CYBERSECURITY RISK, CONTROL AND GOVERNANCE IN DIGITAL DATA: A CHRONOLOGICAL REVIEW
DOI:
https://doi.org/10.35631/IJLGC.1146002Keywords:
Cybersecurity, Digital Data, Risk Control, Risk Governance, Risk ManagementAbstract
The rapid expansion of digital technologies and data dependent operations has increased organizational exposure to cyber threats, privacy breaches, operational disruption, and regulatory noncompliance, strengthening the need for effective cybersecurity risk management, control, and governance. However, existing knowledge remains dispersed across technical, behavioural, organizational, and regulatory perspectives, making the historical development and changing priorities of this research domain difficult to understand. This study presents a chronological literature review of cybersecurity risk, control, and governance in digital data. A systematic advanced search was conducted in the Scopus database using keyword combinations related to “cybersecurity,” “risk management,” “risk governance,” and “risk assessment,” supported by predefined screening and eligibility criteria. The process produced a final dataset of 302 publications covering the period from 2017 to August 2026. Based on publication patterns and changes in research focus, methodological application, and conceptual development, the literature was classified into three chronological phases. The first phase, Emergence and Conceptual Foundation (2017–2019), primarily addressed risk perception, human behaviour, organizational culture, and socio technical security principles. The second phase, Development and Sustained Growth (2020–2023), extended towards organizational resilience, integrated governance, regulatory compliance, risk quantification, adaptive controls, and digital asset protection. The third phase, Accelerated Expansion and Research Maturation (2024–2026), demonstrated increasing attention to standards-based governance, sector specific frameworks, artificial intelligence, explainable automation, dynamic risk assessment, legal accountability, and human AI collaboration. Overall, the findings reveal a progressive transition from fragmented technical and behavioural approaches towards integrated cybersecurity governance that connects people, processes, technology, regulation, and organizational accountability. This review provides a structured understanding of the field’s evolution and supports future development of adaptive, measurable, and context sensitive approaches for managing cybersecurity risks and protecting digital data.
Downloads
References
Ababneh, J., H. Attar, H. Alghamdi, I. Obeidat, Y. Sharrab, J. B. Salameh, H. Ali, and M. Hafez. 2026. “Cybersecurity Laws and Ethical Implications: Integrated Cybersecurity Governance Model (CLEI-ICGM).” Journal of Cloud Computing 15(1). doi:10.1186/s13677-026-00902-9.
Addae, J. H., X. Sun, D. Towey, and M. Radenkovic. 2019. “Exploring User Behavioral Data for Adaptive Cybersecurity.” User Modeling and User-Adapted Interaction 29(3):701–50. doi:10.1007/s11257-019-09236-5.
Ahmad, A., K. C. Desouza, S. B. Maynard, H. Naseer, and R. L. Baskerville. 2020. “How Integration of Cyber Security Management and Incident Response Enables Organizational Learning.” Journal of the Association for Information Science and Technology 71(8):939–53. doi:10.1002/asi.24311.
Alohali, M., N. Clarke, F. Li, and S. Furnell. 2018. “Identifying and Predicting the Factors Affecting End-Users’ Risk-Taking Behavior.” Information and Computer Security 26(3):306–26. doi:10.1108/ICS-03-2018-0037.
Arora, C. 2019. “Digital Health Fiduciaries: Protecting User Privacy When Sharing Health Data.” Ethics and Information Technology 21(3):181–96. doi:10.1007/s10676-019-09499-x.
Bongiovanni, I., K. Renaud, H. Brydon, R. Blignaut, and A. Cavallo. 2022. “A Quantification Mechanism for Assessing Adherence to Information Security Governance Guidelines.” Information and Computer Security 30(4):517–48. doi:10.1108/ICS-08-2021-0112.
Cartwright, A., E. Cartwright, and E. S. Edun. 2023. “Cascading Information on Best Practice: Cyber Security Risk Management in UK Micro and Small Businesses and the Role of IT Companies.” Computers and Security 131. doi:10.1016/j.cose.2023.103288.
Chhetri, M. B., S. Tariq, R. Singh, F. Jalalvand, C. Paris, and S. Nepal. 2024. “Towards Human-AI Teaming to Mitigate Alert Fatigue in Security Operations Centres.” ACM Transactions on Internet Technology 24(3). doi:10.1145/3670009.
Damenu, T. K., and C. Beaumont. 2017. “Analysing Information Security in a Bank Using Soft Systems Methodology.” Information and Computer Security 25(3):240–58. doi:10.1108/ICS-07-2016-0053.
Dennis, A. R., and R. K. Minas. 2018. “Security on Autopilot: Why Current Security Theories Hijack Our Thinking and Lead Us Astray.” Data Base for Advances in Information Systems 49(s1):15–37. doi:10.1145/3210530.3210533.
Eshetu, Ali Yimam, Endris Abdu Mohammed, and A. Salau. 2024. “Cybersecurity Vulnerabilities and Solutions in Ethiopian University Websites.” Journal of Big Data 11. doi:10.1186/s40537-024-00980-z.
Ghanem, M. C., T. M. Chen, M. A. Ferrag, and M. E. Kettouche. 2023. “ESASCF: Expertise Extraction, Generalization and Reply Framework for Optimized Automation of Network Security Compliance.” IEEE Access 11:129840–53. doi:10.1109/ACCESS.2023.3332834.
Goodell, G., and T. Aste. 2019. “Can Cryptocurrencies Preserve Privacy and Comply With Regulations?” Frontiers in Blockchain 2. doi:10.3389/fbloc.2019.00004.
