Open Access

Ralf-Christian Härting, Jörg BüechlORCiD, Philipp Anderlohr, Lukas Betz

• The growing digitalization of our times creates substantial threats to organizational performance through cyber risk. This research examines the relationship between integrated cyber risk management (CRM) and cybersecurity performance. The research combines a systematic literature review (SLR) with data from nine semi-structured interviews with cybersecurity experts working in different industries to achieve its goals. The SLR established a solid theoretical foundation which led to hypothesis development before qualitative content analysis using Mayring’s deductive method analyzed the interview data. The analysis revealed five essential components for successful CRM implementation which include Awareness, Resources, Technology, Organization and Processing. The research demonstrates that organizations should adopt a flexible and adaptive method. The research results further led to a refined conceptual model which incorporates additional influencing elements such as proactive corporate strategy, management understanding, commitment, robust risk culture and comprehensive risk planning. The research demonstrates that organizations must adopt a complete integrated cyber risk management system to maximize cybersecurity performance and offers actionable recommendations for organizations that want to enhance their cyber resilience. Future research needs to validate the proposed model quantitatively while investigating how CRM determinants affect cybersecurity performance metrics in detail.