Embedding Cybersecurity Governance into Corporate Planning: A Framework for Mid-Market Philippine Logistics Firms
DOI:
https://doi.org/10.67903/ijroms0482Keywords:
Governance Integration, Policy Formulation, Resource Allocation, Risk Management, Third-Party RiskAbstract
Cybersecurity governance is increasingly framed as a planning-stage function embedded in resource-allocation and approval processes rather than as a downstream technical control. This shift has progressed furthest in banking, while mid-market third-party logistics (3PL) providers remain largely outside the discussion despite handling sensitive client data and maintaining deep application programming interface (API) integrations with enterprise clients. Prior studies typically offer either standardized extent-of-practice measurement or contextual explanation, rarely both, leaving unclear how extensively cybersecurity governance is integrated into corporate planning and why integration varies across similar firms. This study addressed this gap through a convergent mixed-method multi-case design involving five purposively selected, anonymized Philippine logistics firms. A structured 20-item survey, adapted from the Govern function of the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) 2.0 and the Control Objectives for Information and Related Technologies (COBIT) 2019, measured integration across four dimensions (Governance Structure, Risk Management Integration, Policy Formalization, and Resource Allocation) among 35 personnel, while key informant interviews and document reviews provided contextual explanations. The survey demonstrated good internal consistency (α = .83). Firms with both client-facing integrations and formal senior-level governance oversight (Firms C and D) were classified as “substantially integrated” (3.85 and 3.63), while firms lacking both (Firms A and E) were classified as “minimally integrated” (2.20 and 2.35). Resource Allocation received the highest scores and Policy Formalization the lowest, suggesting that digital investment has outpaced formal governance practices. Interviews indicated that higher-scoring firms converted triggering events into established planning practices through senior-level governance oversight, whereas lower-scoring firms treated cybersecurity primarily as a responsibility of information technology contractors. The study proposes a four-layer framework (Governance, Planning-Gate, Risk-Integration, and Resource-Alignment) and recommends that industry associations develop a voluntary, sector-specific governance benchmark.
Downloads
References
Bangko Sentral ng Pilipinas. (2013). Guidelines on information technology risk management for all banks and other BSP supervised institutions (Circular No. 808, s. 2013). https://www.scribd.com/document/467307020/BSP-Circular-808-s-2013-searchable
Bangko Sentral ng Pilipinas. (2017). Enhanced guidelines on information security management (Circular No. 982, s. 2017). https://lpr.adb.org/sites/default/files/2024-05/philippines-c982.pdf
Birkland, T. A. (1998). Focusing events, mobilization, and agenda setting. Journal of Public Policy, 18(1), 53– 74. https://doi.org/10.1017/S0143814X98000038
Blancaflor, E., Pasco, J. A., Tamargo, J., Jonson, J. A., & Doydoy, J. D. (2024). Comparative analysis and application of cybersecurity framework to Philippine small and medium enterprises (SMEs). In Proceedings of the 2024 9th International Conference on Intelligent Information Technology (pp. 1– 7). Association for Computing Machinery. https://doi.org/10.1145/3654522.3654565
Boyens, J., Paulsen, C., Moorthy, R., & Bartol, N. (2015). Supply chain risk management practices for federal information systems and organizations (NIST Special Publication 800-161). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-161
ConnectWise, & Vanson Bourne. (2025). 2025 state of SMB cybersecurity report. ConnectWise. https://www.connectwise.com/globalassets/media/asset-docs/executive-briefs/the-state-of-smb-cybersecurity-in-2025.pdf
