EU-maiden pankkien kyberturvallisuusraportointi

This study focuses on cybersecurity disclosure of publicly listed banks in EU countries as part of their annual reporting. Due to the transparency of their op-erations, listed entities are expected to communicate with their stakeholders about risks related to their activities and the associated risk...

Full description

Bibliographic Details
Main Author: Korkiakoski, Juho
Other Authors: Informaatioteknologian tiedekunta, Faculty of Information Technology, Jyväskylän yliopisto, University of Jyväskylä
Format: Master's thesis
Language:fin
Published: 2025
Subjects:
Online Access: https://jyx.jyu.fi/handle/123456789/100565
_version_ 1826225731032580096
author Korkiakoski, Juho
author2 Informaatioteknologian tiedekunta Faculty of Information Technology Jyväskylän yliopisto University of Jyväskylä
author_facet Korkiakoski, Juho Informaatioteknologian tiedekunta Faculty of Information Technology Jyväskylän yliopisto University of Jyväskylä Korkiakoski, Juho Informaatioteknologian tiedekunta Faculty of Information Technology Jyväskylän yliopisto University of Jyväskylä
author_sort Korkiakoski, Juho
datasource_str_mv jyx
description This study focuses on cybersecurity disclosure of publicly listed banks in EU countries as part of their annual reporting. Due to the transparency of their op-erations, listed entities are expected to communicate with their stakeholders about risks related to their activities and the associated risk management as part of their annual reports and annexes. Accordingly, companies also report on cybersecurity within these frameworks as part of their annual reports, but they must exercise discretion regarding the scope and depth of reporting due to the sensitive nature of the information. Cybersecurity disclosure is examined in the context of EU countries and banks because the financial sector, particularly banks, plays a significant role in the economy, societal stability, and security. At the same time, European pub-licly listed banks face considerable new regulations and attention related to cybersecurity. Cybersecurity risks have also emerged as the top concern for banks in Europe. The purpose of this study was to address the question, "How do EU banks report on their cybersecurity in their annual reports?" The study was conducted using qualitative methods, analyzing the 2023 annual reports of the largest European banks through theory-driven content analysis. The results of the study revealed significant differences in the extent of cybersecurity disclo-sure among the largest listed banks in EU countries. However, a common fea-ture of the banks that provided the most comprehensive reporting was their avoidance of personal disclosures, while still reflecting annual-specific consid-erations in their reporting. Banks primarily addressed cybersecurity risks, ac-tions aimed at mitigating those risks, and administrative measures. On the oth-er hand, they refrained from disclosing the consequences of specific cybersecu-rity incidents they had experienced. Tämä tutkimus keskittyy EU-maiden listattujen pankkien kyberturvallisuusraportointiin osana vuosittaista raportointia. Listattujen toimijoiden odotetaan raportoivan jo toimintansa läpinäkyvyyden vuoksi viestivän sidosryhmilleen muun muassa toimintaansa koskevista riskeistä sekä niitä koskevista riskienhallinnasta osana vuosikertomuksia ja sen liitteitä. Yritykset raportoivatkin myös kyberturvallisuudesta edeltä mainituin osin osana vuosikertomuksia, mutta toimijat joutuvat samalla käyttämään harkintaa raportoinnin laajuuden ja syvyyden suhteen tiedon luonteesta johtuen. Kyberturvallisuusraportointia tutkitaan EU-maiden ja pankkien kontekstissa, koska finanssialan ja etenkin pankkien merkitys taloudelle, yhteiskunnan vakaudelle ja siten myös turvallisuudelle on suuri. Samaan aikaan eurooppalaisiin listattuihin pankkeihin kohdistuu merkittävissä määrin myös kyberturvallisuutta koskevaa uutta sääntelyä ja huomiota. Kyberturvallisuutta koskevat riskit ovat nousseet myös pankkien suurimmaksi huolenaiheeksi Euroopassa. Tutkimuksen tarkoituksena oli selvittää ”Miten EU-pankit raportoivat kyberturvallisuudestaan vuosikertomuksissaan?”. Tutkimus toteutettiin laadullisin menetelmin suurimpien eurooppalaisten pankkien vuotta 2023 käsitteleviä vuosikertomuksia teorialähtöisen sisällönanalyysin menetelmin tutkimalla. Tutkimuksen tuloksena havaittiin, että EU-maiden suurimpien listattujen pankkien välillä on merkittäviä eroja kyberturvallisuusraportoinnin laajuudessa, mutta yhteistä aiheesta laajimmin raportoiville on, että ne pidättäytyvät omakohtaisesta raportoinnista huomioiden kuitenkin raportoinnissa vuosikohtaisuuden. Pankit käsittelivät eniten kyberturvallisuusriskejä ja niiden pienentämiseen tähtääviä tekoja sekä hallinnollisia toimia. Toisaalta yritykset pidättäytyivät avaamasta heihin jo kohdistuneiden kyberturvallisuushäiriöiden seurauksia.
