Three-week Board Technology Governance Initiative
Technology risk register in dollars. Governance framework modeled on audit committee structure, aligned to the SEC 2023 cybersecurity disclosure rules (Item 106 of Regulation S-K and the four-business-day material-incident clock under Item 1.05 of Form 8-K) where applicable. Management reporting cadence with defined formats. The framework references the NACD Director's Handbook on Cyber-Risk Oversight, COSO ERM, and the NIST CSF 2.0 Govern function. The board deck is built for 20 to 30 minutes of board time. Director and committee-chair availability may extend the schedule.
Who this is for
A board-ready technology governance framework you can present at the next meeting.
Board / Audit Committee
You need a documented posture aligned to the SEC 2023 cyber disclosure rules and technology risk visibility in the same format you already use for financial risk.
General Counsel
You want a defensible governance structure documented before the next D&O renewal or board self-assessment cycle.
CEO
You need a clear way to report on technology to the board without acting as its IT spokesperson.
CISO
Your board is asking for governance maturity and you want the framework documented so the same answer holds up across quarters.
Scope
What this Initiative delivers, and what it does not.
Scope is fixed at signing. Items marked Program are available in the Technology Operating Partner Program. The Initiative alone does not include them. Items tagged with an outside source require a separate specialty engagement.
In scope
- Interviews on current governance (board chair or audit committee chair, GC, CEO, CISO, internal audit if present)
- Technology risk register in dollars (annualized loss expectancy)
- Governance framework recommendation modeled on audit committee structure (charter, cadence, escalation)
- SEC 2023 cybersecurity disclosure alignment where applicable (Item 106 of Regulation S-K board-oversight description; the four-business-day materiality clock under Item 1.05 of Form 8-K; the materiality determination process)
- Management reporting cadence (what gets reported, how often, in what format)
- Board presentation deck designed for 20 to 30 minutes of board time
- Reference to applicable governance frameworks (NACD Director's Handbook on Cyber-Risk Oversight, COSO ERM, NIST CSF 2.0 Govern function)
Out of scope
- Serving on the board or audit committeeDirector independence
- Legal opinion on director-and-officer fiduciary dutyQualified counsel
- Running the governance program on an ongoing basisProgram
- Replacing your internal audit functionInternal audit firm
- Vendor selection for GRC toolingProgram
Inputs
What we need from you
Provided at kickoff. Missing inputs delay the Initiative and do not change scope.
- Current board package or committee charter if one exists
- Existing risk register (financial, operational, or technology) for reference format
- Recent technology incidents or near-misses to inform the register
- Three to five stakeholder interviews (board chair or audit chair, GC, CEO, CISO, optionally internal audit). Board-member calendars may drive the schedule.
Timeline
Week by week
Status updates throughout. A mid-point check confirms direction before the deliverable lands.
Week 1
Kickoff and stakeholder interviews
Scope confirmation, current-state document collection, and three to five structured interviews. Director availability may move some interviews into week 2.
Week 2
Risk register, framework, cadence
Technology risks expressed in financial-impact terms. Governance framework, reporting cadence, escalation paths drafted. Mid-point check with GC and audit committee chair.
Week 3
Deck, walkthrough, handoff
Board presentation built for 20 to 30 minutes of meeting time. Walkthrough with GC and audit committee chair. Final framework, register, and deck delivered.
Output
What you walk away with
- Written governance framework document
- Technology risk register in financial terms
- Management reporting cadence
- Board presentation deck
- Walkthrough with GC and audit committee chair
Limits
What this Initiative does not cover
This Initiative produces advisory documents. It is not legal advice, not director-and-officer fiduciary counsel, and not a replacement for your internal audit function. The framework references governance standards (NACD Director's Handbook on Cyber-Risk Oversight, COSO ERM, NIST CSF 2.0 Govern function) and aligns with the SEC 2023 cybersecurity disclosure rules where applicable. Adoption, ongoing operation, and disclosure language are your responsibility, with your counsel.
If you are a portfolio company
How the work calibrates to the PE-backed seat.
If your company is PE-backed, two things shape how the Initiative is timed.
- Board reporting cycle. Output is sized to land before the next quarterly board read.
- Exit window timing. Decisions made 12 to 24 months before exit can affect the bid. A documented oversight record is one item a buyer's diligence team may ask for.
Related
Initiatives that pair with this one
FAQ
Questions buyers ask first
What do the SEC cybersecurity rules require the board to disclose?
These rules apply to public companies. The annual 10-K must describe the board's oversight of cybersecurity risk. Where a committee is responsible, it must identify the committee and describe how it is informed. The 8-K rules require disclosure of material incidents within four business days of the materiality determination. Counsel decides whether specific wording meets the rule. The Board Technology Governance Initiative produces the governance framework, the committee charter, the reporting cadence, and a materiality determination process that supports the four-business-day clock. Counsel drafts the disclosure language.
How do I quantify IT risk in dollars for the board?
The board-ready format is annualized loss expectancy (ALE). ALE equals single loss expectancy (SLE) multiplied by annual rate of occurrence (ARO), with each number expressed as a range rather than a point estimate. SLE is grounded in asset value and exposure factor. ARO is grounded in industry incident data and your own history. The Initiative produces a first ALE estimate, with ranges, within its three weeks. After that, control decisions can be compared in dollars.
Are directors personally liable for a cyber failure under Caremark?
Pure cyber-failure Caremark claims have mostly lost at the pleading stage. The Delaware Court of Chancery dismissed the SolarWinds derivative suit in Construction Industry Laborers Pension Fund v. Bingle (Sept. 6, 2022) and the Marriott derivative suit in Firemen's Retirement System of St. Louis v. Sorenson (Oct. 5, 2021), both at the pleading stage. Outcomes depend on the facts, and this is not legal advice. Ask counsel about your board's exposure. The Board Technology Governance Initiative documents the oversight process: the committee charter, the reporting cadence, and a record of what the board received and asked.
What is the four-business-day rule for cyber incidents?
Once the company determines a cybersecurity incident is material, it has four business days to file Item 1.05 on Form 8-K. The clock starts at the materiality determination, not at incident detection, and the determination must happen without unreasonable delay. The Board Technology Governance Initiative includes the materiality determination process so the four-business-day window does not catch you unprepared. Counsel drafts the disclosure language.
For your role
Where this Initiative fits into the wider Preside view
Inside the broader program
When the Initiative becomes the standing engagement
This Initiative is a one-time fixed-price engagement. If it helps, the Technology Operating Partner Program can keep the risk register current and bring the board the same format each quarter, at one of four Program levels.
Ready to scope this
Three-week Board Technology Governance Initiative. Fixed scope.
Tell us your situation in a few lines. We reply within one business day to confirm the Initiative or suggest a better fit.
Not sure this is the right Initiative for your situation? Use the four-question Find Your Path tool for a personalized recommendation.