inputenc}}
  \usepackage[english]{babel}
  \usepackage[T1]{fontenc}
  \usepackage{float}
  \usepackage[]{ucs}
  \uc@dclc{8421}{default}{\textbackslash }
  \uc@dclc{10100}{default}{\{}
  \uc@dclc{10101}{default}{\}}
  \uc@dclc{8491}{default}{\AA{}}
  \uc@dclc{8239}{default}{\,}
  \uc@dclc{20154}{default}{ }
  \uc@dclc{10148}{default}{>}
  \def\textschwa{\rotatebox{-90}{e}}
  \def\textJapanese{}
  \def\textChinese{}
  \IfFileExists{tipa.sty}{\usepackage{tipa}}{}
\fi
\def\exampleFont{\ttfamily\small}
\DeclareTextSymbol{\textpi}{OML}{25}
\usepackage{relsize}
\RequirePackage{array}
\def\@testpach{\@chclass
 \ifnum \@lastchclass=6 \@ne \@chnum \@ne \else
  \ifnum \@lastchclass=7 5 \else
   \ifnum \@lastchclass=8 \tw@ \else
    \ifnum \@lastchclass=9 \thr@@
   \else \z@
   \ifnum \@lastchclass = 10 \else
   \edef\@nextchar{\expandafter\string\@nextchar}%
   \@chnum
   \if \@nextchar c\z@ \else
    \if \@nextchar l\@ne \else
     \if \@nextchar r\tw@ \else
   \z@ \@chclass
   \if\@nextchar |\@ne \else
    \if \@nextchar !6 \else
     \if \@nextchar @7 \else
      \if \@nextchar (8 \else
       \if \@nextchar )9 \else
  10
  \@chnum
  \if \@nextchar m\thr@@\else
   \if \@nextchar p4 \else
    \if \@nextchar b5 \else
   \z@ \@chclass \z@ \@preamerr \z@ \fi \fi \fi \fi
   \fi \fi  \fi  \fi  \fi  \fi  \fi \fi \fi \fi \fi \fi}
\gdef\arraybackslash{\let\\=\@arraycr}
\def\@textsubscript#1{{\m@th\ensuremath{_{\mbox{\fontsize\sf@size\z@#1}}}}}
\def\Panel#1#2#3#4{\multicolumn{#3}{){\columncolor{#2}}#4}{#1}}
\def\abbr{}
\def\corr{}
\def\expan{}
\def\gap{}
\def\orig{}
\def\reg{}
\def\ref{}
\def\sic{}
\def\persName{}\def\name{}
\def\placeName{}
\def\orgName{}
\def\textcal#1{{\fontspec{Lucida Calligraphy}#1}}
\def\textgothic#1{{\fontspec{Lucida Blackletter}#1}}
\def\textlarge#1{{\large #1}}
\def\textoverbar#1{\ensuremath{\overline{#1}}}
\def\textquoted#1{‘#1’}
\def\textsmall#1{{\small #1}}
\def\textsubscript#1{\@textsubscript{\selectfont#1}}
\def\textxi{\ensuremath{\xi}}
\def\titlem{\itshape}
\newenvironment{biblfree}{}{\ifvmode\par\fi }
\newenvironment{bibl}{}{}
\newenvironment{byline}{\vskip6pt\itshape\fontsize{16pt}{18pt}\selectfont}{\par }
\newenvironment{citbibl}{}{\ifvmode\par\fi }
\newenvironment{docAuthor}{\ifvmode\vskip4pt\fontsize{16pt}{18pt}\selectfont\fi\itshape}{\ifvmode\par\fi }
\newenvironment{docDate}{}{\ifvmode\par\fi }
\newenvironment{docImprint}{\vskip 6pt}{\ifvmode\par\fi }
\newenvironment{docTitle}{\vskip6pt\bfseries\fontsize{22pt}{25pt}\selectfont}{\par }
\newenvironment{msHead}{\vskip 6pt}{\par}
\newenvironment{msItem}{\vskip 6pt}{\par}
\newenvironment{rubric}{}{}
\newenvironment{titlePart}{}{\par }

\newcolumntype{L}[1]{){\raggedright\arraybackslash}p{#1}}
\newcolumntype{C}[1]{){\centering\arraybackslash}p{#1}}
\newcolumntype{R}[1]{){\raggedleft\arraybackslash}p{#1}}
\newcolumntype{P}[1]{){\arraybackslash}p{#1}}
\newcolumntype{B}[1]{){\arraybackslash}b{#1}}
\newcolumntype{M}[1]{){\arraybackslash}m{#1}}
\definecolor{label}{gray}{0.75}
\def\unusedattribute#1{\sout{\textcolor{label}{#1}}}
\DeclareRobustCommand*{\xref}{\hyper@normalise\xref@}
\def\xref@#1#2{\hyper@linkurl{#2}{#1}}
\begingroup
\catcode`\_=\active
\gdef_#1{\ensuremath{\sb{\mathrm{#1}}}}
\endgroup
\mathcode`\_=\string"8000
\catcode`\_=12\relax

\usepackage[a4paper,twoside,lmargin=1in,rmargin=1in,tmargin=1in,bmargin=1in,marginparwidth=0.75in]{geometry}
\usepackage{framed}

\definecolor{shadecolor}{gray}{0.95}
\usepackage{longtable}
\usepackage[normalem]{ulem}
\usepackage{fancyvrb}
\usepackage{fancyhdr}
\usepackage{graphicx}
\usepackage{marginnote}

\renewcommand{\@cite}[1]{#1}


\renewcommand*{\marginfont}{\itshape\footnotesize}

\def\Gin@extensions{.pdf,.png,.jpg,.mps,.tif}

  \pagestyle{fancy}

\usepackage[pdftitle={Role of Boards in Cyber Security Risk Profiling: The Case of Bangladeshi Commercial Banks},
 pdfauthor={}]{hyperref}
\hyperbaseurl{}

	 \paperwidth210mm
	 \paperheight297mm
              
\def\@pnumwidth{1.55em}
\def\@tocrmarg {2.55em}
\def\@dotsep{4.5}
\setcounter{tocdepth}{3}
\clubpenalty=8000
\emergencystretch 3em
\hbadness=4000
\hyphenpenalty=400
\pretolerance=750
\tolerance=2000
\vbadness=4000
\widowpenalty=10000

\renewcommand\section{\@startsection {section}{1}{\z@}%
     {-1.75ex \@plus -0.5ex \@minus -.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\Large\bfseries}}
\renewcommand\subsection{\@startsection{subsection}{2}{\z@}%
     {-1.75ex\@plus -0.5ex \@minus- .2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\Large}}
\renewcommand\subsubsection{\@startsection{subsubsection}{3}{\z@}%
     {-1.5ex\@plus -0.35ex \@minus -.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\large}}
\renewcommand\paragraph{\@startsection{paragraph}{4}{\z@}%
     {-1ex \@plus-0.35ex \@minus -0.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\normalsize}}
\renewcommand\subparagraph{\@startsection{subparagraph}{5}{\parindent}%
     {1.5ex \@plus1ex \@minus .2ex}%
     {-1em}%
     {\reset@font\normalsize\bfseries}}