Creswell, J. W., & Plano Clark, V. L. (2018). Designing and conducting mixed methods research (3rd ed.). SAGE Publications. https://uk.sagepub.com/en-gb/asi/designing-and-conducting-mixed-methods-research-international-student-edition/book258100
Department of Information and Communications Technology. (2017). National cybersecurity plan 2022. Republic of the Philippines. https://database.cyberpolicyportal.org/api/files/1669373681028wbvn87gdwah.pdf
DiMaggio, P. J., & Powell, W. W. (1983). The iron cage revisited: Institutional isomorphism and collective rationality in organizational fields. American Sociological Review, 48(2), 147–160. https://doi.org/10.2307/2095101
El-Hajj, M., & Mirza, Z. A. (2024). Protecting small and medium enterprises: A specialized cybersecurity risk assessment framework and tool. Electronics, 13(19), Article 3910. https://doi.org/10.3390/electronics13193910
Garrone, R. (2025). Proportionate cybersecurity for micro-SMEs: A governance design model under NIS2 (arXiv:2511.02898). arXiv. https://arxiv.org/abs/2511.02898
Gordon, L. A., & Loeb, M. P. (2002). The economics of information security investment. ACM Transactions on Information and System Security, 5(4), 438–457. https://doi.org/10.1145/581271.581274
Harel, Y., & Carmeli, A. (2025). A strategic cybersecurity oversight framework: A board's imperative. Journal of Cybersecurity, 11(1), Article tyaf021. https://doi.org/10.1093/cybsec/tyaf021
IANS Research, & Artico Search. (2025). 2025 security budget benchmark report. IANS Research. https://www.iansresearch.com/resources/press-releases/detail/ians-research-and-artico-search-release-security-budget-benchmark-report
International Business Machines Corporation. (2024). Cost of a data breach report 2024. IBM Security. https://www.ibm.com/downloads/documents/us-en/107a02e94948f4ec
International Organization for Standardization. (2022). Information security, cybersecurity and privacy protection—Information security management systems—Requirements (ISO/IEC 27001:2022). https://www.iso.org/standard/82875.html
ISACA. (2019). COBIT 2019 framework: Governance and management objectives. https://www.isaca.org/store2/product/WCB19FGM
Jensen, M. C., & Meckling, W. H. (1976). Theory of the firm: Managerial behavior, agency costs and ownership structure. Journal of Financial Economics, 3(4), 305–360. https://doi.org/10.1016/0304-405X(76)90026-X
Jeyaraj, A., & Zadeh, A. (2020). Institutional isomorphism in organizational cybersecurity: A text analytics approach. Journal of Organizational Computing and Electronic Commerce, 30(4), 361–380. https://doi.org/10.1080/10919392.2020.1776033
Lowry, M. R., Vance, A., & Vance, M. D. (2026). Inexpert supervision: Field evidence on boards' oversight of cybersecurity. Management Science, 72(2), 783–804. https://doi.org/10.1287/mnsc.2023.04147
Meyer, J. W., & Rowan, B. (1977). Institutionalized organizations: Formal structure as myth and ceremony. American Journal of Sociology, 83(2), 340–363. https://doi.org/10.1086/226550
National Institute of Standards and Technology. (2024). The NIST cybersecurity framework (CSF) 2.0 (NIST CSWP 29). U.S. Department of Commerce. https://doi.org/10.6028/NIST.CSWP.29
Republic Act No. 10173, Data Privacy Act of 2012. (2012). Congress of the Philippines. https://lawyerly.ph/laws/view/lc44d
Republic Act No. 10175, Cybercrime Prevention Act of 2012. (2012). Congress of the Philippines. https://ldr.senate.gov.ph/legislative-issuance/republic-act-no-10175
von Solms, R., & van Niekerk, J. (2013). From information security to cyber security. Computers & Security, 38, 97–102. https://doi.org/10.1016/j.cose.2013.04.004
World Economic Forum, & Accenture. (2024). Global cybersecurity outlook 2024. World Economic Forum. https://www.weforum.org/publications/global-cybersecurity-outlook-2024/
Yin, R. K. (2018). Case study research and applications: Design and methods (6th ed.). SAGE Publications.
Downloads
Published
How to Cite
Issue
Section
License
Copyright (c) 2026 International Journal of Research on Multidisciplinary Studies
This work is licensed under a Creative Commons Attribution 4.0 International License.