first_indexed 2025-03-05T21:04:50Z
format Pro gradu
free_online_boolean 1
fullrecord [{"key": "dc.contributor.advisor", "value": "J\u00e4rvel\u00e4inen, Jonna", "language": null, "element": "contributor", "qualifier": "advisor", "schema": "dc"}, {"key": "dc.contributor.author", "value": "Korkiakoski, Juho", "language": null, "element": "contributor", "qualifier": "author", "schema": "dc"}, {"key": "dc.date.accessioned", "value": "2025-03-05T09:36:52Z", "language": null, "element": "date", "qualifier": "accessioned", "schema": "dc"}, {"key": "dc.date.available", "value": "2025-03-05T09:36:52Z", "language": null, "element": "date", "qualifier": "available", "schema": "dc"}, {"key": "dc.date.issued", "value": "2025", "language": null, "element": "date", "qualifier": "issued", "schema": "dc"}, {"key": "dc.identifier.uri", "value": "https://jyx.jyu.fi/handle/123456789/100565", "language": null, "element": "identifier", "qualifier": "uri", "schema": "dc"}, {"key": "dc.description.abstract", "value": "This study focuses on cybersecurity disclosure of publicly listed banks in EU countries as part of their annual reporting. Due to the transparency of their op-erations, listed entities are expected to communicate with their stakeholders about risks related to their activities and the associated risk management as part of their annual reports and annexes. Accordingly, companies also report on cybersecurity within these frameworks as part of their annual reports, but they must exercise discretion regarding the scope and depth of reporting due to the sensitive nature of the information.\nCybersecurity disclosure is examined in the context of EU countries and banks because the financial sector, particularly banks, plays a significant role in the economy, societal stability, and security. At the same time, European pub-licly listed banks face considerable new regulations and attention related to cybersecurity. Cybersecurity risks have also emerged as the top concern for banks in Europe.\nThe purpose of this study was to address the question, \"How do EU banks report on their cybersecurity in their annual reports?\" The study was conducted using qualitative methods, analyzing the 2023 annual reports of the largest European banks through theory-driven content analysis. The results of the study revealed significant differences in the extent of cybersecurity disclo-sure among the largest listed banks in EU countries. However, a common fea-ture of the banks that provided the most comprehensive reporting was their avoidance of personal disclosures, while still reflecting annual-specific consid-erations in their reporting. Banks primarily addressed cybersecurity risks, ac-tions aimed at mitigating those risks, and administrative measures. On the oth-er hand, they refrained from disclosing the consequences of specific cybersecu-rity incidents they had experienced.", "language": "en", "element": "description", "qualifier": "abstract", "schema": "dc"}, {"key": "dc.description.abstract", "value": "T\u00e4m\u00e4 tutkimus keskittyy EU-maiden listattujen pankkien kyberturvallisuusraportointiin osana vuosittaista raportointia. Listattujen toimijoiden odotetaan raportoivan jo toimintansa l\u00e4pin\u00e4kyvyyden vuoksi viestiv\u00e4n sidosryhmilleen muun muassa toimintaansa koskevista riskeist\u00e4 sek\u00e4 niit\u00e4 koskevista riskienhallinnasta osana vuosikertomuksia ja sen liitteit\u00e4. Yritykset raportoivatkin my\u00f6s kyberturvallisuudesta edelt\u00e4 mainituin osin osana vuosikertomuksia, mutta toimijat joutuvat samalla k\u00e4ytt\u00e4m\u00e4\u00e4n harkintaa raportoinnin laajuuden ja syvyyden suhteen tiedon luonteesta johtuen.