\def\l@section#1#2{\addpenalty{\@secpenalty} \addvspace{1.0em plus 1pt}
 \@tempdima 1.5em \begingroup
 \parindent \z@ \rightskip \@pnumwidth 
 \parfillskip -\@pnumwidth 
 \bfseries \leavevmode #1\hfil \hbox to\@pnumwidth{\hss #2}\par
 \endgroup}
\def\l@subsection{\@dottedtocline{2}{1.5em}{2.3em}}
\def\l@subsubsection{\@dottedtocline{3}{3.8em}{3.2em}}
\def\l@paragraph{\@dottedtocline{4}{7.0em}{4.1em}}
\def\l@subparagraph{\@dottedtocline{5}{10em}{5em}}
\@ifundefined{c@section}{\newcounter{section}}{}
\@ifundefined{c@chapter}{\newcounter{chapter}}{}
\newif\if@mainmatter 
\@mainmattertrue
\def\chaptername{Chapter}
\def\frontmatter{%
  \pagenumbering{roman}
  \def\thechapter{\@roman\c@chapter}
  \def\theHchapter{\roman{chapter}}
  \def\thesection{\@roman\c@section}
  \def\theHsection{\roman{section}}
  \def\@chapapp{}%
}
\def\mainmatter{%
  \cleardoublepage
  \def\thechapter{\@arabic\c@chapter}
  \setcounter{chapter}{0}
  \setcounter{section}{0}
  \pagenumbering{arabic}
  \setcounter{secnumdepth}{6}
  \def\@chapapp{\chaptername}%
  \def\theHchapter{\arabic{chapter}}
  \def\thesection{\@arabic\c@section}
  \def\theHsection{\arabic{section}}
}
\def\backmatter{%
  \cleardoublepage
  \setcounter{chapter}{0}
  \setcounter{section}{0}
  \setcounter{secnumdepth}{2}
  \def\@chapapp{\appendixname}%
  \def\thechapter{\@Alph\c@chapter}
  \def\theHchapter{\Alph{chapter}}
  \appendix
}
\newenvironment{bibitemlist}[1]{%
   \list{\@biblabel{\@arabic\c@enumiv}}%
       {\settowidth\labelwidth{\@biblabel{#1}}%
        \leftmargin\labelwidth
        \advance\leftmargin\labelsep
        \@openbib@code
        \usecounter{enumiv}%
        \let\p@enumiv\@empty
        \renewcommand\theenumiv{\@arabic\c@enumiv}%
	}%
  \sloppy
  \clubpenalty4000
  \@clubpenalty \clubpenalty
  \widowpenalty4000%
  \sfcode`\.\@m}%
  {\def\@noitemerr
    {\@latex@warning{Empty `bibitemlist' environment}}%
    \endlist}

\def\tableofcontents{\section*{\contentsname}\@starttoc{toc}}
\parskip0pt
\parindent1em
\def\Panel#1#2#3#4{\multicolumn{#3}{){\columncolor{#2}}#4}{#1}}
\newenvironment{reflist}{%
  \begin{raggedright}\begin{list}{}
  {%
   \setlength{\topsep}{0pt}%
   \setlength{\rightmargin}{0.25in}%
   \setlength{\itemsep}{0pt}%
   \setlength{\itemindent}{0pt}%
   \setlength{\parskip}{0pt}%
   \setlength{\parsep}{2pt}%
   \def\makelabel##1{\itshape ##1}}%
  }
  {\end{list}\end{raggedright}}
\newenvironment{sansreflist}{%
  \begin{raggedright}\begin{list}{}
  {%
   \setlength{\topsep}{0pt}%
   \setlength{\rightmargin}{0.25in}%
   \setlength{\itemindent}{0pt}%
   \setlength{\parskip}{0pt}%
   \setlength{\itemsep}{0pt}%
   \setlength{\parsep}{2pt}%
   \def\makelabel##1{\upshape ##1}}%
  }
  {\end{list}\end{raggedright}}
\newenvironment{specHead}[2]%
 {\vspace{20pt}\hrule\vspace{10pt}%
  \phantomsection\label{#1}\markright{#2}%

  \pdfbookmark[2]{#2}{#1}%
  \hspace{-0.75in}{\bfseries\fontsize{16pt}{18pt}\selectfont#2}%
  }{}
      \def\TheFullDate{2021-10-15 (revised: 15 October 2021)}
\def\TheID{10.34257/GJMBRAVOL21IS3PG49\makeatother }
\def\TheDate{2021-10-15}
\title{Role of Boards in Cyber Security Risk Profiling: The Case of Bangladeshi Commercial Banks}
\author{}\makeatletter 
\makeatletter
\newcommand*{\cleartoleftpage}{%
  \clearpage
    \if@twoside
    \ifodd\c@page
      \hbox{}\newpage
      \if@twocolumn
        \hbox{}\newpage
      \fi
    \fi
  \fi
}
\makeatother
\makeatletter
\thispagestyle{empty}
\markright{\@title}\markboth{\@title}{\@author}
\renewcommand\small{\@setfontsize\small{9pt}{11pt}\abovedisplayskip 8.5\p@ plus3\p@ minus4\p@
\belowdisplayskip \abovedisplayskip
\abovedisplayshortskip \z@ plus2\p@
\belowdisplayshortskip 4\p@ plus2\p@ minus2\p@
\def\@listi{\leftmargin\leftmargini
               \topsep 2\p@ plus1\p@ minus1\p@
               \parsep 2\p@ plus\p@ minus\p@
               \itemsep 1pt}
}
\makeatother
\fvset{frame=single,numberblanklines=false,xleftmargin=5mm,xrightmargin=5mm}
\fancyhf{} 
\setlength{\headheight}{14pt}
\fancyhead[LE]{\bfseries\leftmark} 
\fancyhead[RO]{\bfseries\rightmark} 
\fancyfoot[RO]{}
\fancyfoot[CO]{\thepage}
\fancyfoot[LO]{\TheID}
\fancyfoot[LE]{}
\fancyfoot[CE]{\thepage}
\fancyfoot[RE]{\TheID}
\hypersetup{citebordercolor=0.75 0.75 0.75,linkbordercolor=0.75 0.75 0.75,urlbordercolor=0.75 0.75 0.75,bookmarksnumbered=true}
\fancypagestyle{plain}{\fancyhead{}\renewcommand{\headrulewidth}{0pt}}

\date{}
\usepackage{authblk}

\providecommand{\keywords}[1]
{
\footnotesize
  \textbf{\textit{Index terms---}} #1
}

\usepackage{graphicx,xcolor}
\definecolor{GJBlue}{HTML}{273B81}
\definecolor{GJLightBlue}{HTML}{0A9DD9}
\definecolor{GJMediumGrey}{HTML}{6D6E70}
\definecolor{GJLightGrey}{HTML}{929497} 

\renewenvironment{abstract}{%
   \setlength{\parindent}{0pt}\raggedright
   \textcolor{GJMediumGrey}{\rule{\textwidth}{2pt}}
   \vskip16pt
   \textcolor{GJBlue}{\large\bfseries\abstractname\space}
}{%   
   \vskip8pt
   \textcolor{GJMediumGrey}{\rule{\textwidth}{2pt}}
   \vskip16pt
}

\usepackage[absolute,overlay]{textpos}

\makeatother 
      \usepackage{lineno}
      \linenumbers
      
\begin{document}

             \author[1]{Md. Bazlur  Rahman}

             \author[2]{Tania  Karim}

             \author[3]{Imtiaz Uddin  Chowdhury}

             \affil[1]{  University of Chittagong}

\renewcommand\Authands{ and }

\date{\small \em Received: 10 September 2021 Accepted: 30 September 2021 Published: 15 October 2021}

\maketitle


\begin{abstract}
        


Cybercrime becomes costlier than physical crime in developed economies. As a result, it has become the top priority in governance issues in financial institutions. As a developing nation in Bangladesh, the banking sector faces multi-dimensional challenges to adopt IT applications in banking with cybercrime. The paper examines what the banking industry faces cyber security risks and how the board members contribute to identify and mitigate the risk.

