{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,15]],"date-time":"2026-08-15T08:27:01Z","timestamp":1786782421214,"version":"3.56.0"},"reference-count":26,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2026,11,1]],"date-time":"2026-11-01T00:00:00Z","timestamp":1793491200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2026,11,1]],"date-time":"2026-11-01T00:00:00Z","timestamp":1793491200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/legal\/tdmrep-license"},{"start":{"date-parts":[[2026,7,8]],"date-time":"2026-07-08T00:00:00Z","timestamp":1783468800000},"content-version":"vor","delay-in-days":0,"URL":"http:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Computers & Security"],"published-print":{"date-parts":[[2026,11]]},"DOI":"10.1016\/j.cose.2026.105051","type":"journal-article","created":{"date-parts":[[2026,7,7]],"date-time":"2026-07-07T15:12:33Z","timestamp":1783437153000},"page":"105051","update-policy":"https:\/\/doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":0,"special_numbering":"C","title":["Strategic illusion and symbolic oversight: An empirical study of cybersecurity in healthcare boardrooms"],"prefix":"10.1016","volume":"170","author":[{"ORCID":"https:\/\/orcid.org\/0009-0003-4212-9638","authenticated-orcid":false,"given":"Jostein","family":"Jensen","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7143-1348","authenticated-orcid":false,"given":"Farzana","family":"Quayyum","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0009-1857-3767","authenticated-orcid":false,"given":"Lillian","family":"R\u00f8stad","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5624-5929","authenticated-orcid":false,"given":"Olav","family":"Lysne","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"78","reference":[{"issue":"2","key":"10.1016\/j.cose.2026.105051_b1","doi-asserted-by":"crossref","first-page":"147","DOI":"10.2307\/2095101","article-title":"The iron cage revisited: Institutional isomorphism and collective rationality in organizational fields","volume":"48","author":"DiMaggio","year":"1983","journal-title":"Am. Sociol. Rev."},{"key":"10.1016\/j.cose.2026.105051_b2","series-title":"European action plan for cybersecurity in hospitals and healthcare providers","author":"European Commission","year":"2025"},{"key":"10.1016\/j.cose.2026.105051_b3","doi-asserted-by":"crossref","DOI":"10.1016\/j.cose.2022.102840","article-title":"Governing cybersecurity from the boardroom: challenges, drivers, and ways ahead","volume":"121","author":"Gale","year":"2022","journal-title":"Comput. Secur."},{"key":"10.1016\/j.cose.2026.105051_b4","doi-asserted-by":"crossref","first-page":"221","DOI":"10.1365\/s43439-025-00151-7","article-title":"From cybersecurity to cyber resilience in the board room: key steps for supervisory board members and non-executives","volume":"6","author":"Galle","year":"2025","journal-title":"Int. Cybersecur. Law Rev."},{"issue":"3","key":"10.1016\/j.cose.2026.105051_b5","first-page":"1","article-title":"Board tools for oversight of cybersecurity risk","volume":"23","author":"Landefeld","year":"2015","journal-title":"Corp. Gov. Advis."},{"key":"10.1016\/j.cose.2026.105051_b6","series-title":"The Handbook of Board Governance: A Comprehensive Guide for Public, Private, and Not-for-Profit Board Members","first-page":"335","article-title":"Three lines of defense versus five lines of assurance: Elevating the role of the board and CEO in risk governance","author":"Leech","year":"2016"},{"issue":"2","key":"10.1016\/j.cose.2026.105051_b7","article-title":"Inexpert supervision: Field evidence on boards\u2019 oversight of cybersecurity","volume":"72","author":"Lowry","year":"2025","journal-title":"Manag. Sci."},{"key":"10.1016\/j.cose.2026.105051_b8","article-title":"Boards are having the wrong conversations about cybersecurity","author":"Milic\u0103","year":"2023","journal-title":"Harv. Bus. Rev."},{"key":"10.1016\/j.cose.2026.105051_b9","series-title":"Meld. St. 5 (2023\u20132024) En Motstandsdyktig Helseberedskap - Fra Pandemi Til Krig I Europa [Report to the Storting (White Paper): A Resilient Health Emergency Preparedness]","author":"Ministry of Health and Care Services","year":"2023"},{"key":"10.1016\/j.cose.2026.105051_b10","series-title":"Risiko- Og S\u00e5rbarhetsanalyse 2025: Sikkerhet Og Robusthet I Helsesektoren [Risk and Vulnerability Analysis 2025: Security and Resilience in the Health Sector]","author":"Ministry of Health and Care Services","year":"2025"},{"key":"10.1016\/j.cose.2026.105051_b11","series-title":"Meld. St. 9 (2024\u20132025) Totalberedskapsmeldingen [Report to the Storting: Total Preparedness White Paper]","author":"Ministry of Justice and Public Security","year":"2024"},{"key":"10.1016\/j.cose.2026.105051_b12","doi-asserted-by":"crossref","unstructured":"Opdenbusch, J., Hielscher, J., Sasse, M.A., 2025. \u201dWhere Are We On Cyber?