Cybersecurity Management Competencies in Critical Infrastructure Organizations. A Review and Research Agenda

Abstract

Critical infrastructure is vital to the economic, social, and technological survival and welfare of nations. Attacks on these infrastructures can be devastating and can lead to serious consequences. The Top Management Team (TMT) is the highest decision-makers who seal the fate of such organizations when it comes to risk management. Regulations and best practices are demanding that the TMT take responsibility for the cybersecurity posture of the critical infrastructure organizations to protect that infrastructure or prevent further damage. Critical infrastructure organizations often have a combination of information technology and operational technology spread across a wider geographical area and extensive regulation that can affect security investments and the TMT composition. Consequently, to effectively carry out their responsibilities, the TMT requires cybersecurity competencies; therefore, the specific cybersecurity management competencies that constitute these requirements need to be identified and tailored to their roles. To identify research in this area, we surveyed prominent journals that publish on cybersecurity, management, and critical infrastructure. We used search terms that address cybersecurity skills, knowledge, and attitudes necessary for top management in strategic decision-making and cybersecurity risk management. To ensure the collection of relevant articles, the literature review follows a systematic review process. A qualitative analysis method was employed to identify five thematic areas, namely leadership, learning, organization, cybersecurity, and competency, through which management’s cybersecurity competencies are positioned as strategic requirements that can impact organizational cybersecurity resilience. The strategic responsibilities of the Top Management Team (TMT) are interestingly extending to cybersecurity management in organizations. They are also required to align cybersecurity management with the organization’s strategic objectives. Thus, to effectively carry out their responsibilities, the TMT requires cybersecurity competencies. This review has identified relevant cybersecurity skills, knowledge, and attitudes that can be constituted as cybersecurity management competencies that will support TMT in the critical infrastructure protection. The review also reveals research gaps due to the limited number of studies conducted considering the entire TMT cybersecurity management competencies. This review provides a foundation for developing a theoretical framework for studying TMT cybersecurity competencies in critical infrastructure organizations.