\end{abstract}


\keywords{cyber security, cyber risk, board governance, enterprise risk management, risk profile, }

\begin{textblock*}{18cm}(1cm,1cm) % {block width} (coords) 
\textcolor{GJBlue}{\LARGE Global Journals \LaTeX\ JournalKaleidoscope\texttrademark}
\end{textblock*}

\begin{textblock*}{18cm}(1.4cm,1.5cm) % {block width} (coords) 
\textcolor{GJBlue}{\footnotesize \\ Artificial Intelligence formulated this projection for compatibility purposes from the original article published at Global Journals. However, this technology is currently in beta. \emph{Therefore, kindly ignore odd layouts, missed formulae, text, tables, or figures.}}
\end{textblock*}


\begin{textblock*}{10cm}(1.05cm,3cm)
{{\textit{CrossRef DOI of original article:}} \underline{10.34257/GJMBRAVOL21IS3PG49}}
\end{textblock*}\let\tabcellsep& 	 	 		 
\section[{Introduction}]{Introduction}\par
esearch documented cybercrime as costlier than physical crime \hyperref[b33]{(Wilshusen, 2010)}. Malicious software alone, for instance, in recent years, caused damages multi-billion dollars. Cybercrime generated \$81 million theft from the Bangladesh Bank (central bank of Bangladesh) via SWIFT. JP Morgan had data on 76 million US household account recorded stolen, and US Federal Government had \$18 million personal details stolen  {\ref (Danielsson, Fouché, \& Macrae, 2016)}. Cybercrime causes financial losses and creates other risks, including reputation risk, market risk, operational risk, competency risk, and business continuation risk. The high magnitude of impact and the possibility of cybercrime leads to the use of information technology (IT) in financial institutions vulnerable on the one hand, the emergence of IT application in those institutions is robust on the other. As a result, cyber security has become the top priority list of organizations' governance issues. Identification and mitigation of cyber risk are the core functions of Enterprise Risk Management (ERM) and the board of directors must oversee these functions. Recent literature, corporate governance standards, and the legal framework of governance significantly emphasize the board's role in mitigating cyber risk among the ERM functions, especially in the financial sector. Therefore, in the financial institutions, the board members' role on the issue and their profound knowledge and IT expertise are highly required.\par
Information and communication technology is rapidly expanding towards every corporate sector globally, and the Bangladeshi banking sector is no exception. The use of electronic banking is growing in parts of the developing world. As the new software is introduced, existing financial transactions and services are being changed. However, still in Bangladesh, Cash is the dominant medium of exchange. During the last decade, almost all banks adopted electronic banking in thousands of branches. The banking sector faces multidimensional challenges to adopt and adapt E-Banking applications fully. However, it is unclear whether the commercial banks most significantly consider the cyber risk to identify assets' vulnerability. It should also be unveiled whether the IT governance and the board governance mechanisms are adequate for cyber security. While numerous studies have investigated the means of cybercrimes and IT governance for different countries and sectors, to the best of the authors' knowledge, such studies in the Bangladeshi banking sector are absent. This study will first examine the attributes of cybercrime available in the Bangladeshi banking sector and the oversight role of boards of directors on cyber security. Our empirical analysis is based on a comprehensive survey on the impact and likelihood of cybercrimes among the board of directors of ten commercial banks operating in Bangladesh. This paper draws on cyber security risks experienced by financial institutions and identifies traditional risk management's limitations in explaining corporate boards' roles and contributions. Also, this paper focuses on the enterprise risk management (ERM) techniques on preparing the risk profile and makes three main contributions. First, the paper identifies the possible cyber risks with their sources in commercial banks in Bangladesh. Second, applying the ERM tools and techniques, the study measures the severity and likelihood and severity of cybercrimes in a time horizon. Third, it furthers our understanding of whether and how the board members contribute to identify and mitigate the cyber security risks in commercial banks. Because of the increasing pressure to raise banking and computer technology, this study's results may have important implications for corporate boards and policymakers. The paper is divided into six sections. The second section includes the literature review, the third section outlines the methodology, the fourth section presents the results and findings of the study, the fifth section includes the discussion of the results. Finally, the last section comprises the conclusion, implication, and future research direction. 
\section[{II.}]{II.} 
\section[{Literature Review}]{Literature Review}\par
In the 1990s, when the internet emerged massively in all public and private sectors, things began to change information security management, focusing on the security related to people, processes, information, and IT. Since then, there have been many improvements taking us to where we are now with these old security management standards being changed in international standards \hyperref[b9]{(Humphreys, 2008)}. We reviewed the recent literature, reflecting on the operational risks, nature, sources, and impact of cyber risks, IT governance and risk mitigation, and the board of directors' role in risk management in the financial sector, given in the following sections. 
\section[{a) Cyber Risk and Cybercrimes}]{a) Cyber Risk and Cybercrimes}\par
Cyber is used as the short term for cyberspace to elucidate all-digital networks used to create, modify, store, and communicate information (GCHQ, 2012). The system includes all technical resources used in businesses, infrastructure, and services. Wilshusen (2010) identified the cyber risk as costlier than real crimes. Biener, Eling, and Wirfs (2015) refer to the term cyber risk as to the different sources of risk which affect a company's information and technology resources. They specified the cyber risk as to the business's common loss and harm arising from the technical computer system failures, thefts of data by hackers, and criminals' attacks in the system. In the USA, the National Association of Insurance Commissioners (NAIC) reported some noticeable ways of cybercrimes, including business interruption, the disclosure of sensitive information, and identity theft \hyperref[b6]{(Eling \& Wirfs, 2016)}. Many studies attempted to define cyber risk from different perspectives. Some researchers focus on specific areas, such as \hyperref[b14]{Mukhopadhyay et al. (2013)} refer cyber risk to malicious electronic events disrupting business operations.\par
On the other hand, many researchers define the cyber risk in a broader perspective as an information security risk (Ogut, Raghunathan, \& Menon, 2011) or risk failing information systems  {\ref (Bohme \& Kataria, 2006)}. The definition of cyber risk we employ as an expansive operational risk based on how the financial institutions categorize the cyber risk. Cebula and Young (2010) define cyber risk as an operational risk to resources in a way that affects availability, confidentiality, or integrity. In this paper, we focus on operational risks that concern IT assets.\par
Although a considerable amount of literature on cyber risk is found in previous studies, the empirical evidence of cyber risk in a specific industry, country or region is relatively limited. The Ponemon Institute regularly publishes reports on the number of data breaches and how they happen. The Ponemon Institute reports that in 2013, the average expense of a data breach amounting to nearly \$10 million was incurred \hyperref[b18]{(Ponemon Institute, 2013)}. The report predicted the figure to be increased significantly in the following years.\par
Similarly  
\section[{b) Nature, Sources, and Methods of Cyber Crime}]{b) Nature, Sources, and Methods of Cyber Crime}\par
Biener et al. 2015 divided the sources of cyber risk into four broad categories: systems and technology failures, actions of people, internal processes failure, and external events. Obsolescence of hardware, failure due to capacity, compatibility of software, configuration management, security settings, coding practices, change control, system design, system specifications are the elements of cyber risk that occurred in system and technology failures. The errors, omissions, and mistakes, lack of appropriate knowledge and skills of employees, shortage of personnel to take action, intentional vandalism, theft, sabotage, and fraud are the common cyber risks in the action of people category. The internal processes failure category includes the causes of cyber risks are the failure of processes due to poor process design or inadequate execution, lack of control operating the process, and failure of supporting processes to deliver resources. The major elements of cyber risks come from external events are unfavorable weather, loss by fire, flood, earthquake, and risk arising from legal issues, changing business environment, and external parties. The ultimate impact of cybercrime is a financial loss of the organization, and the methods of crime are not always similar. Cybercrime affects the functional departments (Accounting and Finance, Marketing, Operation or Production, Human Resources) directly or indirectly of an organization. \hyperref[b21]{Raghavan and Parthiban (2014)} argue that cybercrime by ATM frauds, phishing, identity theft, and denial of service directly affects a firm's financing activities. Also, Raghavan and Parthiban (2014) assert that companies that fall prey to cybercriminals lose their market value because of the legitimate concerns of financial analysts, investors, and creditors and because of customers' worries about the security of their business transactions.\par
