A Quantitative Study Assessing the Impact of Financial Sector Safeguards Rules on US Publicly Traded Companies' Cybersecurity Breach Frequency and Severity

Cybersecurity failure in the private sector is a growing federal policy priority. Nevertheless, US policy makers struggle with policy instrumentation in this domain. Behavioral public policy theory asserts that a linkage exists between policy target behavioral & cultural attributes and effective policy tool instrumentation. The federal government is now embracing a regulation heavy approach, but little empirical study exists at the nexus of behavioral public policy theory and use of regulatory tools in the cybersecurity policy domain. Since the early 2000s, the financial sector has employed a regulation heavy approach using the Safeguards regulations to facilitate cybersecurity in financial private sector companies. The US financial sector enjoys the behavioral attributes that should make regulation an effective instrument for achieving cybersecurity policy ends. This dissertation leverages secondary cross – sectional data from 2005 – 2020 and difference in difference analysis in demonstrating that the Safeguards regulations have resulted in a statistically significant difference in the severity of a successful breaches and the likelihood of a successful breaches in financial sector companies relative to companies not in the financial sector and not subject to cybersecurity regulations. These findings extend the viability of behavioral public policy theory in a previously unexplored policy domain and, with some caveats, support the feasibility of regulation as tool to facilitate cybersecurity in the private sector.