Anderson, R., Barton, C., Böhme , R., Clayton, R., Van Eeten , M. J., Levi, M., Moore, T., & Savage, S. (2013). Measuring the cost of cybercrime. WEIS, 2012, 265-200 Björck , F. (2004). Institutional Theory: A New Perspective for Research into IS/IT Security in Organisations . Proceedings of the 37th Annual Hawaii International Conference on System Sciences, Big Island, HI, 5-8 January 2004, 1-5. https://doi.org/10.1109/HICSS.2004.1265444 Bunker, G. (2012). Technology is not enough: Taking a holistic view for information assurance. Elsevier Information Security Technical Report 17, 19-25, retrieved from www.compeseconline.com/publications/prodinf.htm doi : http://dx.doi.org/10.1016/j.istr.2011.12.002. Davenport, T.H., & Prusak , L. (2000). Working knowledge: how organizations manage what they know.Boston MA: Harvard Business School Press. E. Borgonovo , A. Cillo and C.L. Smith, Risk Analysis (2018) Gordon, L. A., Loeb, M. P., and Sohail , T. (2010). "Market value of voluntary disclosures concerning information security", MIS quarterly, 567-594. Hovav , A., & D’Arcy, J. (2012). Applying an Extended Model of Deterrence Across Cultures: An Investigation of Information Systems Misuse in the US and South Korea. Information & Management, 49, 99-110. https://doi.org/10.1016/j.im.2011.12.005 Hughes, J., & Cybenko , G. (2013). Quantitative metrics and risk assessment: The three tenets model ofcybersecurity . Technology Innovation Management Review, 3(8). Jirasek , V. (2012). Practical application of information security models. Elsevier Information Security Technical Report 17, 1-8. doi:http ://dx.doi.org/10.1016/j.istr.2011.12.004. James Shires, “Cybersecurity governance in the GCC,” In Rewired: Cybersecurity Governance, (2019): 2. Menz , M., Kunisch , S., Birkinshaw , J., Collis, D.J., Foss, N.J., Hoskisson , R.E. and Prescott, J.E. (2021), Corporate Strategy and the Theory of the Firm in the Digital Age. J. Manage. Stud., 58: 1695-1720. https://doi.org/10.1111/joms.12760 References