The cyber threats come from internal and external sources of the organization. \hyperref[b23]{Riem (2001)} concludes that the most critical computer security threats come from employees, consultants, and contractors working in the company rather than outside hackers. In a similar study, \hyperref[b35]{Yapp (2001)} agrees that more than 70 percent of threats to cyber security like frauds, misuses, and abuses originate mostly from the inside. The weak password policies and controls are the roots of the most internal cyber security problems. 
\section[{c) Role of Board of Directors in IT Governance and Cyber Risk Mitigation}]{c) Role of Board of Directors in IT Governance and Cyber Risk Mitigation}\par
One of the earliest improvements in corporate governance was made in 1994 when the Toronto Stock Exchange Committee on Corporate Governance in Canada issued its report. The report included the groundbreaking guidelines for the board's role that the board of directors should explicitly assume responsibility for identifying the key risks of the corporation and ensuring the implementation of appropriate systems to mitigate those risks \hyperref[b11]{(Leblanc \& Fraser, 2016)}.\par
Leblanc and Fraser (2016) also mentioned that, in 2010, the Securities and Exchange Commission (SEC) in the USA brought in new guidelines for the boards to involve in the oversight of the risk management functions and disclosures to the investors. Following the SEC in the USA, the UK's Financial Reporting Council, in its September 2014 publication, the UK Corporate Governance Code, stipulates that the board's responsibility is to is determine the nature and extend of the critical risks that impact on firm's strategic objectives. Also, the board should monitor the sound internal control systems.\par
Leblanc and Fraser (2016) emphasized the effective board governance and IT knowledge of board members. On the other hand, \hyperref[b10]{Kröger (2008)} suggested the process and accountability of risk management relating to cyber security risks. \hyperref[b10]{Kröger (2008)} recommended that the board should comprehensively address the cyber security issues, and finally, ensure who is responsible and who pays needs to be answered. \hyperref[b25]{Shackelford (2012)} argued that companies must take a proactive approach toward managing cybercrimes to improve overall cybersecurity. Similarly, \hyperref[b24]{Sajeva and Masera (2006)} recommended that the corporate governance framework should ensure strategic guidance, active monitoring, and board accountability to the shareholders in managing cybersecurity risk.\par
However, many lacks on the board regarding cybersecurity governance are indeed available in the literature. Interestingly, many organizations argue that they do not need to invest enough in cybersecurity and cyber-insurance. \hyperref[b16]{Parent and Reich (2009)} believe that this stance underscores the importance of boards to action against potential IT disasters. To make risk management decisions in a practical, fair, and rational way, \hyperref[b24]{Sajeva and Masera (2006)} addressed that the governance strategies would have to consider a more accredited governance principle in both public and corporate levels through the participatory, efficient, and fair decision-oriented process. Furthermore, Skelcher (2005) and Renn and Walker (2008) criticized the multilayer and complex decision making and reporting process because the present governance structures are not good enough to ensure the independence of the CIO, CRO, and other executive officers in risk reporting. Therefore, it is now generally recognized that the board has full accountability for overseeing the firm's approach to managing cybersecurity risks. However, exactly how boards do this in practice can vary. Fraser and Simkins (2010) explained some of the more popular approaches of enterprise risk oversight: first, delegating oversight of enterprise risk management to the audit committee, second, delegating oversight of risk management to the risk committee (or another existing committee such as the governance committee), third, have the full board engaged in the oversight of enterprise risk management. 
\section[{III.}]{III.} 
\section[{Methodology a) Objectives of the study}]{Methodology a) Objectives of the study}\par
The primary objective of the study is to identify the top cybersecurity risks in Bangladeshi commercial banks and present their severity and likelihood through a risk profile. Also, the study demonstrates to find out whether the oversight role of the board adequate mitigating major cyber risks. The specific objectives of the study are as follows: a. To identify the critical cyber security risks that have a significant effect on the Bangladeshi banking sector; and b. To measure the severity and likelihood of the identified risks through the risk profiles. 
\section[{b) Study Sample, Data Collection and Analysis}]{b) Study Sample, Data Collection and Analysis}\par
The target population for the study is the directors of banks operating in Bangladesh. We have selected ten major stock exchange listed private commercial banks operating in Bangladesh for at least 20 years and have online banking ( Through a rigorous literature review, we pointed out the cybercrimes and cyber risks (Table  {\ref -}2) with their nature and sources. Then we asked 30 structured questions about cyber security, risk knowledge, risk profiling, and overseeing risk management functions. It is not easy to access primary data on the board of directors in financial institutions because they keep their business secret \hyperref[b4]{(Daily, Dalton, \& Cannella, 2003)}. Moreover, since the directors are busy professionals, the response rate is meager \hyperref[b17]{(Pettigrew, 1992)}. To increase the response rate, we devoted careful attention to questionnaire design and wording of questions avoiding vague concepts and reducing items' ambiguity \hyperref[b30]{(Tourangeau, Rips, \& Rasinski, 2000)}. We prepared a cover letter, emphasizing the need for research and increasing interest in the directors' topic \hyperref[b13]{(Minichilli, Zattoni, \& Zona, 2009)}. We have also prepared a detailed description of the cyber risk terms and the questionnaire that allows the directors to be aware of cyber risk, cybercrimes, and risk analysis.\par
We have divided the questionnaire into three sections. In the first part of the questionnaire, we asked about the current and potential cyber risks that impact the bank's internal and external environment to assess the impact, nature, and sources of risks. In the second part, we asked to rate the impacts of identified cyber risks, and in the final part of the questionnaire, we asked to measure the likelihood of risks. We measured the impact and likelihood of risk on a five-point magnitude scale (Fraser \& Simkins, 2010). The five-point scales (Table \hyperref[tab_3]{3}) to measure risk are 1 = Minor, 2 = Moderate, 3 = Major, 4 = Severe, and 5 = Worst Case. Similarly, the impact scales are Very Low, Low, Medium, High, and Very High. The Likelihood/Probability scales are 1 = Remote, 2 = Unlikely, 3 = Medium, 4 = Likely, and 5 = Very Likely. The directors of the sample banks rated the cyber risks (Table \hyperref[tab_2]{2}). In their opinion, we assessed the impact and likelihood of the "Top 10" risks (Fraser \& Simkins, 2010) with a three-year time horizon. A "Top 10" risk profile exhibits a ranked listing of the most significant risks an organization faces. It is the simplest method of identifying and ranking the risks and easy to communicate. Also, we presented the identified risks on the risk map. A risk map (Exhibit-1) is one of the most widely described ways to present critical risks facing an organization (Fraser \& Simkins, 2010). It is easy to understand and exhibit, and visually appealing. The vertical axis shows the potential impact of risks, and the horizontal axis shows the estimated likelihood of risks. The map has four areas: high impact/ low likelihood, low impact/ low likelihood, high impact/ high likelihood, and low impact/ high likelihood areas. The risks falling into the area of high impact/ high likelihood are considered critical and require the extensive attention of the board and management.\par
IV. 
\section[{Results}]{Results}\par