\nKyberturvallisuusraportointia tutkitaan EU-maiden ja pankkien kontekstissa, koska finanssialan ja etenkin pankkien merkitys taloudelle, yhteiskunnan vakaudelle ja siten my\u00f6s turvallisuudelle on suuri. Samaan aikaan eurooppalaisiin listattuihin pankkeihin kohdistuu merkitt\u00e4viss\u00e4 m\u00e4\u00e4rin my\u00f6s kyberturvallisuutta koskevaa uutta s\u00e4\u00e4ntely\u00e4 ja huomiota. Kyberturvallisuutta koskevat riskit ovat nousseet my\u00f6s pankkien suurimmaksi huolenaiheeksi Euroopassa.\nTutkimuksen tarkoituksena oli selvitt\u00e4\u00e4 \u201dMiten EU-pankit raportoivat kyberturvallisuudestaan vuosikertomuksissaan?\u201d. Tutkimus toteutettiin laadullisin menetelmin suurimpien eurooppalaisten pankkien vuotta 2023 k\u00e4sittelevi\u00e4 vuosikertomuksia teorial\u00e4ht\u00f6isen sis\u00e4ll\u00f6nanalyysin menetelmin tutkimalla. Tutkimuksen tuloksena havaittiin, ett\u00e4 EU-maiden suurimpien listattujen pankkien v\u00e4lill\u00e4 on merkitt\u00e4vi\u00e4 eroja kyberturvallisuusraportoinnin laajuudessa, mutta yhteist\u00e4 aiheesta laajimmin raportoiville on, ett\u00e4 ne pid\u00e4tt\u00e4ytyv\u00e4t omakohtaisesta raportoinnista huomioiden kuitenkin raportoinnissa vuosikohtaisuuden. Pankit k\u00e4sitteliv\u00e4t eniten kyberturvallisuusriskej\u00e4 ja niiden pienent\u00e4miseen t\u00e4ht\u00e4\u00e4vi\u00e4 tekoja sek\u00e4 hallinnollisia toimia. Toisaalta yritykset pid\u00e4tt\u00e4ytyiv\u00e4t avaamasta heihin jo kohdistuneiden kyberturvallisuush\u00e4iri\u00f6iden seurauksia.", "language": "fi", "element": "description", "qualifier": "abstract", "schema": "dc"}, {"key": "dc.description.provenance", "value": "Submitted by jyx lomake-julkaisija (jyx-julkaisija.group@korppi.jyu.fi) on 2025-03-05T09:36:52Z\nNo. of bitstreams: 0", "language": "en", "element": "description", "qualifier": "provenance", "schema": "dc"}, {"key": "dc.description.provenance", "value": "Made available in DSpace on 2025-03-05T09:36:52Z (GMT). No. of bitstreams: 0", "language": "en", "element": "description", "qualifier": "provenance", "schema": "dc"}, {"key": "dc.format.extent", "value": "84", "language": null, "element": "format", "qualifier": "extent", "schema": "dc"}, {"key": "dc.format.mimetype", "value": "application/pdf", "language": null, "element": "format", "qualifier": "mimetype", "schema": "dc"}, {"key": "dc.language.iso", "value": "fin", "language": null, "element": "language", "qualifier": "iso", "schema": "dc"}, {"key": "dc.rights", "value": "CC BY 4.0", "language": null, "element": "rights", "qualifier": null, "schema": "dc"}, {"key": "dc.title", "value": "EU-maiden pankkien kyberturvallisuusraportointi", "language": null, "element": "title", "qualifier": null, "schema": "dc"}, {"key": "dc.type", "value": "master thesis", "language": null, "element": "type", "qualifier": null, "schema": "dc"}, {"key": "dc.identifier.urn", "value": "URN:NBN:fi:jyu-202503052364", "language": null, "element": "identifier", "qualifier": "urn", "schema": "dc"}, {"key": "dc.contributor.faculty", "value": "Informaatioteknologian