{"status":"OK","data":{"id":555496,"identifier":"T9HSVE","persistentUrl":"https://doi.org/10.34894/T9HSVE","protocol":"doi","authority":"10.34894","separator":"/","publisher":"DataverseNL","publicationDate":"2026-03-04","storageIdentifier":"surf://10.34894/T9HSVE","effectiveDatasetFileCountLimit":10000,"datasetFileUploadsAvailable":9999,"datasetType":"dataset","locks":[],"latestVersion":{"id":31849,"datasetId":555496,"datasetPersistentId":"doi:10.34894/T9HSVE","datasetType":"dataset","storageIdentifier":"surf://10.34894/T9HSVE","versionNumber":1,"internalVersionNumber":127,"versionMinorNumber":0,"versionState":"RELEASED","latestVersionPublishingState":"RELEASED","deaccessionLink":"","lastUpdateTime":"2026-03-04T14:13:44Z","releaseTime":"2026-03-04T14:13:44Z","createTime":"2025-10-28T13:08:14Z","publicationDate":"2026-03-04","citationDate":"2026-03-04","effectiveDatasetFileCountLimit":10000,"datasetFileUploadsAvailable":9999,"license":{"name":"CC0-1.0","uri":"http://creativecommons.org/publicdomain/zero/1.0","iconUri":"https://licensebuttons.net/p/zero/1.0/88x31.png","rightsIdentifier":"CC0-1.0","rightsIdentifierScheme":"SPDX","schemeUri":"https://spdx.org/licenses/","languageCode":"en"},"fileAccessRequest":false,"metadataBlocks":{"citation":{"displayName":"Citation Metadata","name":"citation","fields":[{"typeName":"title","multiple":false,"typeClass":"primitive","value":"Cybersecurity Disclosure in Dutch Annual Reports"},{"typeName":"author","multiple":true,"typeClass":"compound","value":[{"authorName":{"typeName":"authorName","multiple":false,"typeClass":"primitive","value":"Boggini, Clara"},"authorAffiliation":{"typeName":"authorAffiliation","multiple":false,"typeClass":"primitive","value":"https://ror.org/057w15z03","expandedvalue":{"scheme":"http://www.grid.ac/ontology/","termName":"Erasmus University Rotterdam","@type":"https://schema.org/Organization"}},"authorIdentifierScheme":{"typeName":"authorIdentifierScheme","multiple":false,"typeClass":"controlledVocabulary","value":"ORCID"},"authorIdentifier":{"typeName":"authorIdentifier","multiple":false,"typeClass":"primitive","value":"0009-0003-7205-2635"}}]},{"typeName":"datasetContact","multiple":true,"typeClass":"compound","value":[{"datasetContactName":{"typeName":"datasetContactName","multiple":false,"typeClass":"primitive","value":"Boggini, Clara"},"datasetContactAffiliation":{"typeName":"datasetContactAffiliation","multiple":false,"typeClass":"primitive","value":"Erasmus Universiteit Rotterdam"}}]},{"typeName":"dsDescription","multiple":true,"typeClass":"compound","value":[{"dsDescriptionValue":{"typeName":"dsDescriptionValue","multiple":false,"typeClass":"primitive","value":"

Background

\nAnnual reports provide stakeholders with financial and non-financial risks that could influence company performance, including cyber risks. Cyber incidents can cause financial loss, reputational damage, costs of patching, and potential legal liability. Companies must implement cybersecurity controls and risk management frameworks to prevent such incidents. In 2022, the EU introduced NIS2 and DORA, setting obligations for cybersecurity and supply chain risk management. Supply chain cyber risk has increased, as suppliers are often the weakest link, prompting regulatory requirements to manage third-party risks.\n\n

Purpose

\nThis article examines whether the 2022 regulatory changes (NIS2 and DORA) have altered how cybersecurity risks are disclosed in annual reports of Dutch listed companies. The research question is: “To what extent is there an observable change in how Dutch listed companies disclose cyber risk and supply chain cyber risk in their annual reports before and after the introduction of NIS2 and DORA in 2022?”\n\n

Method

\nThe study focuses on listed companies on the AEX, AMX, and AscX indices. A keyword research methodology was used, covering annual reports from 2020, 2022, and 2024. Keywords related to cybersecurity and supply chain controls were identified and extracted. Paragraphs, tables, and graphs containing these keywords were collected and analysed. A second round of keyword research focused on the nature of cybersecurity measures and supply chain security information, using keywords aligned with DORA and NIS2 provisions. Data from both phases were compiled in a single Excel file for comparison across years.\n\n

Results

\nAll extracted cybersecurity-related content from annual reports was recorded, including the frequency of keyword mentions, relevant paragraphs, tables, graphs, and report sections. The second phase categorized disclosures by cybersecurity controls and supply chain security information, allowing detailed analysis of changes over time. Data were consolidated in a single Excel document, enabling longitudinal comparison of disclosure patterns from 2020 to 2024.\n\n

Conclusion

\nThe study provides a framework to assess whether EU cybersecurity legislation has influenced companies’ reporting practices, revealing how changes in regulation may drive revisions and improvements in cybersecurity and supply chain risk management policies."}}]},{"typeName":"subject","multiple":true,"typeClass":"controlledVocabulary","value":["Law"]},{"typeName":"notesText","multiple":false,"typeClass":"primitive","value":"

This entry is a three hundred and seventy-eight-files data package totaling 3.70 GB, containing files in .ods, .pdf, .txt, .xlsm and .xlsx formats.