We summarized the risk as "Top-Ten" risk (Table \hyperref[tab_4]{4}) with sources, implications/events, and possible cybercrimes in Bangladeshi commercial banks based on directors' opinions. The significant cyber risks (Top-Ten) that may happen in the banking sector in Bangladesh are IT governance risk, IT investment risk, cyber competence risk, cyber infrastructure risk, IT project risk, business continuity risk, information risk, financial risk, public perception risk, and IT reputation risk. The study results in IT governance risk as to the most significant risk in the Bangladeshi banking sector. The sources of IT governance risk are the absence of IT expert directors on the board, lack of separate board committees for IT and risk, and insufficient oversight functions regarding IT functions and cyber risk of board committees and the board of directors. The impacts of the IT governance risk on the decision-making process are delaying in the process, risk of mistake and reporting barriers to decision making, and the cost is beyond control. The respondents also agreed that cybercrimes might happen in the Bangladeshi banking  The respondents further evaluated the risks through a risk voting method (Fraser \& Simkins, 2010), measuring the impact and likelihood of risk on a fivepoint scale. We summarized the voting scores of top-ten risks. IT governance risk, IT investment risk, and information risk are the most critical risks among the major cyber security risks in voting scores (Table \hyperref[tab_5]{5}). Above all, the impact of IT governance is very high and is very likely to happen. On the other hand, the cyber infrastructure risk and cyber competence risk have high impacts but medium likely to happen in the banking sector. IT reputation risk, business continuity risk, and public perception risk are identified as low significant risks. We further presented the risk scores through the risk map in impact and likelihood magnitudes. In the risk map (Exhibit-2), IT governance and IT investment risk fall in the critical area (Red Zone), where both impact and probability are high. Information risk, cyber infrastructure risk, cyber competence risk, financial risk, and IT reputation risk fall in the alarming area (Yellow Zone) where the risk impact and probability are in medium magnitudes. On the other hand, IT project risk, business continuity risk, and public perception risk ate in the safe area of the risk map (Green Zone). 
\section[{Exhibit 2: The Risk Map}]{Exhibit 2: The Risk Map}\par
Source: Table \hyperref[tab_5]{5} V. 
\section[{Discussion}]{Discussion}\par
To investigate both existing and possible cyber risks, we gathered empirical evidence from the banking industry in Bangladesh. We combined the theories/literature about cyber security risk and IT governance and primary data to explain whether and how the risk managers and board of directors can identify and mitigate cyber security risk in the Bangladeshi banking industry. The results show that cyber security risks and their sources, impacts, and likelihood are identifiable, depending on the methods used by the organizations, and risks can be mitigated through the effective risk management process and robust oversight by the board. Hence, the board has a role in identifying and mitigating the cyber risk enhancing risk management effectiveness, and board committees' effectiveness in operational and strategic control.\par
Our discussion suggests that IT governance has three core targets: IT project implementation, data and information security, and hardware and systems integrity. Risk governance requires plans and implementation for each IT target. In the wake of catastrophic incidents at Target, JPMorgan Chase, Home Depot, and many other well-known established international brands worldwide, the boards of directors are now very aware of their responsibility for the safety and integrity of the data and information networks \hyperref[b29]{(Straight, 2015)}. Financial corporations are now adopting the responsibility to monitor cyber risk management and establish three primary IT governance functions: learn, ensure, and inspect. The boards' best position is to mitigate cyber security risk and limit the damage when a cyber-attack occurs.\par
Similarly, the risk committee or audit committee plays a critical role in monitoring management's prevention from and response to cyber security risks and the associated regulatory framework and business developments. If all banks do not have their cyber risk committee, the audit committee may play the oversight role on cyber security risk. Implementing a successful cyber security program requires continuous and proactive engagement from the board and the risk committee. In its capacity to oversee risk management's functions and monitoring management's policies, the risk committee must play a notable strategic role in coordinating cyber security initiatives and policies.\par
IT investment risk arises from different types of cybercrimes, which lead to a significant loss of cyber security investment. Although banks invest a lot of money in their cyber security, the criminals break down this security and steal the data. As a result, the investment for this security becomes worthless and, consequently, the customers lose their trust and banks lose their reputation. The IT professionals' competence level falls at risk, and the new projects can face risky start for cybercrimes increasing costs. 
\section[{VI.}]{VI.} 
\section[{Conclusion, Implication, and Future Research Direction}]{Conclusion, Implication, and Future Research Direction}\par
In this study, using the risk profiles, we have explored whether the board of directors can identify and mitigate the cyber security risks and whether the Bangladeshi banking sector is vulnerable. The banking sector, for its vulnerability, is under the spotlight with stakeholders, including the public, regulators, media, and international agencies. Therefore, we aim to contribute to the development of cyber security in the industry by drawing attention to the board's monitoring functions. This section addresses our conclusions, policy implications, and future research directions.\par
This study explored the impact and likelihood of known and possible cyber risks in the Bangladeshi banking sector. We found cyber risk and their sources, events, and common cybercrimes. We employed the "Top-Ten" risk and risk map approaches to identify the most critical cyber risk that should be considered immediately. This study found that IT governance risk and IT investment risk are more critical that made the banking sector vulnerable. Also, information risk, cyber infrastructure risk, cyber competence risk, financial risk, and IT reputation risk are high in impact and likelihood magnitude. The increase of cyber risks can increase the overall risk positions, and the chance of revenues will drop, and customers can divert to competitors. Cyber incidents cause long-term intangible costs that directly impact all lines of business and, therefore, in the worst case, sharply drop the market value. Therefore, IT governance should be implemented as a process, subject to continuous monitoring, reviewing, and improvement. We find out that most of the banks do not have their separate IT committee, and very few of the board members are IT experts or IT knowledgeable. Even most of the banks do not have the position of Chief Information Officer (CIO). In contrast, Chief Risk Officer (CRO) or Chief Financial Officer (CFO) is responsible for the IT department. Consequently, the board cannot implement their IT plan appropriately and not getting specific feedback from them.\par
Based on the above discussion, holistic governance of cyber security risks appears to be vital in the Bangladeshi banking sector. IT governance is necessary to implement industry-wide cyber risk because of the increased importance of information and technology. We think preventive measures for IT security and coverage by cyber insurance policies can be a risk governance tool to minimize cyber risk exposures.\par
Moreover, the findings of the study will be helpful to planners, policymakers, regulators, including the central bank and Security Exchange Commission (SEC) of Bangladesh. The findings will be useful to stress the importance of designing and implementing a sophisticated IT governance for the financial sector to cope with the challenges and uncertainties in the changing environment arising from globalization, rapid technological changes, deregulation, and market competition.\par
Though our study does not concentrate on a particular governance framework, further research can be conducted on the governance framework that can effectively monitor cyber risk management to protect the firm from cybercrimes. Also, potential research can be done to determine the prevention strategies that best help individuals, businesses, and government agencies avoid cybercrime, and international best practice responses and suitable governance framework for the financial sector to mitigate cyber risk and avoid catastrophic cyber scandals.\begin{figure}[htbp]
\noindent\textbf{}\includegraphics[]{image-2.png}
\caption{\label{figure2}}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{1} \par 
\begin{longtable}{P{0.07191201353637902\textwidth}P{0.3351099830795262\textwidth}P{0.0733502538071066\textwidth}P{0.06328257191201353\textwidth}P{0.08773265651438239\textwidth}P{0.15676818950930624\textwidth}P{0.06184433164128596\textwidth}}
No.\tabcellsep Name of the bank\tabcellsep Stock Exchange Listed\tabcellsep Online Banking\tabcellsep Year of Establishment\tabcellsep Assets Ending 2019 in Million BD Taka\tabcellsep Size of Board of Directors\\
1.\tabcellsep A B Bank Limited\tabcellsep Yes\tabcellsep Yes\tabcellsep 1982\tabcellsep 368,076\tabcellsep 6\\
2.\tabcellsep Bank Asia Limited\tabcellsep Yes\tabcellsep Yes\tabcellsep 1999\tabcellsep 355,720\tabcellsep 16\\
3.\tabcellsep Brac Bank Limited\tabcellsep Yes\tabcellsep Yes\tabcellsep 2001\tabcellsep 414,855\tabcellsep 8\\
4.\tabcellsep Dhaka Bank limited\tabcellsep Yes\tabcellsep Yes\tabcellsep 1995\tabcellsep 286,437\tabcellsep 18\\
5.\tabcellsep Dutch Bangla Bank Limited\tabcellsep Yes\tabcellsep Yes\tabcellsep 1995\tabcellsep 380,182\tabcellsep 6\\
6.\tabcellsep Eastern Bank Limited\tabcellsep Yes\tabcellsep Yes\tabcellsep 1992\tabcellsep 338,201\tabcellsep 11\\
7.\tabcellsep Islami Bank Bangladesh Limited\tabcellsep Yes\tabcellsep Yes\tabcellsep 1983\tabcellsep 1,093,188\tabcellsep 22\\
8.\tabcellsep Exim Bank Ltd.\tabcellsep Yes\tabcellsep Yes\tabcellsep 1999\tabcellsep 433,018\tabcellsep 12\\
9.\tabcellsep First Security Islami Bank Ltd.\tabcellsep Yes\tabcellsep Yes\tabcellsep 1999\tabcellsep 437,832\tabcellsep 14\\
10.\tabcellsep Shahjalal Islami Bank Limited\tabcellsep Yes\tabcellsep Yes\tabcellsep 2001\tabcellsep 268,697\tabcellsep 19\\
\multicolumn{2}{l}{Source: Lanka Bangla, 2020}\tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \end{longtable} \par
 
