Corporate Management Boards' Information Security Orientation: An Analysis of Cybersecurity Incidents in DAX 30 Companies

Keywords: Security Management, Cybersecurity Incidents, Management Boards, Germany

Our study analyzes the impact of cybersecurity incidents (CSIs) at executive level in German blue-chip companies between 2005 and 2018. Using Upper Echelons Theory, we examine the effect of CSIs on both the composition of management boards as well as their members' profiles and related responsibilities, performing a qualitative in-depth analysis of the positive cases found. Our results show that while CSIs are a common problem for large German groups, only a few of them address IT-related incidents directly through governance. Firms that reacted strongly went against the general trend, and either added a new functional unit to the management board or strengthened functions related to the issue. Our findings indicate that German blue-chip companies have not yet devised a common strategy to deal with CSIs. Firms that reshape their management boards instead tend to take a more complianceoriented approach.

Introduction

Cybersecurity incidents (hereafter CSIs) pose a considerable threat to economies and appear to concern all businesses. According to a report by McAfee (2020), in a survey of 1,500 organizations from seven countries (G7 member states excluding Italy but including Australia) only 4% claimed to have experienced no CSIs in 2019. When financial and non-financial damage is taken into account, cybercrime-related costs almost doubled between 2018 and 2020 to exceed $1 trillion (McAfee, 2020). Other sources suggest that the total is expected to reach $6 trillion in 2021, representing the "greatest transfer of economic wealth in history [... which] will be more profitable than the global trade of all major illegal drugs combined" (Cybersecurity Ventures, 2018). On a technical level, however, firms frequently lack effective CSI detection and defense mechanisms, with the result that only every second attack (53%) is detected by internal IT systems [START_REF] Kutscher | M-Trends 2017: A View From the Front Lines[END_REF] and only after an average of 99 days (Kasperski, 2016). As a result CSIs continue to cause serious problems illustrated by the steady increase in both the number of sensitive data records and the severity of IT breaches (Risk Based Security, 2021). While the risk to critical IT infrastructure from CSIs is global, the economic impact varies from country to country. According to a McAfee report (2014), referred to in a review of the European Union Agency for Cybersecurity (ENISA, 2016), cybercrime costs when measured as the ratio of a country's GDP, are higher in the U.S. (0.64%) and China (0.63%) than in the EU (0.41%), with some members considerably exceeding the EU and the global average, including Germany (1.6%).

Whereas small and medium-sized enterprises often struggle to create an IT security baseline, larger firms and multinationals are expected to have both the financial resources and the governance structures to respond and adapt to the challenges of CSIs. Although full IT security appears to be unachievable even in large companies, we might assume that firms learn from past incidents, especially when obliged to publicly disclose the significant effects recorded to their stakeholders. However, there is little in the academic literature on the outcomes of post-CSI learning processes. [START_REF] Kvochko | Why data breaches don't hurt stock prices[END_REF] point to the fact that, due to a lack of data on CSI experiences, related learning outcomes appear to be ignored by the stock market. Likewise, Masli et al. (2016, p. 687) argue that while "scholarly and practice literature both stress the importance of senior executive engagement with IT management, the recommendations for doing so remain, at best, limited and general". The fact that most of the companies surveyed by McAfee (2020) in their latest report do not have plans or solutions to respond to CSIs appears to confirm this observation.

While several scholars have examined the engagement of executives in the management of ITrelated activities over the last three decades (e.g., [START_REF] Jarvenpaa | Executive involvement and participation in the management of information technology[END_REF][START_REF] Purvis | The assimilation of knowledge platforms in organizations: An empirical investigation[END_REF][START_REF] Sharma | The contingent effects of management support and task interdependence on successful information systems implementation[END_REF][START_REF] Kearns | Antecedents and consequences of information systems planning integration[END_REF][START_REF] Liang | Assimilation of enterprise systems: The effect of institutional pressures and the mediating role of top management[END_REF]) little attention has been paid to the governance aspects concerning executives in firms that experienced CSIs. [START_REF] Masli | Senior executives' IT management responsibilities: Serious IT-related deficiencies and CEO/CFO turnover[END_REF] sought to fill this gap by analyzing the likelihood of CEO/CFO turnover in U.S. firms that report IT material weaknesses. According to these authors, senior executive turnover appears to be determined by the type of IT deficiency, with CEO turnover affected by issues related to global IT management responsibilities, and CFO departures by problems related to internal IT control. Studying the S-OX 404 reports of U.S. firms, [START_REF] Haislip | Repairing organizational legitimacy following information technology (IT) material weaknesses: Executive turnover, IT expertise, and IT system upgrade[END_REF] also found higher levels of CEO/CFO turnover in cases of IT-related material weaknesses, as well as a shift towards greater IT expertise to redress negative CSI effects. [START_REF] Li | CEO/CFO turnover and subsequent remediation of information technology material weaknesses[END_REF] confirmed that internal control material weaknesses are associated with both higher CEO and CFO turnover, but only observed remediation measures once the CEO had left the company. Likewise, [START_REF] Banker | The impact of information security breach incidents on CIO turnover[END_REF] confirmed higher CSI-related turnover of CEOs and CIOs in U.S. firms, with the exception of CFOs who do not appear to be held accountable for such incidents. Several authors who focused on individual expertise with respect to IT infrastructures, further emphasize the positive impact of CEO IT expertise [START_REF] Haislip | Do the roles of the CEO and CFO differ when it comes to data security breaches[END_REF][START_REF] Haislip | The effect of CEO IT expertise on the information environment: Evidence from earnings forecasts and announcements[END_REF], board IT expertise [START_REF] Vincent | Board and management-level factors affecting the maturity of IT risk management practices[END_REF] and the active engagement of board committees in IT risk management [START_REF] Higgs | The relationship between board-level technology committees and reported security breaches[END_REF][START_REF] Smith | Do auditors price breach risk in their audit fees[END_REF] with respect to the likelihood of CSIs occurring and the related costs.

While these recent studies analyzed multiple governance issues dealing with CSIs, they mainly focused on U.S. firms. To our knowledge, no analysis of European samples exists to date. This is particularly surprising as European economies appear to be affected by CSIs at least as much as other regions. In fact, when considering certain aspects such as cybercrime costs expressed as a percentage of a nation's GDP some European countries, namely the Netherlands, Norway and Germany, figure in the upper section of international comparisons (ENISA, 2016). An analysis of their economies with respect to CSIs, therefore, appears justified. With regard to these three countries, an in-depth analysis of CSIs in German companies seems particularly interesting. First, Germany is the leading European economy and the world's fourth-largest industrial nation in terms of GDP (Worldbank, 2019). Given the size of Germany's economy and its strong ties to other economies in Europe, the extent of CSIs and their cost is expected to be considerable. Estimating the country's annual cybercrime cost to exceed $64 billion, McAfee (2020) even considered Germany to be the "most developed criminal underground in the EU". Second, German firms (unless listed on a U.S. stock exchange) do not underlay the obligation for fulfilling S-OX, notably SEC requirements, as both national and European legislation had less formalized requirements regarding IT risk reporting, at least until 2019.1 Consequently, we may expect different governance outcomes as a result of CSIs. Finally, Germany's two-tier governance system noticeably differs from the Anglo-Saxon system in that listed companies are run by a management board (Vorstand) in charge of operational affairs, which is separate from the supervisory board (Aufsichtsrat) responsible for monitoring the management team and offering advice on the firm's longterm strategic orientation (German Stock Corporation Act, § §76-117). While one-tier board systems permit internal executives to sit on or even to head (in the case of CEO duality) the board of directors, this configuration is prohibited in Germany. Hence, internal executives do not have a direct impact on the efficiency of the monitoring instance but are in charge of the day-to-day implementation of the supervisory board's strategic decisions. This last point is particularly interesting as U.S. studies on the effects of governance on CSIs usually focus their analysis on the board of directors and senior executives (CEO, CFO, CIO, etc.), but rarely consider the composition, profiles and related responsibilities of the whole management team. An analysis of the latter, however, when run under a two-tier board structure, extends the focus beyond key (senior) executives. This enlarged perspective may contribute to a better understanding of the effects of IT-related incidents on aspects of governance, notably whether a change in the scope of responsibilities or the appointment of new top executives following a CSI will lead to a more efficient management team with respect to IT risk management.

