Bridging Cybersecurity and Enterprise Risk Management in the Digital Era
DOI:
https://doi.org/10.70063/techcompinnovations.v2i1.66Keywords:
Cybersecurity Governance, Enterprise Risk Management (ERM), Digital Resilience, Cross-Disciplinary Competence, Cyber-Risk MetricsAbstract
This paper explores the strategic integration of cybersecurity into enterprise risk management (ERM) frameworks to enhance digital resilience in modern organizations. Drawing on a qualitative library research method, the study synthesizes literature, models, and case analyses to identify best practices and governance structures that align technical cybersecurity measures with broader organizational goals. The research reveals that treating cybersecurity as an isolated IT function weakens risk visibility and incident response, while embedding it within ERM enables proactive identification, prioritization, and mitigation of cyber risks. The study highlights challenges such as the communication gap between IT teams and senior leadership, lack of standardized cyber-risk metrics, and siloed governance structures. It proposes cross-disciplinary collaboration, integrated risk frameworks (e.g., ISO 31000, NIST), and metrics-driven decision-making as essential components of effective cybersecurity governance. Although conceptual in nature, the findings emphasize the urgent need for cohesive, strategic, and metric-informed approaches to managing cyber threats. Future research should prioritize empirical validation, industry-specific adaptations, and development of standardized cyber-risk indicators to support evidence-based investment and board-level accountability in cybersecurity governance.
Downloads
References
Djajasinga, N. D., Fatmawati, E., Syamsuddin, S., Sukomardojo, T., & Sulistyo, A. B. (2023). Risk Management in the Digital Era: Addressing Cybersecurity Challenges in Business. Branding: Jurnal Manajemen dan Bisnis, 2(2). https://doi.org/10.15575/jb.v2i2.31919
George, M. W., & Apter, D. E. (2022). The Elements of Library Research: What Every Student Needs to Know (2nd ed.). Princeton University Press.
ISACA. (2022). Managing Cybersecurity Risk as Enterprise Risk. ISACA Journal, Volume 5. https://www.isaca.org/resources/isaca-journal/issues/2022/volume-5/managing-cybersecurity-risk-as-enterprise-risk
Jones, J., & Ashenden, D. (2020). Measuring and Managing Information Risk: A FAIR Approach. Academic Press.
Mayring, P. (2014). Qualitative Content Analysis: Theoretical Foundation, Basic Procedures and Software Solution. Klagenfurt: Beltz.
McKinsey & Company. (n.d.). Cybersecurity: Linchpin of the digital enterprise. https://www.mckinsey.com/capabilities/risk-and-resilience/ourinsights/cybersecurity/cybersecurity-linchpin-of-the-digital-enterprise
National Institute of Standards and Technology (NIST). (2018). Framework for Improving Critical Infrastructure Cybersecurity (Version 1.1). https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf
PwC. (2023). Global Digital Trust Insights Survey. https://www.pwc.com/gx/en/issues/cybersecurity/digital-trust-insights.html
Romanosky, S., & Petrun Sayers, E. L. (2024). Enterprise risk management: How do firms integrate cyber risk? Management Research Review, 47(1), 1–17. https://doi.org/10.1108/MRR-10-2021-0774
Soomro, Z. A., Shah, M. H., & Ahmed, J. (2016). Information security management needs more holistic approach: A literature review. International Journal of Information Management, 36(2), 215–225. https://doi.org/10.1016/j.ijinfomgt.2015.11.009
Zed, M. (2004). Metode Penelitian Kepustakaan. Jakarta: Yayasan Obor Indonesia.