\caption{\label{tab_1}Table 1 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{2} \par 
\begin{longtable}{P{0.44541484716157204\textwidth}P{0.40458515283842794\textwidth}}
Type of Risk\tabcellsep Cybercrime\\
1. IT Investment Risk\tabcellsep a) Computer virus\\
2. IT Governance Risk\tabcellsep b) ATM frauds\\
3. Cyber Competence Risk 4. Cyber Infrastructure Risk 5. IT Project Risk 6. Business Continuity Risk 7. Information Risk 8. Financial Risk\tabcellsep c) Identity theft d) Phishing e) Spoofing f) E-theft g) Netspionage h) Online credit card fraud i) Online denial of services\\
9. Public Perception Risk 10. IT Reputation Risk\tabcellsep j) Software piracy k) Spam\\
\tabcellsep l) E-fraud\\
\tabcellsep m) Cyber terrorism\end{longtable} \par
 
\caption{\label{tab_2}Table 2 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{3} \par 
\begin{longtable}{P{0.2091269841269841\textwidth}P{0.1248015873015873\textwidth}P{0.2496031746031746\textwidth}P{0.26646825396825397\textwidth}}
Rating\tabcellsep Impact\tabcellsep Likelihood Scale\tabcellsep Probability Scale in the Time Horizon\\
5 = Worst Case\tabcellsep Very High\tabcellsep 5 = Very Likely\tabcellsep ? 90\%.\\
4 = Severe\tabcellsep High\tabcellsep 4 = Likely\tabcellsep 65\% -90\%\\
3 = M ajor\tabcellsep Medium\tabcellsep 3 = Medium\tabcellsep 25\% -65\%\\
2 = Moderate 1 = Minor\tabcellsep Low Very Low\tabcellsep 2 = Unlikely 1 = Remote\tabcellsep 5\% -25\% ? 5\%\end{longtable} \par
 