The aim of our study is to analyze the effects of IT-related incidents disclosed by firms at their executive level. Following Upper Echelons Theory [START_REF] Hambrick | Upper echelons: The organization as a reflection of its top managers[END_REF], an organization's outcome is said to be determined by the characteristics of the decision-makers among other things. Consequently, top management team variables, such as composition, profiles, and responsibilities are expected to determine a firm's performance, the latter being seen as the outcome of the decisionmakers' individual cognitive biases, values and personality traits. We assume that this can also apply to how top management teams deal with cybersecurity issues. Accordingly, our research question addresses how far CSIs impact on the composition of management boards as well as the profiles and responsibilities of their members. Deploying Upper Echelons Theory, we focused on the characteristics of the management boards of firms that have experienced significant CSIs. Our analysis is based on a sample of 43 German companies listed on the country's Dax 30 blue-chip index between 2005 and 2018, which we examined for CSIs that were experienced and disclosed. Due to the absence of CSI databases in Germany, we ran an in-depth content analysis of the CSIs identified by gathering information from websites, corporate documentation and other communication sources. In addition, we collected data on the companies' top management teams from which we quantitatively analyzed the characteristics through variables related to the management board itself and the demography and education of the members. We further qualitatively analyzed any changes in the management boards' composition and the scope of the managers' responsibilities regarding cybersecurity in the years following a CSI. That said, the professional experience of IT executives, as examined in U.S. firms by [START_REF] Lim | Sustainability of a firm's reputation for information technology capability: The role of senior IT executives[END_REF] or [START_REF] Haislip | Repairing organizational legitimacy following information technology (IT) material weaknesses: Executive turnover, IT expertise, and IT system upgrade[END_REF][START_REF] Haislip | The effect of CEO IT expertise on the information environment: Evidence from earnings forecasts and announcements[END_REF], could not be included in our study as data on these aspects was incomplete or unavailable.

The remainder of our paper is organized as follows. Part 2 looks at the underlying theoretical assumptions that explain the factors determining any changes in the composition of top management teams, with a focus on the cybersecurity-related literature. Part 3 describes our data and presents the methodology adopted. Part 4 presents the main results of our analysis, while part 5 interprets the findings in the light of the literature and offers a critical discussion. Part 6 presents the conclusion, and part 7 addresses the limitations of our analysis and suggests avenues for further research.

Upper Echelons Theory, Top Management Teams and Cybersecurity Incidents

Upper Echelons Theory and top management team composition

Upper Echelons Theory [START_REF] Hambrick | Upper echelons: The organization as a reflection of its top managers[END_REF] states that an organization's performance is partially determined by the characteristics of its decision-makers. Consequently, the composition of top management teams is assumed to play a decisive role in a firm's strategic policies and outcomes. Given the assumption of bounded rationality [START_REF] March | Organizations[END_REF][START_REF] Cyert | A behavioral theory of the firm[END_REF] according to which informationally complex and uncertain situations are not objectively "knowable" but are merely interpretable [START_REF] Hambrick | A contextual model of strategic decision making in organizations in[END_REF][START_REF] Mischel | The interaction of person and situation[END_REF], the theory's basic premise is that "organizational outcomes [...] are viewed as reflections of the values and cognitive biases of powerful actors in the organization" (Hambrick and Mason, 1984, p. 193). In other words, it is the top manager's individual cognitive biases, values and personality traits that shape their perceptions and interpretations of situations and thus determine their behavior and strategic choices. Given how hard it is to collect psychometric data on managers, Hambrick and Mason (1984, p. 198) suggest using observable background characteristics, such as age, professional background, education, socioeconomic roots and group characteristics, as proxies to explain (at least partially) organizational outcomes. In our analysis, we focused on observable variables of the categories of age, formal education, career experiences other than functional track and group characteristics.

Initially developed in the 1980s and widely disseminated in recent decades, Upper Echelons Theory includes several conceptual and methodological weaknesses [START_REF] Hambrick | Upper echelons theory: An update[END_REF][START_REF] Abatecola | Hambrick and Mason's "Upper Echelons Theory": evolution and open avenues[END_REF][START_REF] Lovelace | Meta-critiques of upper echelons theory: Verdicts and recommendations for future research[END_REF]. Both top managers' cognition processes and their interactions are thus often seen as a black box, although some progress has been made with respect to methodological techniques. Likewise, we can criticize the lack of evidence regarding the sense of causality between managerial background characteristics and strategic outcomes, as well as the still unclear role of contingencies and moderating conditions such as culture and diversity. The widespread use of (aggregated) proxy variables causes further incongruities between theoretical constructs and empirical measures. Issues of endogeneity are also worth examining, since managerial decision-making observed may mirror the board of directors' expectations rather than the characteristics of individual executives. Finally, and more fundamentally, the issue of the role of the company's performance that managers can themselves effectively determine continues to generate ongoing academic debate.

Following Upper Echelons Theory, background characteristics of top executives are seen as a proxy for their socio-cognitive diversity, skills and socio-professional ties [START_REF] Finkelstein | Strategic leadership: Top executives and their effects on organizations[END_REF] whose combination is assumed to shape a firm's strategic direction and performance [START_REF] Michel | Diversification posture and top management team characteristics[END_REF][START_REF] Carpenter | Top management teams, global strategic posture, and the moderating role of uncertainty[END_REF][START_REF] Dezsö | Does female representation in top management improve firm performance? A panel data investigation[END_REF]. Scholars apply this theory in multiple ways by mainly focusing on senior executive characteristics like education, experience and personality traits (for an overview see [START_REF] Wang | Do CEOs matter to firm strategic actions and firm performance? A meta-analytic investigation based on upper echelon theory[END_REF]. Studying the banking industry in the U.S., [START_REF] Bantel | Top management and innovations in banking: Does the composition of the top team make a difference?[END_REF] demonstrated more than three decades ago that the educational level of top management teams is a key factor in a firm's capacity to innovate. In line with these findings, [START_REF] Wiersema | Top management team demography and corporate strategic change[END_REF] observed a positive link between the educational level of top management teams and their propensity for strategic change. Likewise, [START_REF] Wally | Personal and structural determinants of the pace of strategic decision making[END_REF] found a positive link between top executives' cognitive skills and their decision-making speed. Over time, scholars have shifted their focus from specific background characteristics to a more general analysis of the composition of top management teams, as well as the diversity of the background characteristics of their members (for reviews see [START_REF] Certo | Top management teams, strategy and financial performance: A meta-analytic examination[END_REF][START_REF] Abatecola | The personality factor: how top management teams make decisions. A literature review[END_REF]. [START_REF] Auden | Top management team international risk management factor and firm performance[END_REF] observed that age homogeneity among top executives stimulates firm performance as does the heterogeneity of a top management team's functional background, the latter also determining a positive performance effect of team tenure. [START_REF] Naranjo-Gil | Top management team heterogeneity, strategic change and operational performance[END_REF] confirmed these findings, showing that top executives' heterogeneity, when measured by a team's diversity relative to tenure, functional and educational background, moderates the impact of strategic change on operational performance. In addition, executives' personality traits and expertise are also considered to determine strategic outcomes [START_REF] Bertrand | Managing with style: The effect of managers on firm policies[END_REF][START_REF] Bédard | The effect of audit committee expertise, independence, and activity on aggressive earnings management[END_REF][START_REF] Ge | Do CFOs have style? An empirical investigation of the effect of individual CFOs on financial reporting practices[END_REF][START_REF] Winkler | Does the CMO's personality matter for web traffic? Evidence from technology-based new ventures[END_REF]. Consequently [START_REF] Qu | Board members with style: The effect of audit committee members and their personal styles on financial reporting choices[END_REF] shows that characteristics, such as managers' personality [START_REF] Hurtz | Personality and job performance: The big five revisited[END_REF], selfperception [START_REF] Judge | The power of being positive: The relationship between positive self-concept and job performance[END_REF], ethical beliefs [START_REF] Koh | The link between organizational ethics and job satisfaction: A study of managers in Singapore[END_REF] and childhood experience [START_REF] Blustein | Contributions of psychological separation and parental attachment to the career development process[END_REF] determine not only observable aspects, but also a firm's likelihood of financial misstatements.