If you use this dataset, please cite:

Boggini, C. (2026). Cybersecurity Disclosure in Dutch Annual Reports (Version V1) [Data set]. DataverseNL. https://doi.org/10.34894/T9HSVE

"},{"typeName":"language","multiple":true,"typeClass":"controlledVocabulary","value":["English"]},{"typeName":"depositor","multiple":false,"typeClass":"primitive","value":"Boggini, Clara"},{"typeName":"dateOfDeposit","multiple":false,"typeClass":"primitive","value":"2025-10-28"},{"typeName":"timePeriodCovered","multiple":true,"typeClass":"compound","value":[{"timePeriodCoveredStart":{"typeName":"timePeriodCoveredStart","multiple":false,"typeClass":"primitive","value":"2020-01-01"},"timePeriodCoveredEnd":{"typeName":"timePeriodCoveredEnd","multiple":false,"typeClass":"primitive","value":"2024-12-31"}}]},{"typeName":"dateOfCollection","multiple":true,"typeClass":"compound","value":[{"dateOfCollectionStart":{"typeName":"dateOfCollectionStart","multiple":false,"typeClass":"primitive","value":"2024-03-01"},"dateOfCollectionEnd":{"typeName":"dateOfCollectionEnd","multiple":false,"typeClass":"primitive","value":"2025-08-31"}}]},{"typeName":"kindOfData","multiple":true,"typeClass":"primitive","value":["Secondary archival data derived from publicly available annual reports, analysed through a quantitative content analysis of qualitative textual disclosures."]}]},"geospatial":{"displayName":"Geospatial Metadata","name":"geospatial","fields":[{"typeName":"geographicCoverage","multiple":true,"typeClass":"compound","value":[{"country":{"typeName":"country","multiple":false,"typeClass":"controlledVocabulary","value":"Netherlands"}}]}]},"socialscience":{"displayName":"Social Science and Humanities Metadata","name":"socialscience","fields":[{"typeName":"unitOfAnalysis","multiple":true,"typeClass":"primitive","value":["Keywords extracted from the annual reports of each company for the years 2020, 2022, and 2024."]},{"typeName":"universe","multiple":true,"typeClass":"primitive","value":["The annual reports of the 75 companies listed on the AEX, AMX, and AscX indices of Euronext Amsterdam as of March 2024, constituting the population of corporate reports in which cybersecurity and supply chain risks may be disclosed."]},{"typeName":"dataCollector","multiple":false,"typeClass":"primitive","value":"Clara Boggini"},{"typeName":"samplingProcedure","multiple":false,"typeClass":"primitive","value":"Companies listed in 2020,2022, and 2024 in the Euronext index"}]},"dansDataVaultMetadata":{"displayName":"Data Vault Metadata","name":"dansDataVaultMetadata","fields":[{"typeName":"dansDataversePid","multiple":false,"typeClass":"primitive","value":"doi:10.34894/T9HSVE"},{"typeName":"dansDataversePidVersion","multiple":false,"typeClass":"primitive","value":"1.0"},{"typeName":"dansBagId","multiple":false,"typeClass":"primitive","value":"urn:uuid:63a864d7-f27a-4e29-90c2-1d5640a7b3e5"},{"typeName":"dansNbn","multiple":false,"typeClass":"primitive","value":"urn:nbn:nl:ui:13-fbd3414c-b758-4959-a088-8f5778b72582"}]}},"files":[{"description":"\nThis repository contains the dataset and supporting materials for an empirical study examining cybersecurity and supply chain security disclosures in the annual reports of Dutch listed companies.\nThe study is based on a structured two-phase keyword analysis of annual reports. The materials included here allow other researchers to understand how the dataset was created and to replicate or verify the results.","label":"doi-10.34894-t9hsve_data-package_2026.zip","restricted":false,"version":1,"datasetVersionId":31849,"dataFile":{"id":614427,"persistentId":"","filename":"doi-10.34894-t9hsve_data-package_2026.zip","contentType":"application/zip","friendlyType":"ZIP Archive","filesize":3276951615,"description":"\nThis repository contains the dataset and supporting materials for an empirical study examining cybersecurity and supply chain security disclosures in the annual reports of Dutch listed companies.\nThe study is based on a structured two-phase keyword analysis of annual reports. The materials included here allow other researchers to understand how the dataset was created and to replicate or verify the results.","storageIdentifier":"surf://store:19cb8e396a2-18debdd27f09","rootDataFileId":-1,"checksum":{"type":"SHA-1","value":"dac9642729641861a0d27c639851637e0a4e88f9"},"tabularData":false,"creationDate":"2026-03-04","publicationDate":"2026-03-04","lastUpdateTime":"2026-03-04T14:13:44Z","fileAccessRequest":false}}]}}}