Embedding Cybersecurity Governance into Corporate Planning: A Framework for Mid-Market Philippine Logistics Firms

Abstract

Cybersecurity governance is increasingly framed as a planning-stage function embedded in resource-allocation and approval processes rather than as a downstream technical control. This shift has progressed furthest in banking, while mid-market third-party logistics (3PL) providers remain largely outside the discussion despite handling sensitive client data and maintaining deep application programming interface (API) integrations with enterprise clients. Prior studies typically offer either standardized extent-of-practice measurement or contextual explanation, rarely both, leaving unclear how extensively cybersecurity governance is integrated into corporate planning and why integration varies across similar firms. This study addressed this gap through a convergent mixed-method multi-case design involving five purposively selected, anonymized Philippine logistics firms. A structured 20-item survey, adapted from the Govern function of the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) 2.0 and the Control Objectives for Information and Related Technologies (COBIT) 2019, measured integration across four dimensions (Governance Structure, Risk Management Integration, Policy Formalization, and Resource Allocation) among 35 personnel, while key informant interviews and document reviews provided contextual explanations. The survey demonstrated good internal consistency (α = .83). Firms with both client-facing integrations and formal senior-level governance oversight (Firms C and D) were classified as “substantially integrated” (3.85 and 3.63), while firms lacking both (Firms A and E) were classified as “minimally integrated” (2.20 and 2.35). Resource Allocation received the highest scores and Policy Formalization the lowest, suggesting that digital investment has outpaced formal governance practices. Interviews indicated that higher-scoring firms converted triggering events into established planning practices through senior-level governance oversight, whereas lower-scoring firms treated cybersecurity primarily as a responsibility of information technology contractors. The study proposes a four-layer framework (Governance, Planning-Gate, Risk-Integration, and Resource-Alignment) and recommends that industry associations develop a voluntary, sector-specific governance benchmark.