Top management teams and cybersecurity incidents

While several scholars have examined executives' engagement in the management of IT-related activities over the last three decades (e.g., [START_REF] Jarvenpaa | Executive involvement and participation in the management of information technology[END_REF][START_REF] Purvis | The assimilation of knowledge platforms in organizations: An empirical investigation[END_REF][START_REF] Sharma | The contingent effects of management support and task interdependence on successful information systems implementation[END_REF][START_REF] Kearns | Antecedents and consequences of information systems planning integration[END_REF][START_REF] Liang | Assimilation of enterprise systems: The effect of institutional pressures and the mediating role of top management[END_REF], little attention has been paid to specific governance aspects of the executives in companies that have experienced CSIs. The presumed impact of top management teams' background characteristics on organizational outcomes, however, also applies to CSIs. Accordingly, IT expertise of top executives, as well as their educational and functional background in this area are considered to have an impact on firm performance. On the one hand, when top managers have a higher level of IT expertise [START_REF] Haislip | Do the roles of the CEO and CFO differ when it comes to data security breaches[END_REF][START_REF] Vincent | Board and management-level factors affecting the maturity of IT risk management practices[END_REF] and there is a comprehensive anchorage of IT issues in a firm's decision-making bodies [START_REF] Higgs | The relationship between board-level technology committees and reported security breaches[END_REF][START_REF] Smith | Do auditors price breach risk in their audit fees[END_REF], it seems that there is a reduction in the likelihood of such incidents. On the other hand, CSIs may lead to noticeable changes in the composition of top management teams, such as more senior executive turnover [START_REF] Masli | Senior executives' IT management responsibilities: Serious IT-related deficiencies and CEO/CFO turnover[END_REF][START_REF] Li | CEO/CFO turnover and subsequent remediation of information technology material weaknesses[END_REF] or a readjustment in the makeup of boards and committees. Changes may include inviting IT experts with proven experience in a related industry to intervene, or appointing new board members with valuable educational and professional skills in ITrelated areas, the aim being to avoid CSIs from reoccurring and to reduce the likelihood of new IT incidents.

Surprisingly, studies on the relations between IT-related incidents and specific governance aspects of management boards are limited to U.S. samples. [START_REF] Masli | Senior executives' IT management responsibilities: Serious IT-related deficiencies and CEO/CFO turnover[END_REF] analyzed the likelihood of CEO/CFO turnover in U.S. firms that reported an IT material weaknesses. According to these authors, senior executive turnover appears to be determined by the type of IT deficiency, with CEO turnover affected by issues with overall IT management responsibilities, and CFO departures affected by problems related to internal IT control. Studying the S-OX 404 reports of U.S. groups, [START_REF] Haislip | Repairing organizational legitimacy following information technology (IT) material weaknesses: Executive turnover, IT expertise, and IT system upgrade[END_REF] also found higher levels of CEO/CFO turnover in cases of IT-related material weaknesses and observed further changes toward more IT expertise to remediate negative effects of IT-related incidents. While [START_REF] Li | CEO/CFO turnover and subsequent remediation of information technology material weaknesses[END_REF] confirmed that internal control material weaknesses were associated with higher CEO and higher CFO turnover, the authors only noted remediation measures when the CEO actually left the firm. Likewise, Banker and Feng (2019) confirmed higher CSI-related turnover for CEOs and CIOs in U.S. firms, with the exception of CFOs, who do not seem to be held accountable for such IT incidents. Analyzing the impact of operational IT failures on board-level governance of U.S. publicly listed firms, [START_REF] Benaroch | Operational IT failures, IT value destruction, and board-level IT governance changes[END_REF] also showed that IT incidents lead to adjustments to the board, including higher CIO turnover as well as more effort to increase the board's level of IT experience. However, these changes tend to be limited to internal executive directors.

By analyzing the relationship between top executives' IT knowledge and organizational output, [START_REF] Haislip | Do the roles of the CEO and CFO differ when it comes to data security breaches[END_REF] suggested that higher levels of IT expertise by CEOs lead to greater transparency, while greater CFO IT expertise reduces the number of problems reported, suggesting that it results in fewer CSIs. Likewise, [START_REF] Haislip | The effect of CEO IT expertise on the information environment: Evidence from earnings forecasts and announcements[END_REF] investigated a large sample of U.S. firms and found that CEOs with greater IT expertise appear to encourage more efficient IT practices. As a result, internal information reporting systems tend to improve through better forecasting accuracy and faster reporting cycles. Aside from senior executives, other scholars have studied the role of boards of directors regarding IT risk management. Their findings also suggest a positive yet less sharp impact of IT expertise, while highlighting the importance of committees both before and after CSIs. For example, [START_REF] Vincent | Board and management-level factors affecting the maturity of IT risk management practices[END_REF] found a positive impact of IT expertise on management boards in terms of IT risk management practices, but suggested that a lack of IT expertise is less important than the board's involvement in IT risk monitoring since the former can be compensated for by bringing in external specialists. Furthermore, IT risk management practices appear more mature when monitoring is ensured at board level rather than by an executive committee. This confirms the findings of [START_REF] Higgs | The relationship between board-level technology committees and reported security breaches[END_REF] who observed that firms with more mature technology committees are less likely to experience IT security breaches. In line with these findings, [START_REF] Smith | Do auditors price breach risk in their audit fees[END_REF] suggested that the presence of boardlevel risk committees as well as more active audit committees can help to mitigate higher audit fees related to data security breaches. More generally, firms hit by CSIs exhibit fewer innovative activities [START_REF] He | The impact of reported cybersecurity breaches on firm innovation[END_REF] and a greater propensity to manipulate earnings at the cost of future profitability [START_REF] Xu | Earnings management in firms with data security breaches[END_REF] following a breach, leading to negative overall effects on shareholders' wealth [START_REF] Gatzlaff | The effect of data breaches on shareholder wealth[END_REF]. To sum up these results, the current academic literature shows a link between the management of CSIs and executive board composition, tenure, responsibilities and expertise.

