Assessing Cybersecurity Risk for Oil & Gas Mergers and Acquisitions

Abstract

This paper presents a cybersecurity risk assessment guide for mergers and acquisitions (M&A) in the oil and gas industry. The mechanisms used for assessing cyber risk are technology neutral and developed around an organization's security culture, information systems, and operating infrastructure as they apply to the M&A process. Assessing a security infrastructure includes any connections between information technology and operational technology systems. Security considerations relating to the integration of acquired operating and information system assets are also factored into the approach. For mergers, we present six open-ended questions that are linked to specific cybersecurity functions and corresponding domains. Each domain includes industry best practices for acquirers to understand the relative maturity of a target company's cybersecurity program. Asset acquisitions require a less-comprehensive approach that focuses on four relevant areas of risk. The assessment presented in this paper can be used by companies operating across the oil and gas supply chain.

US-Russia Geopolitical Risk and Corporate Cybersecurity Risk: Evidence from 10-K Reports

“…acquisition activities exhibit inherent cybersecurity risk (Hosseini & Paul, 2017). Ultimately, we control for the number of employees (EMPLOYEES) as the weakest link in a rm's cybersecurity is human (Gozon et al, 2021).…”

Merger and acquisition, firm‐level cybersecurity risk, and research and development intensity

“…Although numerous empirical research has been conducted to explore the determinants of firm-level cybersecurity risk as well as its impact on other corporate decisions (e.g., Aldasoro et al, 2022;Crosignani et al, 2023;Florackis et al, 2023;Hoang, 2023;Jamilov et al, 2020;Jiang et al, 2022;Nguyen & Hoang, 2023), none of them digs into the impact of M&A on firm-level cybersecurity risk. Hosseini and Paul (2017) show interest in this connection, but their research is in the form of a discussion paper and is limited to the oil and gas industry. Sun (2021) and Sun et al (2023), though also pay attention to data security and M&A, study the impact of the adoption of the Data Breach Notification Law on M&A intensity across US states.…”