In many organisations the answer is unclear. Day-to-day IT may sit with a staff member, a contractor or a volunteer, and the board or committee assumes security is being looked after. Technical management can be delegated, and accountability for the outcome stays with the leadership team.
What leadership needs to know
The person who manages the systems handles the technical work, such as applying updates, configuring accounts and running backups. Knowing which vulnerability was exploited in a particular attack is a job for that person. Leadership needs the simpler answer to who does what, and when, and some way to confirm it is happening.
Questions leadership can ask
A board or committee that can answer these has a reasonable view of its cyber security position:
- Who holds administrator access to the website, email, domain and cloud tools, and what happens if that person leaves or is unavailable?
- Who applies software updates, and how often?
- Where are the backups kept, and when was a restore last tested?
- Is two-factor authentication turned on for email and other important accounts?
- Who is contacted first if the website or email is compromised?
- What personal information does the organisation hold, and who can see it?
- How often does leadership receive a report on any of this, and is it readable?
If several of these are hard to answer, a security review provides a baseline.
When access depends on one person
One of the most common gaps is administrator access that sits with a single individual, with thin documentation and no plan for when that person moves on. We worked with a member association where this was the case. When its website was compromised, the board had no real oversight of infrastructure it was ultimately responsible for. The case study describes how the site was recovered and how a governance structure was put in place to prevent a repeat.
Organisations without an IT person
Many small organisations have nobody in the role. In that situation responsibility needs to be assigned to a named person, with access documented and checked periodically by someone independent. An external adviser can provide that check, or fill the gap on an ongoing basis. Our approach page describes the Advisory, Consulting and Fractional options.
How we help
Our Technology Governance service covers access control, cyber risk and preventative planning, documentation and continuity, and plain-language reporting for boards and committees. Hands-on security work sits under Cyber Security & Safety.