The low number of studies on the impact of CSIs on the composition of top management teams is quite surprising as the literature points to several links between IT-related incidents and firm performance. These include decisions about the voluntary disclosure of CSIs; diverse market reactions with respect to the nature of these incidents; as well as reactions to transparency requirements. Concerning the first point, managers seem to fear the effects of negative news on reputation and, therefore, tend to "sugarcoat" the anticipated negative consequences [START_REF] Fang | When bad news is sugarcoated: Information distortion, organizational search and the behavioral theory of the firm[END_REF]. Nevertheless, a study of U.S. firms [START_REF] Gordon | Market value of voluntary disclosures concerning information security[END_REF] found a positive link between the voluntary disclosure of incidents related to information security and firm value suggesting that managers should recognize the positive signaling effects of voluntary disclosures to market participants. In addition, both the nature and the severity of CSIs seemingly determine positive or (to be avoided) negative market reactions. Studies have found that breaches affect companies with customer data more substantially as these firms receive more public attention and are often associated with data protection laws such as GDPR (European Parliament and European Council, 2016). In line with this point, several studies have detected negative Stock Appreciation Rights (SARs) in firms experiencing failures regarding confidential customer information [START_REF] Campbell | The economic cost of publicly announced information security breaches: empirical evidence from the stock market[END_REF][START_REF] Aytes | The economic impact of information security breaches: Firm value and intra-industry effects[END_REF]Maholtra and Malholtra, 2011) and other privacy breaches (Acquisiti et al., 2006;Nicholas-Donald et al., 2012), with payment card fraud causing the highest losses [START_REF] Johnson | Stock price reaction to data breaches[END_REF]. Firms are also afraid of not respecting basic information security management principles as technically 'easy' breaches tend to have a stronger impact on stock prices than highly sophisticated attacks. Accordingly, [START_REF] Leung | Indirect financial loss of phishing to global market[END_REF] and later [START_REF] Bose | Do phishing alerts impact global corporations? A firm value analysis[END_REF] noted that phishing, an example of an attack that can mostly be avoided through internal awareness, leads to negative Cumulative Abnormal Returns (CARs). In general, this form of breach appears to have a more serious impact on technology companies than on non-technology firms [START_REF] Pirounias | The relation between information security events and firm market value, empirical evidence on recent disclosures: An extension of the GLZ study[END_REF]. A link between reputation and stock market price was also found when good reputation is viewed as an investment against the impact of IT security breaches. Companies with greater pre-event corporate social responsibility thereby seem to exhibit less negative CARs [START_REF] Akey | Hacking corporate reputations[END_REF] and are less likely to incur a breach [START_REF] Lending | Corporate governance, social responsibility, and data breaches[END_REF]. Finally, regulatory and financial market authorities increasingly require transparency from companies affected by IT security incidents, thereby determining managerial decision-making. Such requirements are, on the one hand, due to the need to protect critical national infrastructures (European Council, 2016) and on the other to protect investors from distorted information on the firm's health (Securities and Exchange Commission, 2018). Thus, simply accepting the consequences of a security breach (e.g., by compensating the customers after such an IT-related incident [START_REF] Goode | User compensation as a data breach recovery action: An investigation of the Sony PlayStation network breach[END_REF])) appears to be insufficient.

Since companies have an interest in managing CSIs to improve their performance, one way to do this is to strengthen their corporate governance through adjustments to the top management team. Prior research has suggested that individual members of executive teams can have a significant impact on improving firm management with respect to IT risks. However, no study to date has addressed changes that take the entire board into account or the specific situation in Europe. To fill this gap, we analyze the impact of CSIs at executive level, at the same time extending research to outside the U.S. (Masli et al., 2017;[START_REF] Vincent | Board and management-level factors affecting the maturity of IT risk management practices[END_REF]. Accordingly, we seek to answer the research question "How far CSIs impact on the composition of management boards as well as the profiles and responsibilities of their members?"

Data and Methodology

We base our study on German listed firms for the reasons already highlighted before (size of the economy and CSI-related costs, less formalized disclosure requirements, governance system with a two-tier board structure, lack of research exploring the link between CSIs and German top executive teams). We conduct our study on German blue-chip companies listed on the Dax 30 stock market index. Traded on the Frankfurt Stock Exchange, the index comprises the country's 30 largest industrial and financial listed firms. Index membership is reviewed twice a year and depends on companies' order book volume and their market capitalization.

To start, we identified all the firms listed in the Dax 30 index at any one time in the period 2005-2018. This gave us a total sample of 43 companies. We then identified any major publicly disclosed CSIs during the 14-year period for each firm. The biggest challenge here was to get precise information as, to our knowledge, no official database on relevant CSIs experienced by listed German firms exists to date. While the country has a Federal Office for Information Security (Bundesamt für Sicherheit in der Informationstechnik), the latter does not publish or distribute any data on IT-related incidents in German companies or their repercussions. This corresponds to ''the problem of collecting empirical data on the computer (in)security phenomena [that] has been examined by a number of disciplines and professions in various countries'' (Kowalski 1994, p. 97). Despite extensive data being gathered on the technical consequences of IT-related incidents, the question of their impact on strategic decision-making and organizational outcomes lacks clear empirical evidence. Aiming to deliver the most accurate and conclusive results for a qualitative empirical assessment we, therefore, opted for a research method in the form of an in-depth content analysis of media sources.

The media represent and influence the public sphere in modern economies as a primary space in which problems and solutions are discussed, and responsibilities and competencies are contested [START_REF] Neidhardt | Öffentlichkeit, öffentliche Meinung, soziale Bewegungen[END_REF]. Considered as a structured social space, the media follow a specific rationale and have specific characteristics [START_REF] Hilgartner | The rise and fall of social problems: A public arena model[END_REF]) that include agenda-setting and gatekeeping functions as well as assigning news value and imposing attention cycles. In other words, the media are "a site on which various social groups, institutions, and ideologies struggle over the definition and construction of social reality" (Gurevitch and Levy, 1985, p. 19), actively taking part in the construction of social realities by presenting them as legitimate or not [START_REF] Lok | Institutional logics as identity projects[END_REF]. Consequently, the media affect the reputation of both firms and their managers, with the magnitude of the effect depending on the nature of the news. Studying German companies, [START_REF] Raithel | The effects of corporate reputation perceptions of the general public on shareholder value[END_REF] found reputational perceptions driven by non-financial aspects to have a bigger impact on shareholder wealth than those affected by financial factors. [START_REF] Stern | Whom are you promoting? Positive voluntary public disclosures and executive turnover[END_REF] noted that disclosing positive information on a firm's research and development activities as well as their performance also sends positive signals to the managerial labor market about the quality of a firm's executives and thus has a positive impact on voluntary executive turnover. Similar reputation reactions may also exist with respect to top executives' IT-related risk management and adequate handlings of experienced CSIs.

Identification of IT-related incidents

Given these considerations and the lack of an official database on CSIs in Germany, we decided to conduct an in-depth manual analysis of all IT incidents experienced by our sample firms that gained public attention by being disclosed during the observation period, either by the companies themselves or through third parties. Information on CSIs was gathered from corporate websites, official corporate documentation and online communication sources. To compile the relevant data, we employed the most frequently used search engines, Google and Bing. The links followed an n+2 logic, where n is the last tab showing relevant information on a potential CSI. Our keyword selection included the firm name as well as one of the items "security", "incident", "cybersecurity" or "attack", either in English or in German. Following the logic of a systematic review [START_REF] Cook | Systematic reviews: Synthesis of best evidence for clinical decisions[END_REF][START_REF] Cooper | Synthesizing research[END_REF][START_REF] Denyer | Producing a systematic review[END_REF], the data were verified through cross-checks with other sources, including corrections or corporate (re)statements. For each of the CSOs detected, we noted the date of both the IT incident and its disclosure. In addition, we checked the firms' annual reports to identify whether any management board-related post-CSI governance measures (composition changes, restructuration of functional units or changes in responsibilities) were taken or if the topic of IT security was explicitly addressed. Positive findings were further analyzed and then presented as mini cases following our quantitative analysis. Contrary to U.S. studies on CSIs, missing or non-verifiable data on the IT-related incidents' financial outcomes of our German sample firms did not allow us to quantify their business impact (such as changes in market value or CARs), thereby limiting our analysis to directly observable and documented effects following the disclosure of CSIs (legal prosecution, loss of customers etc...).

Measurements of governance data

Governance composition information about the sample firms' management boards was gathered from the companies' annual reports over the 14-year observation period (2005)(2006)(2007)(2008)(2009)(2010)(2011)(2012)(2013)(2014)(2015)(2016)(2017)(2018). The data comprised both individual information about the board members as well as the aggregated characteristics of the management board as an entity. Inspired by [START_REF] Hambrick | Upper echelons: The organization as a reflection of its top managers[END_REF], we divided the management board members' background characteristics into four areas: personal, demographic, educational and professional information. Our data was completed by general management board characteristics comprising for each considered fiscal year the variables board size, proportion of female executives, level of turnover, presence of members with foreign citizenship, age, tenure and educational background.

