Moral Licensing Revisited: CSR and Cybersecurity-Related Disclosure After COP21

Using a sample of U.S. S&P 100 firms, we examine the relationship between firms’ CSR and cybersecurity-related disclosure, leveraging COP21 as an institutional shock in a difference-in-differences design. We find that, prior to COP21, firms’ aggregated environmental and social (E&S) profiles, and environmental (E) profiles are negatively, but insignificantly, associated with cybersecurity-related disclosure, whereas social (S) profiles exhibit a significantly negative association. Drawing on moral licensing theory, we argue that firm leaders who perceive their firms as having accumulated sufficient moral capital through strong CSR engagement may feel less compelled to respond proactively to emerging stakeholder expectations in non-traditional responsibility domains such as cybersecurity. Following COP21, however, firms with stronger aggregated E&S (as well as E and S) profiles increase their cybersecurity-related disclosure. We interpret COP21 as an institutional inflection point that intensified scrutiny and strengthened evaluative standards surrounding corporate responsibility, thereby diminishing the protective value of previously accrued moral credentials. Under heightened accountability, firm leaders appear more inclined to reaffirm a responsible organisational identity through greater transparency and responsiveness to stakeholder information demands. Overall, our evidence suggests that greater cybersecurity-related disclosure may help firms reinforce their social legitimacy and signal their commitment to cybersecurity.