…
Cybersecurity used to stop at the IT department door. That has changed. Regulatory bodies across North America and Europe now treat board oversight of cyber risk as a legal obligation, not a management preference. Directors who cannot document their engagement with cybersecurity face personal liability, regulatory scrutiny, and pressure from investors and insurers.
The stakes are concrete. IBM’s 2025 Cost of a Data Breach Report puts the global average cost of a breach at $4.44 million. Projected global cybercrime costs have reached $10.5 trillion in 2026 (Cybersecurity Ventures). Regulators are no longer waiting for organizations to act voluntarily. This guide covers what boards are now required to do, what the current threat landscape looks like, and how governance infrastructure supports the oversight function.
Key takeaways
- Cybersecurity is a fiduciary responsibility under current law in the US and EU
- SEC rules require public companies to disclose material incidents within four business days and describe board oversight in annual reports
- NIS2 and DORA require EU boards to approve cybersecurity programs, with personal liability for directors who fail to act
- The global average cost of a data breach reached $4.44 million in 2025 (IBM)
- AI-powered attacks and supply chain vulnerabilities are the fastest-growing threat categories
- 86% of Fortune 100 companies now seek cybersecurity expertise on the board or in leadership biographies (EY, 2025)
Why cybersecurity is now a board-level responsibility
The regulatory shift
The SEC’s 2023 cybersecurity disclosure rules require public companies to report material incidents via Form 8-K within four business days of determining materiality. Annual reports must also describe how the board oversees cybersecurity risk, including which committee holds that responsibility and how management reports cyber risks to the board.
In the EU, the NIS2 Directive requires boards to formally approve and oversee cybersecurity risk-management measures. Directors can be held personally liable for infringements. Regulators can suspend individual officers or directors until deficiencies are remedied. DORA, which entered full enforcement in January 2025, applies equivalent obligations specifically to financial entities, covering ICT risk management, incident reporting within defined timelines, and third-party oversight that is auditable at board level.
The financial and reputational stakes
An average breach costs $4.44 million. That figure covers detection, containment, regulatory fines, legal fees, and remediation. It does not fully account for the reputational damage that follows a public disclosure, particularly when the governance record shows the board was not engaged.
ISACA’s State of Cybersecurity 2025 found that 43% of organizations expect a significant cyberattack within the next year, and only 41% feel confident in their incident response. Boards that cannot demonstrate active oversight bear the governance consequences when an incident arrives.
Ensure your governance record is ready before regulators ask. Centralize board documentation, approvals, and audit trails in one secure environment. Request a Board Portal demo.
Core board responsibilities in cybersecurity governance
Setting and reviewing the risk appetite
The board’s role is strategic, not operational. It means defining how much cyber risk the organization can accept, approving budgets that reflect the actual risk profile, and verifying that management’s programs stay within agreed tolerances. Reporting to the board should be in business terms: exposure level, cost to mitigate, and progress made. Not raw technical data.
Building the CISO relationship
Boards benefit from direct, recurring interactions with the CISO rather than filtered reporting through the CEO. Best practice includes periodic deep-dive sessions and a clear escalation protocol so the board receives timely notification of significant incidents without requiring management discretion to trigger it.
The EY 2025 Cyber Disclosure Report found that 86% of Fortune 100 companies now seek cybersecurity expertise in board member biographies or skill matrices, up from 53% in 2019. Boards that lack that expertise need a structured way to fill the gap: committee composition, external advisors, or a director education program all work.
Supply chain and third-party risk
Attackers frequently enter through a vendor’s environment rather than attacking a target organization directly. NIS2 converts third-party cyber oversight into a legal obligation for EU organizations. Boards need to confirm that management has embedded security requirements in supplier contracts, conducts due diligence before onboarding new vendors, and monitors performance against agreed standards throughout each relationship.
ISACA’s State of Cybersecurity 2025 found that 43% of organizations believe they will face a significant attack within the next year. Many of those attacks will trace back to a third-party entry point.
Incident response oversight
Boards need to confirm that an incident response plan exists, has been tested recently, and assigns clear roles across every phase of a breach.
Before a breach:
- Defined escalation thresholds and communication frameworks
- Clear roles for board vs. management and a designated crisis lead
- Documented criteria for what constitutes a “material” incident requiring regulatory disclosure
During a breach:
- Secure communication channels that do not depend on the potentially compromised environment
- Direct access to legal counsel and crisis advisors without delay
- Board authorization protocols for decisions that may be required rapidly
After a breach:
- Post-incident board review with documented deliberation for the governance record
- Regulatory disclosure within the required timeframe (four business days under SEC rules; defined windows under NIS2 and DORA)
- Lesson-learned process that feeds back into governance and security improvements
For a detailed framework, see DiliTrust’s board crisis management guide.
Board governance documentation is the foundation of credible incident response. See how DiliTrust’s Board Portal keeps every decision timestamped and audit-ready.
Questions boards should ask management
Structured questions build the defensible record regulators expect to see. Organize them by theme.
Risk and posture
- What are our three most significant cyber risks right now, and how are we measuring them in business terms?
- Have there been incidents in the last 12 months that were not escalated to the board? What were the criteria for that decision?
- How does our security posture compare to peers in our sector?
Policy and investment
- Is the cybersecurity budget proportionate to our risk exposure, or is it based on last year’s spend?