Results and Analysis

Our multisource research shows that 16 of the 43 current or former Dax 30 companies experienced a significant CSI (19 IT incidents were identified in total) at least once during the 14-year period (2005-2018), representing 37.2% of all the sample firms. As Table 2 shows, five IT incidents took place prior to 2015, while almost three-quarters of all CSIs occurred after 2015. This may be interpreted in two ways: either the technological progress in IT combined with the subsequently more intensive use of data caused a parallel increase in the frequency of CSIs, or the growing rise in ITrelated incidents is the result of increased public disclosure due to stronger interest and sensitivity of stakeholders together with a faster dissemination of related information. After identifying all the companies affected by CSIs during our observation period, we conducted a comprehensive analysis of the characteristics of the management boards of all the firms concerned. Our analysis was conducted from three perspectives:

▪ a cross-company perspective that focused on the key characteristics of the management boards and their evolution during the observation period, ▪ a cross-company perspective that analyzed the profiles of all the board members and their evolution during the entire observation period, and, ▪ a firm-specific perspective that explored the characteristics of both the management board and its individual members for each firm responding to a CSI, while searching in particular for key changes following the IT security incident experienced.

Evolution of management board characteristics

Analysis of the characteristics of the management boards during the 14-year observation period shows some interesting findings (Table 3). Board size, measured by the relative indicator of the sum of full-year mandates completed by intermediate management board entrances and exits on a daily-basis, appears to be relatively stable over time as variation concerns around six members on average. Given the tougher legal requirements regarding the representation of women on the supervisory boards of German listed firms (minimum quota of 30% of all new members since 2016), the proportion of female representatives on management boards also increased over the course of the observation period, although it remained at a relatively low level. That said, in 2018, five out of 16 companies (BASF, E.ON, Infineon Technologies, RWE and ThyssenKrupp) still had no women among their top managers. As a result of ongoing internationalization, the percentage of non-German top managers increased to an average of 31% of all full-year mandates, representing a rise of around 50% compared to 2005. Firms with the highest average level of foreigners among their top executives were FMC (75%), Adidas (55%) and Deutsche Post (44%). Those with the lowest levels over time were E.ON (7%), BASF (12%) and Infineon Technologies (12%). While at first appearing somewhat counterintuitive, management board turnover also turned out to be quite stable over time, with annual entries and exits representing 16% of the members on average. Looking at the entire period, turnover was highest at Beiersdorf (22%), followed by Bayer (20%) and E.ON (20%), whereas it seems to have been quite low at Adidas (7%), BASF (8%) and FMC (12%). As a result of ongoing internationalization, the percentage of non-German top managers increased to an average of 31% of all full-year mandates, representing a rise of around 50% compared to 2005. Firms with the highest level of foreigners among their top executives were FMC (75%), Adidas (55%) and Deutsche Post (44%). Those with the lowest levels over time were E.ON (7%), BASF (12%) and Infineon Technologies (12%). Likewise, the average age of board members was stable over time, fluctuating at around 54 years old, with the youngest top managers during the period in question working at Infineon Technologies (51.5 years) and the oldest at Volkswagen (57.7 years). Finally, our analysis also showed relative stability of average tenure at around six years. The firms with the longest average tenure were Adidas (11.25 years) and BASF (7.57 years), while those with the shortest average stay were RWE (4.9 years) and Beiersdorf (4.52 years).

Table 3. Evolution of management board characteristics of sample firms between 2005 and 2018

Source: annual reports; observation period = 2005-2018, sample = 16 firms

Evolution of management board member profiles

In a second step, we studied the individual profiles of management board members in the sample firms, which also showed interesting results (Table 4). The data revealed a very high level of top managers holding a higher tertiary education degree. The average was 88% in 2005, increasing 13 years later to over 96%. Consequently, in 2018, only three groups (Deutsche Lufthansa (20%), Bayer (18%) and Merck (13%)) had management board members without higher education degrees. A more detailed examination of educational background revealed the predominance of business administration or economics degrees. The average number of management board members with this type of degree in fact grew over time (from 43% to 51%), exceeding 75% in five companies in the last year (Adidas, Beiersdorf, Deutsche Post, Deutsche Telekom and Siemens), while the firm with the lowest share of top executives with such a profile reported a percentage of 17% in 2018 (Merck). Alongside these aspects, the proportion of management board members with a law degree decreased significantly during the period investigated, passing from 13% on average in 2005 to just 6% in 2018. In 2005, the highest proportion of law graduates among German top managers in our sample firms was 67% (Deutsche Lufthansa), whereas 13 years later, the level was a mere 22% (E.ON). In line with our research question, we also studied the proportion of top executives with a higher education degree (graduate or undergraduate) in IT-related disciplines. Surprisingly, the results show a high level of homogeneity among management boards regarding the absence of IT education backgrounds, with a very low average in 2005 (5%) that declined even further over time (3% in 2018). While this finding is already surprising, a closer look reveals that only two companies (Merck and Volkswagen) had IT graduates on their management board in 2018, while the remaining 14 firms had no board members with a computer science degree. Given the increasing relevance of IT risk-related management since the millennium, such low representation of IT backgrounds among top executives throws serious doubt on whether cybersecurity skills are sufficiently represented on the firms' highest decision-making instances. An in-depth analysis of the areas of responsibility of our sample firms' management board members confirms this. In 2018, only four of the 18 groups studied explicitly mention IT security as an area included in the scope of responsibilities of at least one member of their executive team. In three other companies, IT security was added to the CEO's responsibilities as an additional function. In the remaining 11 firms, however, IT security was not explicitly mentioned among the board members' responsibilities. The frequently observed absence of IT backgrounds may also be linked to another specific aspect of the German governance system: far more than a Bachelor's or Master's degree, a PhD is considered a highly prized criterion with regard to top management positions in Germany [START_REF] Hartmann | Eliten und Macht in Europa -Ein internationaler Vergleich[END_REF]Prinz, 2011). This is corroborated by the high proportion of executives holding a PhD in the companies in our sample. Even though we observed a significant decrease over time, with the average number falling from 49% in 2005 to 37% 13 years later, the percentage was still comparatively high, notably in comparison with other countries where doctorates are typically a precursor to an academic rather than a managerial career. Consequently, the number of firms in which no executive holds a PhD is very low (three out of 18 in 2015). A closer look at our data shows that management board members with a PhD generally gained their degree in business or economics. This share remained quite stable during the study period, averaging out at 12%. It is followed by managers with a PhD in law, even though their percentage decreased over time from 10% to 5% of all board members. Finally, our data show that top executives holding a PhD in IT are very rare. Only one company (FMC) in our sample had one member with a PhD in IT science among its top managers, and this was only since 2013. The scarcity of such executives may be explained by the fact that IT science is a comparatively new field of study that offered only very few programs when most of the top executives in our sample companies were studying. This argument, however, cannot be confirmed by the low and even slightly decreasing number of executives with IT degrees (between 3% and 5%) during the observation period.

Post CSI reactions in companies

In addition to the presentation of the characteristics of all the management boards and their members' profiles, we ran a comprehensive analysis of companies that had experienced a CSI during the observation period and, in its wake, modified governance aspects related to their management board (composition, restructuration of functional units or change in profiles/responsibilities) or explicitly addressed the topic of IT security in their annual report(s). In total, we were able to identify just four firms and five IT-related incidents that addressed the issue in some way. For the 12 remaining companies, representing 14 incidents, no reaction (disclosure or changes to their management board) could be observed. In the following cases we analyze the adjustments made in each of the four companies identified and present the post-CSI measures adopted.

