Corporate Learning & Development

When systems fail, whether through a ransomware attack, a stolen password or a supplier's mistake, the consequences are those of any serious business risk: lost revenue, lost trust, legal exposure. Responsibility for that risk cannot be delegated entirely to the technical team. The board must understand it well enough to set its appetite, fund the response and ask the right questions.

Those questions are practical. What are our most important systems and data? Who can reach them? How would we know if something had gone wrong, and what is the plan on the day? Has it been rehearsed? Increasingly the law adds its own demands: duties under data protection law to notify when personal information is compromised, cybersecurity rules such as the European Union's NIS2 Directive, and laws that create cyber offences, such as South Africa's Cybercrimes Act and Kenya's Computer Misuse and Cybercrimes Act. Frameworks such as ISO/IEC 27001 and the NIST Cybersecurity Framework give boards a common yardstick.

This theme is about governing cyber risk without needing to be technical: the oversight a board should provide and the plain-language answers it should expect.