\caption{\label{tab_3}Table 3 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{4} \par 
\begin{longtable}{P{0.10966169724770641\textwidth}P{0.004873853211009175\textwidth}P{0.3051032110091743\textwidth}P{0.3192373853211009\textwidth}P{0.11112385321100916\textwidth}}
\multicolumn{2}{l}{Type of Risk}\tabcellsep Sources of Risk\tabcellsep Implications/ Risk Event\tabcellsep Cybercrime\\
1. IT Risk\tabcellsep Governance\tabcellsep Lack of IT Expert on the Board. Lack of separate board committee for IT and Risk. I nadequate oversight function.\tabcellsep Delay in the decision-making process. Reporting barriers and risk of mistake in decision making. Cost is beyond control.\\
\multicolumn{2}{l}{2. IT Investment Risk}\tabcellsep Theft of Data. Hardware Damage.\tabcellsep Capital lost Low profit\\
3. Cyber\tabcellsep \tabcellsep Loose Customer Employee\tabcellsep Revenue downturn Customer\\
\multicolumn{2}{l}{Competence Risk 4. Cyberinfrastructure Risk 5. IT Project Risk 6. Business Continuity Risk 7. Information Risk}\tabcellsep Turnover Loose Information Physical Damage Lack of skilled IT Expert. Lack of advanced technological i nfrastructure. Lower Capital/Liquidity Low Business Growth Weak Password Dishonest Employee\tabcellsep dissatisfaction Risky Operation. Lack of insurance coverage or high insurance premium. Hampered smooth operation. Long decision-making process. Business shutdown. Share price fall. Loosing competency. Mistrust among the customers.\tabcellsep 1. Computer virus 2. ATM frauds 3. Identity theft 4. Phishing 5. Spoofing 6. E-theft 7. Netspionage 8. Online credit card fraud 9. Online denial of services\\
\multicolumn{2}{l}{8. Financial Risk}\tabcellsep Budget pressure/ Insufficient IT fund. High cost of IT project.\tabcellsep Lack technological of Negative impact on net advanced infrastructure. income.\tabcellsep 10. Software piracy 11. Spam 12. E-fraud 13. Cyber terror ism.\\
\multicolumn{2}{l}{9. Public Perception Risk}\tabcellsep Cyber security is not considered as top priority. Lack of prompt action against the cybercrime. Lack of updated information and community engagement.\tabcellsep Growing Reduction in using online public mistrust. banking and credit card. Negative reports in media\\
\multicolumn{2}{l}{10. IT Reputation Risk}\tabcellsep Identity Theft. Lack of communication.\tabcellsep Lower Additional regulatory scrutiny. customer loyalty.\end{longtable} \par
  {\small\itshape [Note: Source: Survey opinions]} 
\caption{\label{tab_4}Table 4 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{5} \par 
\begin{longtable}{P{0.07562557924003707\textwidth}P{0.13707136237256717\textwidth}P{0.16464318813716405\textwidth}P{0.022057460611677477\textwidth}P{0.042539388322520855\textwidth}P{0.06459684893419833\textwidth}P{0.0819277108433735\textwidth}P{0.21584800741427246\textwidth}P{0.004726598702502317\textwidth}P{0.009453197405004634\textwidth}P{0.014179796107506951\textwidth}P{0.01733086190917516\textwidth}}
\tabcellsep \multicolumn{5}{l}{sector, including computer viruses, ATM frauds, identity}\tabcellsep \multicolumn{5}{l}{online credit card fraud, online denial of services,}\\
\tabcellsep \multicolumn{5}{l}{theft, phishing, spoofing, E-theft, Netspionage, and}\tabcellsep \multicolumn{5}{l}{software piracy, spam, E-fraud, and cyber-terrorism.}\\
Year 2021\tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \\
54\tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \\
Volume XXI Issue III Version I\tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \\
( ) A\tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \\
Global Journal of Management and Business Research\tabcellsep No. 1 2 3 4 5 6 7\tabcellsep Type of Risk IT Governance Risk IT Investment Risk Information Risk Cyberinfrastructure Risk Cyber Competence Risk IT Project Risk Financial Risk\tabcellsep N 50 50 50 50 50 50 50\tabcellsep Average 4.62 4.22 3.64 4.28 3.92 3.78 2.56\tabcellsep \multicolumn{2}{l}{Impact St. Dev. 0.6966 0.9101 0.8021 0.9267 0.6952 0.6788 0.8609}\tabcellsep \multicolumn{4}{l}{Likelihood Magnitude N Average St. Dev. Magnitude Very High 50 4.58 0.7309 Very Likely High 50 4.44 0.8369 Likely High 50 3.92 1.0069 Likely High 50 2.80 0.8806 Medium High 50 2.66 0.9172 Medium High 50 2.30 0.9529 Unlikely Medium 50 4.62 0.6667 Very Likely}\\
\tabcellsep 8\tabcellsep IT Reputation Risk\tabcellsep 50\tabcellsep 2.24\tabcellsep \multicolumn{2}{l}{0.9161}\tabcellsep Low\tabcellsep 50\tabcellsep 3.90\tabcellsep 1.0738\tabcellsep Likely\\
\tabcellsep 9\tabcellsep Business Continuity Risk\tabcellsep 50\tabcellsep 2.48\tabcellsep \multicolumn{2}{l}{0.8628}\tabcellsep Medium\tabcellsep 50\tabcellsep 2.24\tabcellsep 0.8466\tabcellsep Unlikely\\
\tabcellsep 10\tabcellsep Public Perception Risk\tabcellsep 50\tabcellsep 1.82\tabcellsep \multicolumn{2}{l}{0.8003}\tabcellsep Very Low\tabcellsep 50\tabcellsep 2.02\tabcellsep 0.7421\tabcellsep Unlikely\\
\tabcellsep \multicolumn{2}{l}{Source: Authors' Figure}\tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \\
\tabcellsep \multicolumn{2}{l}{© 2021 Global Journals}\tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \end{longtable} \par
 