Beiersdorf

Beiersdorf, an almost 140-year-old multinational manufacturer of personal-care products and pressure-sensitive adhesives, headquartered in Hamburg (Beiersdorf, 2021) was one of a large number of international companies that fell victim to NotPetya, a malicious malware exploiting a Windows operating system vulnerability called "Eternal Blue". This malware was deployed the same year in two other attacks, namely "WannaCry" and "Adylkuzz". NotPetya blocked several hundred thousand computers in order to blackmail firms. A bitcoin blockchain suggests that about 30 individual entities paid the $300 ransom demanded to decrypt the infected hard drives. Among the victims were large groups like the French construction and material firm Saint Gobain, the U.S. Drugmaker Merci & Co., and the food manufacturer Mars Inc. With regard to Beiersdorf, India-based employees of Nivea Skin care products reported a direct impact on their systems [START_REF] Stubbs | Cyber Attacks Cripple Companies Worldwide[END_REF]. As a consequence of the malware attack, Beiersdorf announced that €35 million of sales revenues would be shifted to the next quarter [START_REF] Kovacs | NotPetya Attack Costs Big Companies Millions[END_REF]. Although Beiersdorf's annual report for the fiscal year 2017 (pp. 5-6) mentioned that both its supervisory board and the audit committee had explicitly dealt with the cyber-attack in June 2017, no information could be found on the scope of the IT-incident or its impact. It further did not appear to result in any direct changes to the composition of the company's management board either. However, Beiersdorf's CFO, a male manager who graduated in business administration and whose expertise also included IT, left the group one year later in June 2018 as his contract was not renewed. He was replaced by a female manager, who was also a graduate in business administration, with responsibilities covering the areas of audit, compliance, law, quality assurance and IT remaining unchanged. While no explicit reason was put forward for the CFO's departure, the economic press suggested that the non-renewal of his contract was related to the experienced CSI (Finance Magazin, 2018/02/16).

BMW

Bayerische Motoren Werke is a German multinational manufacturer of automobiles and motorcycles founded in 1916, which currently employs around 135,000 people worldwide (BMW, 2021). In 2015, BMW cars were found to be vulnerable due to a remote hack flaw in their "ConnectedDrive" tool. The problem was discovered by Germany's leading automobile association, ADAC, which discovered the vulnerability during a white hat exercise. It enabled researchers to use reverse engineering to build a copy of BMW's servers that could send remote unlocking instructions to cars. A patch was consequently sent to 2.2 million cars potentially vulnerable to the attack [START_REF] Williams | BMW cars found vulnerable in Connected Drive hack[END_REF]. The connection of devices to the internet, often treated in the context of the "Internet of Things" (IoT), is a major issue in the automotive industry. Other automobile manufacturers experienced similar media coverage, e.g., Volkswagen was exposed to serious allegations in 2015 which claimed that hackers could easily unlock about 100 million vehicles (Greenberg, 2015).

One consequence observed with respect to the CSI was a slightly greater focus on the topic of cyber-attacks in the group's annual reports from 2016 onward, pointing in particular to the relevance of cybersecurity as well as the potential consequences of cyber-attacks. Otherwise, no direct impact on BMW's corporate governance system was found. The areas of responsibility of the group's management board members -which surprisingly comprised no term related to IT -remained unchanged in the three years following the incident. Similarly, none of the changes in the management board's composition that occurred after 2015 could be related directly to the CSI.

Deutsche Telekom

Deutsche Telekom is one of Europe's largest telecommunication companies that currently employs about 216,000 people worldwide (Deutsche Telekom, 2021). In 2008, the firm experienced a high-profile IT security scandal that led to extensive national and international media coverage (Spiegel 2008/22;Wirtschaftswoche 2008;Handelsblatt 2008;Manager Magazin 2008;New York Times 2008;Le Monde 2008). The scandal dated back to the early 2000s when several top executives and members of the group's supervisory board decided to launch an investigation into repeated leaks regarding plans for massive layoffs. The investigation was led by an internal corporate security unit called 'KS3' that (legally and illegally) analyzed communication data to identify the origins of the leak. As a result, at least 55 people were monitored for almost two years, including several members of the group's supervisory board, one of its largest subsidiaries (T-Mobile), one member of the groups' management board, several members of work councils, including their families, external labor union representatives and journalists (Spiegel, 2008/27; Wirtschaftswoche 2008/05/04). In addition, the firm experienced several outages from 2008 onwards, and one particularly successful hack which left 900,000 of its UK customers without access to numerous services (BBC, 2016), although these incidents obtained far less press coverage than the 2008 spy scandal.

As news coverage of the group's eavesdropping controversy only occurred in May 2008, no reason was given in the annual report for the departure of the CEO in November 2006 after more than five and a half years on the group's management board. The president of the company's supervisory board also resigned without any explicit reason in February 2008, three months before the scandal broke. It appears that the only internal measures taken by the new CEO were to fire the firm's security chief and several leading employees of the internal security unit in 2007, before the controversy became public knowledge in the second quarter of 2008. Surprisingly, even after the affair did become public, it was not explicitly mentioned in the group's subsequent annual reports. Likewise, no changes were noted regarding the composition of the management board or the scope of the members' responsibilities, and issues of compliance and risk management were only addressed in 2010 by the group's supervisory board and audit committee. That said, a new management position covering data security, legal affairs and compliance was created at the end of 2008 [START_REF] Georg | Information security governance: Pending legal responsibilities of non-executive boards[END_REF]. The position was attributed to a German manager with a PhD in law, who already was the group's general counsel since 1997. This change was designed to reassure stakeholders about the firm's compliance and sensibilization with respect to the issue. The position was dissolved 11 years later at the end of 2019, with the security governance function returning to the manager in charge of technology and innovation (Deutsche Telekom, 2020).

FMC

Fresenius Medical Care (FMC) is a German healthcare company employing in 2019 more than 120,000 people. FMC provides products and services for dialysis, hospitals, and inpatient and outpatient medical care kidney dialysis services via worldwide patient centers and production sites in the U.S., Germany and Japan. In 2018, the North American branch of FMC was fined for filing breach reports in 2013 concerning five separate CSIs linked to electronically protected health information that occurred in 2012. The company agreed to pay $3.5 million to the U.S. Department of Health and Human Services (HHS) and to adopt a comprehensive corrective action plan designed to address potential violations of the Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security Rules (HHS, 2018a). The incidents included failure to "implement policies and procedures to address security incidents", failure to "govern the receipt and removal of hardware and electronic media that contain ePHI into and out of a facility", failure to "safeguard their facilities and equipment from unauthorized access, tampering, and theft", and failure to "implement a mechanism to encrypt and decrypt ePHI, when it was reasonable and appropriate to do so under the circumstances'' (HHS, 2018b p.1). The fine showed that the U.S. regulator treated the protection of medical customer data seriously, in line with findings from Acquisiti et al. (2006) and Nicholas-Donald et al. (2012) regarding negative market reactions in cases of privacy breaches.

Even though FMC explicitly addressed IT security questions in the annual reports following the CSIs, no documentation about the incidents or changes to the composition of the company's management board or the scope of responsibilities of their members was observed. This is even more surprising as one top executive holds a PhD in computer science and may thus be assumed to have sound expertise in this area. That said, several operational measures were introduced at lower hierarchical levels. In the year prior to disclosure of the CSIs, FMC thus announced the creation of a new worldwide operating function in charge of data-and cybersecurity questions, which was incorporated into the group's law department and completed by a working team of internal risk, security and compliance IT specialists (FMC, 2017, p. 84). One year later, the company further reconfirmed its focus on privacy and data security and set up a global data protection program defining minimum personal data protection requirements. The program is monitored by the group's management board that provides updates on the program's status twice a year as well as relevant data protection concerns (FMC, 2018, p. 97). To guarantee adherence to these measures, a global head of data protection and cybersecurity law as well as a privacy team ensure further support.

