Technology is on most board agendas. At many boards it is not governed like finance or audit.
Boards oversee finance, audit, compensation, and legal through standing committees. Technology usually has no such structure. The SEC's 2023 rules (Item 106 of Regulation S-K and Item 1.05 of Form 8-K) require public companies to disclose how the board oversees cybersecurity risk and to report material incidents within four business days of determining materiality. Directors of Delaware corporations have a fiduciary duty of good-faith oversight of mission-critical risks. Courts treat that standard as demanding for plaintiffs, and the outcome depends on the facts. A board that can show what it received, asked, and did is in a stronger position.
Where you sit today
What a director sees today.
Three situations a director may recognize.
You rely on management's assurance
Without a separate source, the board has only management's account of technology risk before something happens. Management updates are an input to oversight, not a substitute for it.
Technology is on the agenda and owned by no committee
Audit committee governs audit. Finance committee governs finance. Technology gets a slide and a head-nod, then moves on.
The record matters, not just the outcome
After a material incident, regulators and plaintiffs ask what the board received, asked, and did. A board should be able to show that record.
What changes with Preside
Three changes to technology oversight.
A risk register in dollars
Annualized loss expectancy for each material technology risk where data allows. The same units finance uses. Written so that auditors and acquirers can follow it. For cyber, the Cyber Risk Review is a shorter starting point.
Quarterly board reporting that holds up
Same format every quarter. Risk in dollars. Spend trajectory. Control posture against your applicable framework. One page the board can use.
A third-party view alongside management’s report
This assessment is produced separately from the team responsible for the condition assessed. It is not an audit, a certification, or a regulatory approval, and Preside also sells ongoing advisory work through the Technology Operating Partner Program. Regulators, insurers, and acquirers may find an assessment produced this way more useful than management self-report.
A sample report
Example: the quarterly board risk page
A single page produced on the same cadence as the financial report. Same format every quarter so the trend is visible. Same units finance uses so the conversation works.
Quarter ending Q3
Example: technology risk and oversight summary
Annualized loss expectancy
$3.6M to $6.0M
Midpoint $4.8M, down $1.1M vs Q2
Top driver: ransomware exposure on legacy identity infrastructure. Remediation track on schedule.
Control posture vs framework
68%
Up 4 points vs Q2
Share of assessed NIST CSF 2.0 subcategories rated implemented. 3 subcategories moved from "partial" to "implemented" this quarter.
Material vendor exposure
11 vendors
2 elevated
2 vendors flagged for renewal review on data-handling and concentration risk. Decisions due in Q4.
Active projects at risk
2 of 7
One fewer than Q2
Atlas project return to date is below the original case. Decision required: continue, restructure, or stop.
Regulatory anchors
Rules that may bear on board oversight of technology
Cyber and technology oversight now draws on several rules and frameworks. The anchors below are examples. Not all apply to every company.
-
SEC Item 106 of Regulation S-K (Dec 2023)
Public companies disclose, in the 10-K, board oversight processes for cybersecurity risk and report material incidents within four business days under Item 1.05 of Form 8-K.
Relevant to: registrants and acquirers of registrants. Source: SEC press release 2023-139.
-
NYDFS 23 NYCRR Part 500 (Second Amendment, phased through Nov 2025)
The board or senior governing body must have sufficient understanding of cybersecurity to exercise oversight, require management to maintain the program, and review the annual CISO program report.
Relevant to: NY-regulated financial services. Source: NYDFS cybersecurity guidance.
-
FFIEC IT Examination Handbook (Architecture, Infrastructure, and Operations booklet)
Board approves IT strategy aligned to risk appetite, receives regular Architecture, Infrastructure, and Operations governance reports, and is educated to review performance.
Relevant to: OCC, Fed, and FDIC-supervised institutions. Source: FFIEC IT Handbook.
-
HHS OCR HIPAA Security Rule update (NPRM Dec 2024)
Raises governance expectations: 12-month asset inventory and network map refresh, annual incident-response plan testing, annual verification of business-associate safeguards.