Ibnugraha, Prajna Deshanta, Anas Satria, Fabian Sekar Nagari, Moch Fahru Rizal, and Khamla Nonalinsavath. 2023. “The Reliability Analysis for Information Security Metrics in Academic Environment.” International Journal on Informatics Visualization 7(1):92–97. doi:10.30630/joiv.7.1.1593.
Islam, S., B. Sardar, E. M. Kalogeraki, K. Lampropoulos, and S. Papastergiou. 2026. “Hybrid AI-Based Dynamic Risk Assessment Framework with Explainable AI Practices for Composite Product Cybersecurity Certification.” International Journal of Information Security 25(2). doi:10.1007/s10207-026-01218-0.
Jensen, J., F. Quayuum, L. Røstad, and O. Lysne. 2026. “Strategic Illusion and Symbolic Oversight: An Empirical Study of Cybersecurity in Healthcare Boardrooms.” Computers and Security 170. doi:10.1016/j.cose.2026.105051.
Khan, A., M. Ibrahim, and A. Hussain. 2021. “An Exploratory Prioritization of Factors Affecting Current State of Information Security in Pakistani University Libraries.” International Journal of Information Management Data Insights 1(2). doi:10.1016/j.jjimei.2021.100015.
Kropczynski, J., Z. Aljallad, N. J. Elrod, H. Lipford, and P. J. Wisniewski. 2021. “Towards Building Community Collective Efficacy for Managing Digital Privacy and Security within Older Adult Communities.” Proceedings of the ACM on Human-Computer Interaction 4(CSCW3). doi:10.1145/3432954.
Lier, S. K., T. M. Eppers, J. Gerlach, P. Müller, and M. H. Breitner. 2025. “An Iterative Five-Phase Process Model to Successfully Implement AI for Cybersecurity in a Corporate Environment.” Electronic Markets 35(1). doi:10.1007/s12525-025-00802-x.
Linan-Acosta, B., O. Bazalar-Gonzales, and J. Santisteban. 2025. “GuardNet: An Architecture Based on NIST v2.0 for Confidential Data Protection in Higher Education Institutions in Peru.” Engineering, Technology and Applied Science Research 15(6):28977–85. doi:10.48084/etasr.12978.
Metin, B., S. Duran, E. Telli, M. Mutlutürk, and M. Wynn. 2024. “IT Risk Management: Towards a System for Enhancing Objectivity in Asset Valuation That Engenders a Security Culture.” Information (Switzerland) 15(1). doi:10.3390/info15010055.
Mundra, S. 2018. “Blockchain Initiatives and Implementation.” Information Services and Use 38(3):187–89. doi:10.3233/ISU-180022.
Nyblom, P., G. Wangen, and V. Gkioulos. 2020. “Risk Perceptions on Social Media Use in Norway.” Future Internet 12(12):1–40. doi:10.3390/fi12120211.
Proudfoot, J. G., W. A. Cram, and S. Madnick. 2025. “Weathering the Storm: Examining How Organisations Navigate the Sea of Cybersecurity Regulations.” European Journal of Information Systems 34(3):436–59. doi:10.1080/0960085X.2024.2345867.
Rashid, Z., U. Noor, and J. Altmann. 2021. “Economic Model for Evaluating the Value Creation through Information Sharing within the Cybersecurity Information Sharing Ecosystem.” Future Generation Computer Systems 124:436–66. doi:10.1016/j.future.2021.05.033.
van Schaik, P., J. Jansen, J. Onibokun, J. Camp, and P. Kusev. 2018. “Security and Privacy in Online Social Networking: Risk Perceptions and Precautionary Behaviour.” Computers in Human Behavior 78:283–97. doi:10.1016/j.chb.2017.10.007.
van Schaik, P., D. Jeske, J. Onibokun, L. Coventry, J. Jansen, and P. Kusev. 2017. “Risk Perceptions of Cyber-Security and Precautionary Behaviour.” Computers in Human Behavior 75:547–59. doi:10.1016/j.chb.2017.05.038.
Schinagl, S., A. Shahim, and S. Khapova. 2022. “Paradoxical Tensions in the Implementation of Digital Security Governance: Toward an Ambidextrous Approach to Governing Digital Security.” Computers and Security 122. doi:10.1016/j.cose.2022.102903.
Shah, M. U., F. Iqbal, U. Rehman, and P. C. K. Hung. 2023. “A Comparative Assessment of Human Factors in Cybersecurity: Implications for Cyber Governance.” IEEE Access 11:87970–84. doi:10.1109/ACCESS.2023.3296580.
Thompson, N., A. Ahmad, and S. Maynard. 2020. “Do Privacy Concerns Determine Online Information Disclosure? The Case of Internet Addiction.” Information and Computer Security 29(3):558–69. doi:10.1108/ICS-11-2020-0190.
Varghese, B. B., and Q. N. Bui. 2026. “An Integrated Framework for Information Security Risk Management: A Mixed-Methods Systematic Literature Review.” Computers and Security 168. doi:10.1016/j.cose.2026.104957.
da Veiga, A., L. V Astakhova, A. Botha, and M. Herselman. 2020. “Defining Organisational Information Security Culture—Perspectives from Academia and Industry.” Computers and Security 92. doi:10.1016/j.cose.2020.101713.
Wan, Z., L. Bao, D. Gao, E. Toch, X. Xia, T. Mendel, and D. Lo. 2019. “AppMoD: Helping Older Adults Manage Mobile Security with Online Social Help.” Proceedings of the ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies 3(4). doi:10.1145/3369819.
Zhang, L., A. Taal, R. Cushing, C. de Laat, and P. Grosso. 2022. “A Risk-Level Assessment System Based on the STRIDE/DREAD Model for Digital Data Marketplaces.” International Journal of Information Security 21(3):509–25. doi:10.1007/s10207-021-00566-3.