Discussion

Our study presents four principal findings. First, we found that a comparatively low percentage (37.2%) of German blue-chip companies fell victim to at least one major and publicly documented CSI during the observation period (2005)(2006)(2007)(2008)(2009)(2010)(2011)(2012)(2013)(2014)(2015)(2016)(2017)(2018). Given that only about half of all IT incidents appear to be detected [START_REF] Kutscher | M-Trends 2017: A View From the Front Lines[END_REF] and in light of a survey by McAfee (2020) according to which 96% of a total of 1,500 organizations contacted said they experienced IT incidents in 2019, we believe that a much larger number of CSIs can be assumed to have occurred in the period in question, which did not reach the public sphere. In addition, only a quarter of the companies covered by the media displayed a noticeable post-incident governance reaction, either by documenting the respective CSI in the annual report, changing the management board's composition or altering the scope of their members' responsibilities (Table 5). Our findings support the assumption of a somewhat slow and reluctant governance reaction to IT-related incidents that do not seem to be considered as issues requiring major changes at top executive level. Consequently, annual reports, serving by definition as an interface to company stakeholders, appear to be only marginally used as a communicative medium with respect to CSIs in Germany.

Secondly, alongside the finding that CSIs do not seem to result in firms noticeably modifying the composition or the scope of their top management team's responsibilities, our qualitative analysis also shows that while some changes were made after IT-related incidents, these adjustments went against the general trend. The most powerful post-incident signal -the departure of a senior executive board member -was only observed in one case (Beiersdorf), where the CSI led to the non-renewal of the CFO's contract. A less powerful response was noted at Deutsche Telekom where, unlike most groups that keep the status quo regarding the number of business units on their management board after an IT-incident, the firm added a new unit following the eavesdropping controversy detected in 2008. It was in fact dissolved 11 years later as the group annually publishes updates on data security and privacy and has introduced some seemingly successful remediation measures, making the unit redundant. Furthermore, our findings on post-CSI effects in German firms did not confirm prior research on U.S. firms according to which CSIs result in higher senior executive turnover, except for Beiersdorf and Deutsche Telekom where, in the case of the latter, reactions occurred prior to disclosure of the incident [START_REF] Haislip | Repairing organizational legitimacy following information technology (IT) material weaknesses: Executive turnover, IT expertise, and IT system upgrade[END_REF][START_REF] Masli | Senior executives' IT management responsibilities: Serious IT-related deficiencies and CEO/CFO turnover[END_REF][START_REF] Benaroch | Operational IT failures, IT value destruction, and board-level IT governance changes[END_REF][START_REF] Li | CEO/CFO turnover and subsequent remediation of information technology material weaknesses[END_REF]. Thirdly, an IT-related educational background seems to be the exception rather than the norm among top executives in German firms that have experienced CSIs. Depending on the years, no more than three to five of the 16 companies have at least one top manager with an IT degree on their board, with the average percentage varying over time between 3% and 5%. These results are similar to those of [START_REF] Haislip | The effect of CEO IT expertise on the information environment: Evidence from earnings forecasts and announcements[END_REF] who found that only 3% of U.S. CEOs can be considered as IT experts (when measured by IT-related degrees or prior professional experience). In contrast to the low number of managers with IT backgrounds, our sample shows somewhat stable homogeneity relative to management board members with a degree in business or economics (between 43% and 56%). Although the number of top executives with law degrees appears to decline over time in our sample firms, two of the four identified companies with a governance reaction (Deutsche Telekom and FMC) indicated that cybersecurity issues are confined to units with a focus on legal matters or functional units led by professionals with a legal background. Firms therefore seemed to consider most of the damage from a CSI to be predominantly on the legal side. In other words, IT incidents appeared more liable to be treated as failures of compliance rather than technical security issues that put a firm's business model at risk. In the case of Deutsche Telekom, a new management board position was created following the CSI in 2008. Responsibility for security was then rapidly transferred from the manager in charge of IT (an executive with an engineering background) to that of the new board position headed by a lawyer with no specific IT expertise. Likewise, FMC extended the responsibilities of their compliance department that continued to be run by an executive without specific IT skills. Treating the CSIs as a compliance issue, it is interesting that both firms happened to be the only German blue chips breached that were simultaneously listed on the U.S. stock exchange at the time of the incidents. This suggests that the changes observed may have been the result of greater pressure from both regulatory bodies and investors in the United States. In light of the low number of German management board members with an educational background in IT science, our findings do not enable us to either confirm or reject previous studies suggesting that top executives' IT skills determine a firm's response to CSIs [START_REF] Haislip | Do the roles of the CEO and CFO differ when it comes to data security breaches[END_REF][START_REF] Vincent | Board and management-level factors affecting the maturity of IT risk management practices[END_REF].

A fourth result is that the German companies analyzed seemed to avoid discussing IT-related weaknesses and incidents in their annual reports. Only one firm (Beiersdorf) explicitly mentioned the CSI in their documentation (without presenting any concrete post-incident measures). We assume that the lack of clear communication on CSIs is due to two factors: fear of negative reactions after disclosing such incidents and a lack of adequate methodologies to quantify the damage. Both explanations support former research on stock market reactions following the disclosure of CSIs [START_REF] Campbell | The economic cost of publicly announced information security breaches: empirical evidence from the stock market[END_REF][START_REF] Johnson | Stock price reaction to data breaches[END_REF] and the difficulty of quantifying the impact of any post-incident actions taken due to a lack of data [START_REF] Kvochko | Why data breaches don't hurt stock prices[END_REF]. In addition, we observed that when companies do react to incidents, their responses seem to be driven by legal motives such as underlying lawsuits rather than concerns about reputation. Even though CSIs cost huge amounts in remediation actions, lead to a loss of both reputation and competitive advantage, and entail other legal consequences, German firms appear to fail to quantify and communicate the consequences of the CSIs adequately to their stakeholders. Our results confirm the recent findings of a survey conducted by McAfee (2020) according to which most organizations have no plans in place to prevent or respond to CSI incidents, and those that do mostly develop action plans without involving their executives or the board of directors.

To sum up, and with regard to our research question, our findings do not allow us to confirm any changes in the composition or scope of responsibilities on German management boards in response to CSIs. Accordingly, we indirectly confirm Upper Echelons Theory in that the relative stability of top executive teams after experienced IT incidents does not lead to substantial changes in strategic measures with respect to IT-related risk management. In addition, our qualitative analysis shows that the few companies that did undertake visible measures tend to treat CSIs at top executive level as a legal rather than an operational issue, as reflected by the structure of business units and related responsibilities.

Conclusion

Given the growing rise in IT-related incidents that particularly concern multinational groups, we have addressed the research question of how far CSIs impact management board composition as well as the profiles and responsibilities of their members. Based on Upper Echelons Theory, our study offers for the first time for Germany an in-depth analysis of top management teams in the country's blue-chip companies regarding their reactions on CSIs and, therefore, contributes to the application of UET in the area of security governance. The following four main findings are eminent Firstly, our results confirm the increasing trend in the frequency of CSIs, the percentage of German firms that publicly disclose IT-related incidents yet being comparatively low. Secondly, and contrary to previous research in the U.S. [START_REF] Higgs | The relationship between board-level technology committees and reported security breaches[END_REF][START_REF] Haislip | Do the roles of the CEO and CFO differ when it comes to data security breaches[END_REF][START_REF] Vincent | Board and management-level factors affecting the maturity of IT risk management practices[END_REF], CSIs do not seem to engender major changes at executive level in German companies, thereby suggesting regulations to be the central driver for adjustments to management boards following such incidents. Thirdly, top managers of German firms that experienced CSIs almost never have an IT background, but frequently hold higher education degrees in business administration and law. Accordingly, IT-related incidents seem to be handled by German managers more under a juridical angle and appear to be considered as failures of compliance rather than technical security issues. Finally, German companies seem to avoid both disclosing and discussing CSIs in their annual reports which seems to be due to fears of negative reactions as well as difficulties to quantify the damage of such incidents.

