Cyber risk is now a governance question, not a technical footnote

Boards that treat cybersecurity as “an IT matter” are making a category error. Cybersecurity has become a primary driver of operational continuity, financial integrity, regulatory exposure, partner confidence, and enterprise valuation. When risk sits at that level, it is not delegated away. It is governed.

This does not mean boards must discuss tools or configurations. It means boards must govern:

what the organisation is willing to risk
what must never fail
how control effectiveness is evidenced
who owns the consequences when controls fail
how crises are managed when prevention fails (because sometimes it will)

A mature board treats cyber the way it treats credit risk, liquidity risk, fraud risk, and business continuity: as a strategic risk with measurable indicators, clear decision rights, and periodic stress testing.

A practical model: “Cyber governance as an enterprise control system”

A board-grade cyber programme is an enterprise control system with five elements:

Crown jewels definition
What assets, processes, and data would cause existential harm if compromised?
Control objectives
What are we trying to guarantee? Confidentiality, integrity, availability, safety, and legal compliance.
Control coverage
Which controls protect which crown jewels? Where are the gaps?
Assurance and evidence
How do we know controls work? Not belief. Evidence.
Response readiness
What happens when controls fail? Who decides, who communicates, and how recovery is executed.

If any of these elements is missing, the organisation is relying on luck.

What boards must own (and what they must not pretend to own)

Boards should not “run security.” Boards should own governance. Practically, that means:

Board responsibilities

approve cyber risk appetite and tolerances
ensure management has a funded, time-bound programme
demand evidence of control effectiveness
oversee third-party concentration risk and exit readiness
ensure incident response, recovery, and crisis communications are rehearsed
ensure accountability for repeated control failures

Management responsibilities

implement controls and produce evidence
run operations: monitoring, patching, access governance, vendor oversight
execute incident response and recovery
build culture and capability

The line is simple: boards demand clarity and evidence, management delivers capability.

Failure modes boards repeatedly enable (often without realising it)

1) “Delegation without authority”

Boards delegate security to IT without giving it authority across business units, procurement, HR, and operations. The result is predictable: controls remain inconsistent and exceptions multiply.

2) “Cyber treated as an annual audit event”

Security becomes a once-a-year compliance exercise, while attackers operate continuously. If cyber is not discussed routinely, it is not governed.

3) “Metrics theatre”

Boards receive dashboards full of activity metrics (number of trainings, number of tools deployed) instead of risk metrics (time-to-detect, privileged access reduction, restore success rate). Activity is not safety.

4) “Vendor complacency”

Boards underestimate third-party risk and concentration risk. A vendor outage or compromise becomes the organisation’s problem within minutes, regardless of contract wording.

5) “Crisis improvisation”

The first time executives discuss decision rights, customer messaging, regulatory notification, and containment trade-offs is during the incident. That is not leadership. That is reaction.

The board’s non-negotiable question set

A board that wants to govern cyber should ask questions that force precision:

Crown jewels and blast radius

What are our crown jewels, and what is the blast radius if each is compromised?
Which systems can move money, change identity attributes, or export customer data?
Who has privileged access today, and how fast can that access be removed?

Detection and response readiness

How quickly can we detect an intrusion or fraud campaign in our most critical systems?
How quickly can we contain it without destroying evidence or causing extended downtime?
When was our last incident simulation, what failed, and what has been fixed since?

Recovery and continuity

Do we have tested restores, not just backups?
What are our proven RTO and RPO for crown jewel systems?
How would we operate manually if key platforms are down for 48 hours?

Third-party and concentration risk

Which vendors are critical to uptime, identity, payments, or customer communications?
What is our exit plan if a critical vendor fails or becomes unaffordable?
How do we monitor vendor controls beyond initial onboarding?

Governance and accountability

Who owns cyber risk in each business unit?
What are the top 5 risks management is carrying, and why are we accepting them?
What is our process for exceptions, and how do exceptions expire?

These questions translate cyber from “technical” into “governance”.

The board pack: what should appear every quarter

A board cannot govern cyber without a consistent evidence pack. Each quarter, boards should receive:

Crown jewels map and changes since last quarter
Top risk register: top 5–10 cyber risks with likelihood, impact, mitigation status
KRI dashboard (risk indicators, not activity indicators)
Incident and near-miss report with lessons learned and actions closed
Third-party posture report for critical vendors and concentration exposure
Readiness report: tabletop exercise outcomes, recovery tests, communications rehearsal outcomes
Programme delivery status: what was promised, what is done, what is late, and why

If the pack is not evidence-based, it is a storytelling exercise.

The KRIs that actually translate risk

Boards should focus on a small set of KRIs that show whether risk is increasing or decreasing:

Access and identity risk

MFA coverage on crown jewel systems
privileged access count and trend (should reduce over time)
time-to-deprovision access for leavers and contractors (SLA and compliance)

Vulnerability and change risk

critical vulnerability remediation SLA adherence
percentage of crown jewel systems with current patch posture
percentage of production changes with change control and rollback plans

Detection and response risk

time-to-detect and time-to-contain for material incidents and simulations
alert fatigue indicators: false positive rate and triage backlog
coverage of logging for key events (privilege changes, data exports, payout changes)

Recovery and continuity risk

restore test success rate and proven RTO/RPO outcomes
coverage of tested recovery plans across crown jewel systems

Third-party risk

number of critical vendors without current risk review
concentration risk index: dependency on top 1–3 providers without exit runbooks

These KRIs avoid the trap of “we did training therefore we are safe.”

Africa-specific reality: cyber crises become social crises

In many African markets, trust collapses quickly and publicly, often through WhatsApp, community channels, and informal media amplification. This changes the crisis dynamic.

Boards must ensure:

crisis communications is rehearsed, not improvised
messaging is truthful, specific, and timely
customer protection actions are prioritised (account safety, fraud containment, service continuity)
regulators are engaged with discipline, not panic
internal teams have a single source of truth to prevent rumour-driven chaos

Speed and clarity are not PR tactics. They are trust controls.

Governance structure: who should own what at board level

Boards should assign ownership clearly:

Audit/Risk Committee: KRIs, risk register, vendor risk, assurance
Technology Committee (if present): resilience, architecture risk, major investments
Full Board: risk appetite, major incident oversight, strategic trade-offs

Management should have a named executive owner, typically a CRO/COO/CIO depending on the organisation, with the CISO responsible for programme delivery and evidence.

Conclusion: boards don’t need technical depth, they need governance depth

A board that governs cyber well does three things consistently:

demands clarity on crown jewels and blast radius
insists on evidence of control effectiveness
rehearses response and recovery before the crisis arrives

Anything less is not neutrality. It is unmanaged risk.