The gap shows up in the data. In PwC's 2026 survey, 82% of directors rated the information they receive on AI outcomes, risk, and performance as fair, poor, or absent.
Information technology governance is the system through which the board and management set direction, assign authority, oversee risk, and judge whether technology creates lasting business value. This article covers board responsibilities, five governance domains, decision rights, board-ready reporting, and a 90-day path to stronger oversight.
Key Takeaways
- The board governs outcomes, risk appetite, and accountability. It does not run IT.
- Strong governance links investment, cyber, data, AI, vendors, and resilience to strategy.
- Clear decision rights, trend metrics, and escalation thresholds beat raw technical reports.
- The goal is oversight without noise: fewer surprises, faster escalation, defensible decisions.
Why IT Governance Is a Board Responsibility
Technology is no longer a back-office function. It sits behind business continuity, customer experience, financial performance, intellectual property, regulatory exposure, and reputation. When it fails, the whole enterprise feels it.
Oversight versus execution
The board sets expectations and challenges assumptions. The CEO and technology leaders design and run the strategy within approved limits.
Great boards don't try to run security. They set direction, define boundaries, and hold leaders accountable, while management executes and escalates when reality departs from the plan.
In practice, the board's core duties are to:
- Approve or oversee technology strategy
- Set risk appetite
- Confirm leadership and resources are adequate
- Monitor performance
- Hold management accountable for material weaknesses and missed outcomes
Oversight also covers upside. Modernization, data-driven growth, AI adoption, automation, and digital products are all board-level questions, not only the risk of getting them wrong.
What US rules and case law say
Requirements differ by company type, so separate them carefully.
Public companies. The SEC's 2023 cybersecurity final rule, effective September 5, 2023, requires:
- Annual disclosure of board oversight of cyber risk and how the board is informed (Regulation S-K Item 106)
- Form 8-K Item 1.05 disclosure of material incidents within four business days of the materiality determination, not discovery
A proposed requirement to disclose director cyber expertise was not adopted.
Sector and state rules. These apply by industry and jurisdiction, not just public or private status:
- FTC Safeguards Rule: a Qualified Individual reports to the board in writing at least annually, for covered financial institutions
- NYDFS Part 500: the senior governing body oversees cyber risk for covered entities
- HIPAA Security Rule: applies to covered entities and business associates
- State laws such as California's breach-notice statute
Fiduciary duty. Delaware's Caremark line of cases addresses bad-faith failure to set up reporting systems or to monitor them. Marchand v. Barnhill (2019) let a claim proceed where the board allegedly had no reporting process for a mission-critical risk. Liability does not follow merely because a risk materializes.
Have counsel confirm which obligations apply to your organization.
The Five Main Domains of IT Governance
The five-domain model comes from the IT Governance Institute's board briefing, documented in ISACA's journal. COBIT, NIST, ISO 38500, and NACD use different terms, so treat the five domains as a practical organizing frame.
Strategic alignment
Test whether the technology roadmap supports business strategy, customer commitments, the operating model, and competitive position. Each business goal should map to a measurable technology outcome and a named executive owner, not "IT" as a group. "Grow enterprise revenue," for example, might map to cutting security-questionnaire cycle time from 15 days to 5.
Value delivery and investment oversight
Every major investment, whether modernization, AI, or technical-debt cleanup, needs a value hypothesis, owner, milestones, dependencies, and outcome measures. Ask what the board will see in two quarters. If a leader can't show progress over that span, the initiative isn't really a priority.
Risk management and resilience
Treat technology risk as part of enterprise risk management. That covers:
- Cybersecurity, privacy, and data misuse
- Third-party and supply-chain exposure
- Business continuity, disaster recovery, and incident response
- Cloud and emerging-technology risk, including AI
Dependencies matter. Verizon's 2026 data breach report found third parties involved in 48% of breaches, a global figure rather than a US-only one.
Resource management
Directors should ask whether the organization has the people, leadership capacity, architecture, vendors, data assets, budget, and skills to deliver the strategy. A funded plan with no one qualified to run it is a risk in itself.
Performance measurement and assurance
Monitor outcomes, control effectiveness, delivery milestones, service resilience, risk trends, and remediation progress. Don't rely only on management's word. Use internal audit or other independent evidence, as the IIA's Three Lines Model separates management's responsibility from independent assurance.