Relevant to: HIPAA-covered entities. Source: HHS HIPAA Security Rule NPRM.
-
California CCPA cybersecurity audit and risk-assessment regulations (effective Jan 2026; first audit covers 2027)
Larger businesses must complete an annual independent cybersecurity audit covering 18 prescribed control areas, plus documented risk assessments, attested at the executive level.
Relevant to: larger California-touching businesses. Source: California Privacy Protection Agency.
-
NERC CIP standards (CIP-002 through CIP-015, including INSM)
Board-overseen programs for asset identification, supply-chain risk, configuration change management, internal network security monitoring, and incident reporting to FERC and NERC Regional Entities.
Relevant to: electric utilities and connected entities. Source: NERC reliability standards.
-
SEC Reg S-P amendments (adopted May 2024; large-adviser compliance Dec 2025; smaller advisers Jun 2026)
Registered investment advisers and funds must maintain a written incident-response program, notify affected customers, oversee service providers, and keep expanded records.
Relevant to: registered investment advisers and funds. Source: Proskauer alert.
-
Delaware Caremark fiduciary doctrine
Directors of Delaware corporations must make a good-faith effort to put a board-level information-and-reporting system in place for mission-critical risks and to monitor it. Cybersecurity claims under this doctrine have mostly lost at the pleading stage, and outcomes depend on the facts.
Relevant to: Delaware-incorporated companies. Source: Harvard Law CorpGov Forum.
-
D&O underwriting questions
Insurers increasingly ask for evidence of specific controls at underwriting and renewal. Requirements vary by carrier and policy.
Relevant to: boards carrying D&O coverage. Sources: Moody's D&O analysis, WTW 2025 D&O outlook.
-
NACD-ISA Director's Handbook on Cyber-Risk Oversight (5th edition)
Not a regulation. A director guide with six principles plus fifteen tools, including cyber-risk quantification in dollars.
Relevant to: every board. Source: NACD Director's Handbook.
Example: the full quarterly view
Example: the one-page Quarterly Technology View
A sample Quarterly Technology View is linked below. It covers six dimensions of technology performance on one page, sized for about five minutes of board time. It draws on TBM Council Taxonomy v4, NIST CSF 2.0, NIST AI RMF, SEC Item 106, and the calibrated-estimate method in Hubbard and Seiersen's How to Measure Anything in Cybersecurity Risk. The figures are invented for illustration. They are not client data. It includes a methodology appendix and a defensibility ledger.
Your recommended Initiative
Three-week Board Technology Governance Initiative
The deliverable
A governance framework, a risk register in dollars, a reporting cadence, and a board deck, ready for your next board or audit committee meeting.
See the Board Technology Governance Initiative →Our view
Boards govern finance, audit, compensation, and legal with a fixed structure. Technology often gets a slide instead. The gap matters more than it did five years ago, because disclosure rules and expectations of director oversight have grown. More management reporting will not close the gap. Oversight with the structure boards already apply elsewhere will, produced separately from the team being assessed.
What directors ask first
The four questions directors ask in committee.
How is this different from the CISO report management already gives us?
Management reports on its own posture. That report is a starting point. This assessment is produced separately from the team responsible for the conditions under review, in the format and units the board can act on.
Won't this duplicate or undermine management?
It adds an oversight view on top of management's reporting. Management still runs the function. We turn that operation into the oversight format the board needs. The result makes the team's work readable to the people funding it.
What if there is no incident? Is the report still useful?
The same record can answer a diligence question when an acquirer asks, support accuracy in cyber-insurance applications, and show what the board reviewed if a regulator asks. Its value does not depend on an incident.
Who receives this, the full board or the audit committee?
Either or both. Many companies route technology governance through the audit committee with a quarterly summary to the full board. The format works for either cadence and is sized to fit inside a normal committee packet.
Start with the Board Technology Governance Initiative. Three weeks, fixed scope.
A governance framework, a risk register, a reporting cadence, and a board deck for review at your next audit-committee meeting. If it helps, the Technology Operating Partner Program continues the work.