- What percentage of staff completed cybersecurity training in the past year?
- How are we verifying the security posture of our critical technology vendors?
Governance and preparedness
- When did we last test the incident response plan, and what did we learn from it?
- What is the escalation protocol if a breach is discovered outside business hours?
- How do we ensure that AI tools used in board preparation do not expose sensitive materials to external systems?
What’s changing in 2026 and beyond
AI-powered attacks are raising the baseline
Threat actors are using AI to scale phishing campaigns, generate convincing impersonations, and identify vulnerabilities faster than traditional security tools can respond. EY found that 48% of Fortune 100 companies named AI risk oversight as a board-level priority in 2025, up from just 16% in 2024. For boards, this means understanding both the external threat and whether AI tools inside the organization are themselves creating new exposure. Prompt injection attacks and data poisoning have moved from theoretical risk to active threat categories.
EU regulatory enforcement is accelerating
NIS2 and DORA are now in active enforcement. Fines under NIS2 can reach €10 million or 2% of global annual turnover. Boards of organizations with EU operations need governance processes that can be demonstrated to a regulator on request. That includes documented board-level training on NIS2 obligations, evidence of cybersecurity program approval at board level, and audit-ready records of incident reviews.
For financial entities specifically, DORA compliance requires continuous ICT risk management, third-party oversight, and a recovery planning process with documented board accountability at every step.
Board composition is shifting
40% of Fortune 100 companies had a board-level committee dedicated to AI oversight in 2025, compared to 11% in 2024 (EY). Cyber and AI governance are converging at board level. The NACD’s 2026 Director’s Handbook on Cyber-Risk Oversight identifies six oversight principles for boards, covering risk integration, legal and disclosure obligations, board expertise structures, reporting cadence, incident oversight, and systemic resilience. Boards that treat cyber and AI as separate agendas are likely to find gaps at exactly the intersection regulators are watching most closely.
Practical resource: Download the Data Governance and Privacy: A Checklist for Boards for a structured framework your board can use to review its data protection posture.
How governance infrastructure supports cybersecurity oversight
The tools a board uses are not separate from the cybersecurity question. Board materials distributed by email create an uncontrolled document trail. Generic file-sharing platforms lack the access controls and audit capabilities that governance in regulated environments requires.
Purpose-built board governance platforms address specific risks that generic tools do not:
- Encrypted document distribution: Board packs, resolutions, and committee materials stay inside a controlled, access-logged environment rather than email inboxes
- Complete governance records: Every meeting, vote, and decision creates a timestamped, auditable record that can demonstrate active board oversight to regulators
- Closed AI processing: Where boards use AI for document summarization or minute generation, closed-platform AI ensures sensitive board materials are never routed through external systems
The DiliTrust Board Portal is certified to ISO 27001:2022 and ISO 27701:2019, with SOC 2 Type II compliance. Data is hosted by OVHcloud in the client’s chosen territory, with EU clients on servers in France and Canadian clients in Quebec. All AI processing through Lini, DiliTrust’s proprietary AI engine, takes place within DiliTrust’s own environment. No board data is shared with third-party AI models.
For organizations subject to NIS2 or DORA, DiliTrust’s security posture and jurisdiction-specific hosting are directly relevant to evidencing the controls those directives require. Full technical detail is available on DiliTrust’s security certifications page.
See how modern boards manage governance documentation, incident records, and secure communications in one place. Request a Board Portal demo
Frequently asked questions
Boards set the organization’s cyber risk appetite, oversee management’s security programs, ensure an incident response plan exists and has been tested, and maintain a documented record of their engagement with cyber risk. Under SEC rules, public company boards must describe their oversight role in annual reports. Under NIS2, EU boards must formally approve and oversee cybersecurity risk-management measures.
Since 2023, the SEC requires public companies to disclose material cybersecurity incidents via Form 8-K within four business days of determining materiality. Annual reports (Form 10-K) must describe how the board oversees cybersecurity risk, including which committee holds that responsibility and how management reports to the board.
NIS2 is an EU cybersecurity directive that requires boards to approve and oversee their organization’s cybersecurity risk-management programs. Directors can be held personally liable for compliance failures. Regulators can suspend individual officers or directors until deficiencies are resolved. The directive covers energy, transport, banking, digital infrastructure, and public administration, among other sectors.
Boards in regulated industries typically use a purpose-built board portal for document distribution, meeting management, and governance records. Key criteria are encryption standards (AES-256 at rest, TLS 1.2 or higher in transit), granular access controls, full audit trails, and hosting jurisdiction. Platforms certified to ISO 27001 and SOC 2 Type II provide the security baseline that regulated environments require. DiliTrust’s Board Portal meets each of these criteria, with sovereign hosting options for EU and Canadian organizations.
Through board minutes that reflect substantive discussion of cyber risk, regular CISO reporting to the board with documented board responses, a tested incident response plan with clear board-level escalation protocols, a designated committee owning cyber oversight, and a governance platform that generates timestamped, auditable records of decisions and communications. The documentation is the evidence.
DORA applies to financial entities operating in the EU. It requires boards to take direct accountability for ICT risk management, including resilience testing, incident reporting within defined timelines, and oversight of third-party technology providers. Boards must be able to produce governance records demonstrating that these obligations are actively managed, not delegated without oversight.