\u201d-A Qualitative Study On Boards\u2019 Cybersecurity Risk Decision Making. In: Network and Distributed System Security (NDSS) Symposium.","DOI":"10.14722\/ndss.2025.240595"},{"key":"10.1016\/j.cose.2026.105051_b13","article-title":"Sizing up your cyberrisks","author":"Parenty","year":"2019","journal-title":"Harv. Bus. Rev."},{"key":"10.1016\/j.cose.2026.105051_b14","article-title":"Is your board prepared for new cybersecurity regulations?","author":"Pearlson","year":"2022","journal-title":"Harv. Bus. Rev."},{"key":"10.1016\/j.cose.2026.105051_b15","article-title":"7 pressing cybersecurity questions boards need to ask","author":"Pearlson","year":"2022","journal-title":"Harv. Bus. Rev."},{"key":"10.1016\/j.cose.2026.105051_b16","series-title":"Proceedings of the 57th Hawaii International Conference on System Sciences","doi-asserted-by":"crossref","DOI":"10.24251\/HICSS.2024.810","article-title":"Board level balanced scorecard for cyber resilience","author":"Pearlson","year":"2024"},{"key":"10.1016\/j.cose.2026.105051_b17","series-title":"Cybersecurity: The 2022 Board Perspective \u2014 Board Director Views on the Global Threat Landscape, Cybersecurity Priorities and CISO Relations","author":"Proofpoint and MIT Sloan (CAMS)","year":"2022"},{"issue":"4","key":"10.1016\/j.cose.2026.105051_b18","article-title":"The importance of board member actions for cybersecurity governance and risk management","volume":"22","author":"Proudfoot","year":"2023","journal-title":"MIS Q. Exec."},{"issue":"2","key":"10.1016\/j.cose.2026.105051_b19","first-page":"12","article-title":"The board\u2019s role in managing cybersecurity risks","volume":"59","author":"Rothrock","year":"2018","journal-title":"MIT Sloan Manag. Rev."},{"issue":"2","key":"10.1016\/j.cose.2026.105051_b20","doi-asserted-by":"crossref","first-page":"238","DOI":"10.2307\/2393176","article-title":"Corporate attributions as strategic illusions of management control","volume":"29","author":"Salancik","year":"1984","journal-title":"Adm. Sci. Q."},{"issue":"2","key":"10.1016\/j.cose.2026.105051_b21","doi-asserted-by":"crossref","first-page":"261","DOI":"10.1108\/ICS-02-2019-0033","article-title":"What do we know about information security governance? \u201cFrom the basement to the boardroom\u201d: towards digital security governance","volume":"28","author":"Schinagl","year":"2020","journal-title":"Inf. Comput. Secur."},{"key":"10.1016\/j.cose.2026.105051_b22","doi-asserted-by":"crossref","DOI":"10.1016\/j.accinf.2023.100642","article-title":"A pathway model to five lines of accountability in cybersecurity governance","volume":"51","author":"Slapni\u010dar","year":"2023","journal-title":"Int. J. Account. Inf. Syst."},{"key":"10.1016\/j.cose.2026.105051_b23","series-title":"Trusselrapport 2025: Cybersikkerhet I Spesialisthelsetjenesten [Sectoral Threat Assessment 2025: Cybersecurity in the Specialist Healthcare Service]","author":"Specialist care services and HealthCERT","year":"2025"},{"key":"10.1016\/j.cose.2026.105051_b24","series-title":"2019 IEEE International Conference on Intelligence and Security Informatics","first-page":"231","article-title":"Cyber security and data governance roles and responsibilities at the C-level and the board","author":"Thuraisingham","year":"2019"},{"key":"10.1016\/j.cose.2026.105051_b25","doi-asserted-by":"crossref","DOI":"10.1016\/j.cose.2024.103708","article-title":"Unravelling the three lines model in cybersecurity: a systematic literature review","volume":"139","author":"Valkenburg","year":"2024","journal-title":"Comput. Secur."},{"key":"10.1016\/j.cose.2026.105051_b26","series-title":"The Global Risks Report 2026: 21st Edition","author":"World Economic Forum","year":"2026"}],"container-title":["Computers & Security"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0167404826002270?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0167404826002270?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2026,8,15]],"date-time":"2026-08-15T08:10:53Z","timestamp":1786781453000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S0167404826002270"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,11]]},"references-count":26,"alternative-id":["S0167404826002270"],"URL":"https:\/\/doi.org\/10.1016\/j.cose.2026.105051","relation":{},"ISSN":["0167-4048"],"issn-type":[{"value":"0167-4048","type":"print"}],"subject":[],"published":{"date-parts":[[2026,11]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"Strategic illusion and symbolic oversight: An empirical study of cybersecurity in healthcare boardrooms","name":"articletitle","label":"Article Title"},{"value":"Computers & Security","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.cose.2026.105051","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2026 The Authors. Published by Elsevier Ltd.","name":"copyright","label":"Copyright"}],"article-number":"105051"}}