\caption{\label{tab_5}Table 5 :}\end{figure}
 			\footnote{© 2021 Global JournalsRole of Boards in Cyber security Risk Profiling: T he Case of Bangladeshi Commercial Banks} 			\footnote{© 2021 Global JournalsRole of Boards in Cyber security Risk Profiling: the Case of Bangladeshi Commercial Banks} 		 		\backmatter  			  				\begin{bibitemlist}{1}
\bibitem[ World Economic Forum ()]{b34}\label{b34} 	 		\textit{},  		 \url{http://www3.weforum.org/docs/WEF\textunderscore GlobalRisks\textunderscore Report\textunderscore 2012}  	 	 		\textit{World Economic Forum}  		2012.  	 	 (Global Risks 2012 Seventh Edition) 
\bibitem[Posthumus and Von Solms ()]{b20}\label{b20} 	 		‘A framework for the governance of information security’.  		 			S Posthumus 		,  		 			R Von Solms 		.  	 	 		\textit{Computers \& Security}  		2004. 23  (8)  p. .  	 
\bibitem[Sajeva and Masera ()]{b24}\label{b24} 	 		‘A strategic approach to risk governance of critical infrastructures’.  		 			M Sajeva 		,  		 			M Masera 		.  	 	 		\textit{International journal of critical infrastructures}  		2006. 2  (4)  p. .  	 
\bibitem[Cebula and Young ()]{b3}\label{b3} 	 		\textit{A taxonomy of operational cyber security risks},  		 			J L Cebula 		,  		 			L R Young 		.  		2010.  		 			Carnegie-Mellon Univ Pittsburgh Pa Software Engineering Inst 		 	 
\bibitem[Smith et al. ()]{b28}\label{b28} 	 		‘Case studies of cybercrime and its impact on marketing activity and shareholder value’.  		 			K T Smith 		,  		 			M Smith 		,  		 			J L Smith 		.  	 	 		\textit{Academy of Marketing Studies Journal}  		2011.  	 
\bibitem[Daily et al. ()]{b4}\label{b4} 	 		\textit{Corporate governance: Decades of dialogue and data},  		 			C M Daily 		,  		 			D R Dalton 		,  		 			A A CannellaJr 		.  		2003. Academy of management review. 28 p. .  	 
\bibitem[Ponemon ()]{b19}\label{b19} 	 		\textit{Cost of data breach study: Global analysis. Poneomon Institute sponsored by Symantec},  		 			L Ponemon 		.  		2013. p. .  	 
\bibitem[Kröger ()]{b10}\label{b10} 	 		‘Critical infrastructures at risk: A need for a new conceptual approach and extended analytical tools’.  		 			W Kröger 		.  	 	 		\textit{Reliability Engineering \& System Safety}  		2008. 93  (12)  p. .  	 
\bibitem[Greisiger et al. ()]{b8}\label{b8} 	 		\textit{Cyber liability \& data breach insurance claims},  		 			M Greisiger 		,  		 			I D Allclear 		,  		 			F Ireland 		,  		 			P L L Cox 		.  		 \url{https://netdiligence.com/wp-content/uploads/2016/05/CyberClaimsStudy-2013.pdfon}  		2013. 2017. 3.  	 
\bibitem[Danielsson et al. ()]{b5}\label{b5} 	 		\textit{Cyber risk as systemic risk},  		 			J Danielsson 		,  		 			M Fouche 		,  		 			R Macrae 		.  		2016.  		 			VOX CEPR Policy Portal 		 	 
\bibitem[Eling et al. ()]{b6}\label{b6} 	 		\textit{Cyber risk: too big to insure? Risk transfer options for a mercurial risk class},  		 			M Eling 		,  		 			J H. ; I Wirfs 		,  		 			Vw 		,  		 			Schriftenreihe 		.  		2016.  	 
\bibitem[Ö?üt et al. ()]{b15}\label{b15} 	 		‘Cyber security risk management: Public policy implications of correlated risk, imperfect ability to prove loss, and observability of self-protection’.  		 			H Ö?üt 		,  		 			S Raghunathan 		,  		 			N Menon 		.  	 	 		\textit{An International Journal}  		2011. 31  (3)  p. .  	 
\bibitem[Mukhopadhyay et al. ()]{b14}\label{b14} 	 		‘Cyber-risk decision models: To insure IT or not’.  		 			A Mukhopadhyay 		,  		 			S Chatterjee 		,  		 			D Saha 		,  		 			A Mahanti 		,  		 			S K Sadhukhan 		.  	 	 		\textit{Decision Support Systems}  		2013. 56 p. .  	 
\bibitem[Siegel et al. ()]{b26}\label{b26} 	 		‘Cyber-risk management: technical and insurance controls for enterprise-level security’.  		 			C A Siegel 		,  		 			T R Sagalow 		,  		 			P Serritella 		.  	 	 		\textit{Information Systems Security}  		2002. 11  (4)  p. .  	 
\bibitem[Riem (2001)]{b23}\label{b23} 	 		‘Cybercrimes of the 21st Century’.  		 			A Riem 		.  	 	 		\textit{Computer Fraud \& Security}  		2001. April. p. .  	 
\bibitem[Fraser, J., & Simkins, B. (ed.) ()]{b7}\label{b7} 	 		\textit{Enterprise risk management: Today's leading research and best practices for tomorrow's executives},  		Fraser, J., \& Simkins, B. (ed.)  		2010. 3.  	 
\bibitem[Parent and Reich ()]{b16}\label{b16} 	 		‘Governing information technology risk’.  		 			M Parent 		,  		 			B H Reich 		.  	 	 		\textit{California Management Review}  		2009. 51  (3)  p. .  	 
\bibitem[Wilshusen ()]{b33}\label{b33} 	 		‘Information Management: Challenges in Federal Agencies' Use of Web 2.0 Technologies: Testimony Before the Subcommittee on Information Policy, Census, and National Archives, Committee on Oversight and Government Reform, House of Representatives’.  		 			G C Wilshusen 		.  	 	 		\textit{US Government Accountability Office}  		2010.  	 
\bibitem[Humphreys ()]{b9}\label{b9} 	 		\textit{Information security management standards: Compliance, governance and risk management},  		 			E Humphreys 		.  		2008. 13 p. .  	 	 (information security technical report) 
\bibitem[Biener et al. ()]{b1}\label{b1} 	 		\textit{Insurability of cyber risk: An empirical analysis. The Geneva Papers on Risk and Insurance-Issues and Practice},  		 			C Biener 		,  		 			M Eling 		,  		 			J H Wirfs 		.  		2015. 40 p. .  	 
\bibitem[Whitman ()]{b32}\label{b32} 	 		‘Is ERM legally required? Yes for financial and governmental institutions, no for private enterprises’.  		 			A F Whitman 		.  	 	 		\textit{Risk Management and Insurance Review}  		2015. 18  (2)  p. .  	 
\bibitem[Skelcher ()]{b27}\label{b27} 	 		‘Jurisdictional integrity, polycentrism, and the design of democratic governance’.  		 			C Skelcher 		.  	 	 		\textit{Governance}  		2005. 18  (1)  p. .  	 
\bibitem[Renn and Walker ()]{b22}\label{b22} 	 		‘Lessons learned: A re-assessment of the IRGC framework on risk governance’.  		 			O Renn 		,  		 			K Walker 		.  	 	 		\textit{Global risk governance},  				 (Dordrecht)  		2008. Springer. p. .  	 
\bibitem[Minichilli et al. ()]{b13}\label{b13} 	 		‘Making boards effective: An empirical examination of board task performance’.  		 			A Minichilli 		,  		 			A Zattoni 		,  		 			F Zona 		.  	 	 		\textit{British Journal of Management}  		2009. 20  (1)  p. .  	 
\bibitem[Institute ()]{b18}\label{b18} 	 		\textit{Managing Cyber Security as a Business Risk: Cyber Insurance in the Digital Age},  		 			Ponemon Institute 		.  		 \url{http://assets.fiercemarkets.com/public/newsletter/fiercehealthit/experianponemonreport}  		2013.  	 
\bibitem[Böhme and Kataria (2006)]{b2}\label{b2} 	 		‘Models and Measures for Correlation in Cyber-Insurance’.  		 			R Böhme 		,  		 			G Kataria 		.  	 	 		\textit{WEIS},  				2006. June. 2 p. 3.  	 
\bibitem[Pettigrew ()]{b17}\label{b17} 	 		\textit{On studying managerial elites. Strategic management journal},  		 			A M Pettigrew 		.  		1992. 13 p. .  	 
\bibitem[Yapp ()]{b35}\label{b35} 	 		‘Passwords: use and abuse’.  		 			P Yapp 		.  	 	 		\textit{Computer Fraud \& Security}  		2001. 2001.  (9) .  	 
\bibitem[Al-Hadi et al. ()]{b0}\label{b0} 	 		‘Risk committee, firm life cycle, and market risk disclosures’.  		 			A Al-Hadi 		,  		 			M M Hasan 		,  		 			A Habib 		.  	 	 		\textit{Corporate Governance: An International Review}  		2016. 24  (2)  p. .  	 
\bibitem[Van Asselt and Renn ()]{b31}\label{b31} 	 		‘Risk governance’.  		 			M B Van Asselt 		,  		 			O Renn 		.  	 	 		\textit{Journal of Risk Research}  		2011. 14  (4)  p. .  	 
\bibitem[Shackelford ()]{b25}\label{b25} 	 		‘Should your firm invest in cyber risk insurance’.  		 			S J Shackelford 		.  	 	 		\textit{Business Horizons},  				2012. 55 p. .  	 
\bibitem[Lewis and Baker ()]{b12}\label{b12} 	 		\textit{The economic impact of cybercrime and cyber espionage},  		 			J Lewis 		,  		 			S Baker 		.  		2013. McAfee.  	 
\bibitem[Raghavan and Parthiban ()]{b21}\label{b21} 	 		‘The effect of cybercrime on a Bank's finances’.  		 			A R Raghavan 		,  		 			L Parthiban 		.  	 	 		\textit{International Journal of Current Research and Academic Review}  		2014. 2  (2)  p. .  	 
\bibitem[Leblanc and Fraser ()]{b11}\label{b11} 	 		\textit{The Handbook of Board Governance: A Comprehensive Guide for Public, Private, and Not-for-Profit Board Members},  		 			R Leblanc 		,  		 			J Fraser 		.  		2016. John Wiley \& Sons.  	 
\bibitem[Straight (2015)]{b29}\label{b29} 	 		\textit{The Role of the Board in Cybersecurity: 'Learn, Ensure, Inspect', Dark Reading},  		 			J Straight 		.  		 \url{http://www.darkreading.com/endpoint/the-role-of-the-board-in-cybersecurity-learn-ensure-inspect/a/d-id/1321222}  		2015. August 02. 2015.  	 
\bibitem[Tourangeau et al. ()]{b30}\label{b30} 	 		 			R Tourangeau 		,  		 			L J Rips 		,  		 			K Rasinski 		.  		 CMU/SEI-2010-TN-028.  		\textit{The psychology of survey response},  				2000. Cambridge University Press.  		 			CERT Carnegie Mellon University 		 	 	 (Technical Note) 
\end{bibitemlist}
 			 		 	 
\end{document}