Building a Board-Ready IT Governance Operating Model
Decision rights
Spell out who approves, who is notified, who escalates, and who executes.
| Role | Primary responsibility |
|---|---|
| Full board | Outcomes, material risk, major tradeoffs, appetite |
| Audit or risk committee | Controls, incidents, compliance posture |
| Technology committee (if any) | Strategy, architecture choices, delivery health, vendor strategy |
| CEO | Owns the strategy and is accountable for execution |
| CIO and CISO | Run technology and security programs; report and escalate |
| General counsel | Disclosure, legal exposure, privilege |
| Business-unit leaders | Own business outcomes and risk acceptance in their area |
Escalation thresholds
Dollar value alone is a weak trigger. A one-page appetite statement should also tie materiality to:
- Customer harm and trust
- Critical operations and downtime
- Sensitive data and regulatory duties
- Reputation and strategic direction
A one-page escalation ladder then says who notifies whom, how fast, and what the first update contains. Incident updates should follow pre-set triggers, not whoever is loudest in the room.
A stable reporting rhythm
Use a monthly one-page dashboard for trends and quarterly deep dives on one or two themes, such as cloud migration or vendor concentration. NACD's 2026 handbook suggests reporting at least quarterly, and immediately after material incidents.
The dashboard should show:
- What changed since last time
- Current exposure and trend direction
- Accountable owners and overdue actions
- Strategic outcomes and decisions required
Skip raw technical metrics without business context. "Time to revoke access" and "backup recovery time" mean something to directors when tied to a service and a target.
Questions directors can ask
- Which three technology assumptions would break our strategy if wrong?
- Where is AI touching customers, pricing, or decisions, and who approved it?
- Which vendors could stop a business service or expose sensitive data?
- What technical debt are we carrying, and what does it cost us each quarter?
- If ransomware hit tomorrow, what happens in the first hour?
- Do we have the talent to deliver the transformation plan, and what happens if its assumptions fail?
Crisis readiness
Governance is tested in an incident. Build readiness around:
- Defined notification paths
- Direct director access to key executives and advisors
- Secure board communications
- Tabletop exercises with directors in the room
- After-action reviews and records that show active oversight
A Practical 90-Day Roadmap for Strengthening Board Technology Governance
Day ranges here are a planning structure, not a regulatory deadline.
Days 0–30: Inventory and listen
- List critical systems, data, dependencies, active transformation programs, and major vendors
- Review current committees, reports, and decision rights
- Interview directors and executives to find where information is unclear
- Document the biggest gaps and recent surprises
NIST CSF 2.0 supports this step through its asset inventory and critical-service identification practices.
Days 31–60: Agree on the rules
- Confirm the governance domains and committee responsibilities
- Set risk appetite and escalation criteria, such as maximum downtime, data-loss window, and fraud loss per period
- Agree on the reporting cadence and a concise dashboard linking technology to business outcomes
- Prioritize board education, including AI
Days 61–90: Test and assign
- Run the first structured board review
- Assign an owner and due date to each material gap
- Walk through one escalation or incident scenario
- Set follow-up dates and measurable outcomes
Boards that need extra capacity can bring in outside help. Tyson Martin works with boards and executive teams as a board advisor, and as an interim or fractional CISO during transitions.
Frequently Asked Questions
What is the difference between a CIO and a director of information technology?
Titles vary, but a CIO typically holds the broader, strategy-focused executive role. An IT director often manages operations and may report to the CIO. Both are management roles, distinct from a board director with technology expertise.
What are the five main domains of IT governance?
The five main domains are strategic alignment, value delivery, risk management and resilience, resource management, and performance measurement and assurance. Terminology differs across COBIT, ISO, and NIST.
Who is higher, the CEO or the board of directors?
The board oversees the company and appoints and evaluates the CEO. The CEO leads day-to-day management. Clearly defined authority matters more than informal hierarchy.
What is IT governance at the board level?
It is oversight of technology strategy, risk, investment, accountability, resilience, and outcomes. It is not operational control of systems or technical teams.
How often should a board review information technology governance?
Boards should review reporting at least quarterly and evaluate the governance structure at least annually, adjusting for risk, regulatory exposure, and transformation activity. Material incidents go to the board immediately, outside the regular cycle.