tiedekunta", "language": "fi", "element": "contributor", "qualifier": "faculty", "schema": "dc"}, {"key": "dc.contributor.faculty", "value": "Faculty of Information Technology", "language": "en", "element": "contributor", "qualifier": "faculty", "schema": "dc"}, {"key": "dc.contributor.organization", "value": "Jyv\u00e4skyl\u00e4n yliopisto", "language": "fi", "element": "contributor", "qualifier": "organization", "schema": "dc"}, {"key": "dc.contributor.organization", "value": "University of Jyv\u00e4skyl\u00e4", "language": "en", "element": "contributor", "qualifier": "organization", "schema": "dc"}, {"key": "dc.subject.discipline", "value": "Kyberturvallisuuden maisteriohjelma", "language": "fi", "element": "subject", "qualifier": "discipline", "schema": "dc"}, {"key": "dc.subject.discipline", "value": "Master's Degree Programme in Cyber Security", "language": "en", "element": "subject", "qualifier": "discipline", "schema": "dc"}, {"key": "dc.type.coar", "value": "http://purl.org/coar/resource_type/c_bdcc", "language": null, "element": "type", "qualifier": "coar", "schema": "dc"}, {"key": "dc.rights.copyright", "value": "\u00a9 The Author(s)", "language": null, "element": "rights", "qualifier": "copyright", "schema": "dc"}, {"key": "dc.rights.accesslevel", "value": "openAccess", "language": null, "element": "rights", "qualifier": "accesslevel", "schema": "dc"}, {"key": "dc.type.publication", "value": "masterThesis", "language": null, "element": "type", "qualifier": "publication", "schema": "dc"}, {"key": "dc.format.content", "value": "fulltext", "language": null, "element": "format", "qualifier": "content", "schema": "dc"}, {"key": "dc.rights.url", "value": "https://creativecommons.org/licenses/by/4.0/", "language": null, "element": "rights", "qualifier": "url", "schema": "dc"}]
id jyx.123456789_100565
language fin
last_indexed 2025-03-05T21:04:50Z
main_date 2025-01-01T00:00:00Z
main_date_str 2025
online_boolean 1
online_urls_str_mv {"url":"https:\/\/jyx.jyu.fi\/bitstreams\/a8b48367-40d9-4660-983b-301822fcdc27\/download","text":"URN:NBN:fi:jyu-202503052364.pdf","source":"jyx","mediaType":"application\/pdf"}
publishDate 2025
record_format qdc
source_str_mv jyx
spellingShingle Korkiakoski, Juho EU-maiden pankkien kyberturvallisuusraportointi Kyberturvallisuuden maisteriohjelma Master's Degree Programme in Cyber Security
title EU-maiden pankkien kyberturvallisuusraportointi
title_full EU-maiden pankkien kyberturvallisuusraportointi
title_fullStr EU-maiden pankkien kyberturvallisuusraportointi EU-maiden pankkien kyberturvallisuusraportointi
title_full_unstemmed EU-maiden pankkien kyberturvallisuusraportointi EU-maiden pankkien kyberturvallisuusraportointi
title_short EU-maiden pankkien kyberturvallisuusraportointi
title_sort eu maiden pankkien kyberturvallisuusraportointi
title_txtP EU-maiden pankkien kyberturvallisuusraportointi
topic Kyberturvallisuuden maisteriohjelma Master's Degree Programme in Cyber Security
topic_facet Kyberturvallisuuden maisteriohjelma Master's Degree Programme in Cyber Security
url https://jyx.jyu.fi/handle/123456789/100565 http://www.urn.fi/URN:NBN:fi:jyu-202503052364
work_keys_str_mv AT korkiakoskijuho eumaidenpankkienkyberturvallisuusraportointi