Considering our findings, two practical contributions may be noted. The first relates to the fact that despite the public's growing interest in the topic of CSIs, external communication and documentation of German companies on IT-related incidents seems to be relatively limited, possibly due to the absence of any national or European equivalent to S-OX 404 or SEC compliance requirements.2 Accordingly, the analysis of corporate documentation alone does not give investors a clear picture of CSI risks and their potential outcomes, and therefore is insufficient as a tool to strengthen managerial monitoring. As a consequence, policy designs regarding official documentation requirements should be adapted to further promote and value transparency, since both the disclosing company and its stakeholders benefit from improved corporate communication.

The second implication emanates from the observation that German firms tend to handle IT security predominantly as a legal matter in the aftermath of CSIs. In addition, top executives appear to delegate -maybe due to fear of legal consequences or other personal risk dispositions -accountability to lower operational levels instead of accepting it as a management board concern. By doing so, firms not only downplay the strategic relevance of such incidents but also limit themselves to manage the (juridical and technical) consequences rather than focussing on prevention through strategic planning and a proactive risk management policy. Given the growing damage potential of CSIs, however, it is in the companies' interest to use all their governance instruments to avoid such issues from happening while assuring an effective reaction in case they do. Consequently, IT-related risk management must be located at and proactively directed by the management board which puts the focus on aspects such as the representation of the topic of cybersecurity in the different areas of responsibility as well as the profile of top executives with respect to IT expertise. Given these considerations, our study provides some evidence that German blue-chip companies need to anchor both pre-and post-management of ITrelated incidents more firmly at their management board level.

Limitations and Further Research

A first limitation of our study concerns the availability of data on the CSIs experienced during our observation period. In spite of the general understanding that the Internet, by definition, never forgets, public search engines tend to select more recent information with high click rates. Older news from websites with lower visiting rates (that automatically suffer further from the steadily growing number of internet users) therefore tend not to show up. Moreover, modern corporate communication policies are usually based on search engine optimization designed to bring favorable news to the fore rather than reputation-damaging information. As a consequence, even high impact IT incidents may not be published or will only have low visibility, complicating exhaustive identification of CSIs, or even making it infeasible and contingent on chance. We assume that this issue is also a factor in the relatively low number of IT-related problems we identified for German blue-chip companies. The fact that 15 of the 19 IT incidents (78.9%) occurred in 2015 or later supports this point. Further adding to the problem of information asymmetry, and in contrast to the regulatory requirements in the U.S., European firms are not obliged to disclose CSIs at present. Consequently, pressure on European executives to take appropriate measures with respect to IT-related incidents and thus protect investors remains rather limited. That said, we believe that the lack of strict disclosure requirements significantly hampered the detection of IT material weaknesses in our sample firms. Our analysis only focused on externally visible measures taken after the disclosure of a CSI, but we are well aware that internal responses to incidents are possible without any form of public communication, particularly when the actions are limited to levels not covered by disclosure requirements. Such reactions may be similar to the one identified in our analysis of FMC (2017, p. 84), where the incident led to the creation of a new operating unit within an existing department, completed by a team of internal IT specialists.

Alongside this limited availability of data on CSIs, unobserved variables may explain the absence of noticeable changes on German management boards in response to CSIs. Several scholars have thus demonstrated that factors such as experience in IT firms [START_REF] Masli | Senior executives' IT management responsibilities: Serious IT-related deficiencies and CEO/CFO turnover[END_REF][START_REF] Haislip | The effect of CEO IT expertise on the information environment: Evidence from earnings forecasts and announcements[END_REF], board members' individual style [START_REF] Qu | Board members with style: The effect of audit committee members and their personal styles on financial reporting choices[END_REF], CEOs' reputation [START_REF] Francis | CEO reputation and earnings quality[END_REF], ''superstar CEOs'' [START_REF] Koh | Value or glamour? An empirical investigation of the effect of celebrity CEOs on financial reporting practices and firm performance[END_REF], overconfidence [START_REF] Schrand | Executive overconfidence and the slippery slope to financial misreporting[END_REF] and even a manager's facial structure [START_REF] Jia | Masculinity, testosterone, and financial misreporting[END_REF] or their off-the-job behavior [START_REF] Davidson | Executives' ''off-the-job'' behavior, corporate culture, and financial reporting risk[END_REF] can also determine organizational outcomes. Given that our analysis only takes the directly observable characteristics of executives such as age, gender, tenure and educational background into account, these aspects may not be sufficient proxies to evaluate CSI risks in German groups, or how such incidents are likely to be handled. Consequently, extending the set of variables to cognitive aspects might be helpful in future surveys since cognitive bias, especially with regard to IT security, can play a decisive role in decision-making.

Beside insufficient communication about CSIs, corporate disclosure about the characteristics of German top managers, particularly with respect to their profile and skills, still appears to be limited or even non-existent. This issue was addressed several years ago by [START_REF] Prinz | 10 Anmerkungen zur laufenden Debatte um Aufsichtsräte[END_REF] who noted that German blue-chip companies do not usually justify the appointment of new executives from a competency perspective, restricting communication on their skills and professional expertise, partially due to reasons of confidentiality. Even though we cross-checked data from corporate annual reports with publicly available information, it is highly likely that the profiles of the executives from our sample companies are incomplete. Stronger disclosure requirements with respect to management board member profiles, and particularly their professional skills, would be a substantial help in advancing research on the link between a management board's IT expertise and CSIs.

Since the European Securities and Monitoring Authority (2019) published its new guidelines on (cyber) risk reporting, there is good reason to believe that the latter will compel companies to disclose IT-related incidents more frequently, as well as present any subsequent governance measures to their stakeholders. That said, a first analysis of the 2019 annual reports of CAC 40 companies listed in France shows that firms almost exclusively use qualitative metrics and focus their explanations of governance measures at the level of the Chief Information Security Officer [START_REF] Georg-Schaffner | Cyber risk disclosure: How transparent are CAC40 companies in their annual reports?[END_REF], while failing to demonstrate substantial changes in governance tools and decision-making teams. As regulatory and fiscal/accounting authorities such as ESMA also work to protect the value of intangibles, information in the form of valuable data is central to this challenge, and the literature has already indicated several measures that can help such data to be quantified [START_REF] Laney | Infonomics: How to monetize, manage, and measure information as an asset for competitive advantage[END_REF]. Consequently, once the asset value of information can be determined, both loss and damage to these assets will be more visible, making cybersecurity (incidents) a quantifiable metric for organizational performance and hence corporate governance. Further research can help to develop this aspect and contribute to clearer insights into the impact of corporate governance strategies on CSIs, thereby improving the way they are handled in the digital age.

Table 4 .

 4 Evolution of management board member profiles from sample firms between 2005 and 2018 Source: annual reports; observation period = 2005-2018, sample = 16 firms, HE = higher education, IT = information technology

Table 1 .

 1 Table 1 details the measurement and operationalization of our governance data. Measurement and operationalization of governance data

Table 2 .

 2 CSIs in Dax 30 companies occurring between 2005 and 2018

Source: our own data; observation period = 2005-2018

Table 5 .

 5 Summary of IT incidents identified which led to a governance reaction

	Source: our own analysis

In

2019, the European Securities and Monetary Authority (ESMA) published new guidelines on risk reporting that obligate publicly listed European companies to report material risks, including cyber risk. That said, these requirements remain less comprehensive than those requested in the Security and Exchange Commission's Statement and Guidance on Public Company Cybersecurity Disclosures (2011 and 2018).

While ESMA guidelines require European listed firms to disclose a specific risk report including cyber risks since 2019, when such quantifications cannot be provided, these guidelines allow companies to limit their assessment to a qualitative description of the risk.

Availability of data and material: Public Code availability: Not applicable

Declarations:

Funding: Not applicable Conflicts of interest/ competing interests: Not applicable