According to Willis' findings, the top three cyber risks identified in the retail sector include the privacy and loss of confidential data (74%); reputation risk (66%) and cyber liability (61%). However, cyber risk at the hands of "outsource vendors" was a concern for only 9%. Given the level of outsourcing across the sector and an overall dependence on third-party technology partners, this result is surprising.

In combatting cyber risks, the survey revealed that almost half of the respondents cited the use of technical safeguards, which is greater than the rest of the Fortune 1000. Despite this, 17% of retail companies reported inadequate resources to limit cyber losses. This is a potential cause for concern, Willis suggests, as technical protections may not be able to effectively contain the effects of some cyber or technological events. Similarly, only 9% of the sector indicated they have purchased insurance for cyber exposures.

"Addressing the evolving set of cyber threats facing the retail sector must remain a top priority. It is encouraging to see some retail industry leaders take steps to better prepare for and defend themselves against the increasing wave of targeted attacks via information sharing arrangements," said senior vice president of National Resource E&O for Willis, Chris Keegan.

At the same time, however, Keegan indicates that there is room for improvement.

"In Willis' view, the sector is slightly behind the curve in taking proactive steps," he said. "A series of recent high-profile cyber breaches have pointed a government spotlight at the sector and Willis expects this scrutiny to continue. Our advice for retailers is: don't wait for the SEC to come knocking on your door."

Willis' Special Report, "10K Disclosures – How Retail Companies Describe their Cyber Liability Exposures" is part of an ongoing Willis series analyzing how U.S. public companies describe their cyber risks in financial documents required by the U.S. Securities & Exchange Commission since October 2011.