10 Questions Board Members Should Be Asking About Security and Compliance

Major security incidents can quickly affect enterprise value, operational continuity, regulatory standing, and reputation.

As organizations become more dependent on connected infrastructure, cloud services, AI, and third parties, weaknesses in one part of the ecosystem can cascade across the business.

A Board is not expected to make technical decisions. Its role is to exercise informed oversight: set expectations, test whether accountability is clear, require evidence of resilience, and ensure that management integrates security and compliance into strategy, investment, operations, and crisis preparedness.

The following questions are designed for a Board of Directors and its relevant committees. They broaden the original cybersecurity focus to include compliance, privacy, data governance, third-party assurance, regulatory change, and demonstrable control effectiveness. 

1. Are security and compliance roles, decision rights, and escalation paths clearly defined?

Treating security or compliance as an isolated specialist function weakens governance. Accountability should extend across executive leadership, business operations, technology, legal, risk, privacy, internal audit, and the security organization. The Board should understand who owns material risks, what is the risk appetite who can accept them, and how significant incidents, control failures, vulnerabilities, or regulatory concerns reach the appropriate committee or full Board.

Evidence to request:

• Does the security and compliance leadership team have direct access to executive management and the Board?
• Are material risks escalated before they materialize into active incidents?
• Do responsibilities cover prevention, detection, response, recovery, regulatory obligations, and assurance?

2. Are security and compliance built into strategy, investment, and transformation decisions?

Security and compliance should shape strategic choices from the beginning, not be added after commitments have been made. Major investments, cloud programs, acquisitions, new products, AI initiatives, and supplier selections should be assessed alongside security and compliance considerations. Early involvement helps identify structural risk while decisions are still practical to change. 

Evidence to request:

• Which strategic decisions require a documented security and compliance review?
• What risks or control requirements influenced the final decision?
• Are funding and accountability aligned with the risk created by the initiative?

3. Do we have a transparent, decision-ready view of security and compliance risk?

Boards need more than technical activity reports. Management should translate important threats, vulnerabilities, control gaps, legal obligations, and business dependencies into clear enterprise risk scenarios. Reporting should show potential operational, financial, legal, and reputational consequences, as well as the residual risk that remains after controls are applied. 

Evidence to request:

• Which scenarios could materially affect our strategic objectives?
• How are likelihood, business impact, and control effectiveness assessed?
• What residual risks have been accepted, by whom, and for how long? 

4. Is our compliance strategy prepared for regulatory change?

Compliance should be managed as a continuing capability rather than a periodic response to individual requirements. The Board should assess whether regulatory developments are monitored, interpreted consistently, assigned to accountable owners, and translated into controls, technology roadmaps, evidence, and reporting. This includes requirements affecting security, privacy, data sovereignty, operational resilience, AI, and third-party services. 

Evidence to request: 

• Which emerging requirements could materially affect the business?
• How quickly can new obligations be translated into operational controls? 
• Can management demonstrate compliance consistently across regions, business units, and technology environments?

5. Are legacy systems and technical debt creating unacceptable security or compliance exposure?

Systems that are no longer fully supported can accumulate security weaknesses, limit monitoring, complicate recovery, and make compliance evidence harder to produce. The Board should view aging critical systems as an enterprise risk and investment issue, not just an IT lifecycle matter. Where modernization is delayed, management should document compensating controls, ownership, and a time-bound plan. 

Evidence to request: 

• Which critical systems are out of support or approaching end of support?
• What business processes and regulatory obligations depend on them?
• What is the modernization plan and how is interim risk independently validated?

6. Are AI security, compliance, and governance embedded in the operating model?

AI introduces security, legal, privacy, data, ethical, and operational questions that require coordinated governance. Whether AI is developed internally or obtained from a third party, management should know what data it can access, how outputs are used, which decisions remain subject to human review, and how systems are tested and monitored as they change.

Evidence to request:

• Who is accountable for approving and monitoring AI use cases?
• What controls protect sensitive data and prevent unauthorized use?
• How are legal, ethical, security, compliance, and human-rights considerations evaluated and evidenced?

7. Are identity and access management strong enough for our risk profile? 

Compromised credentials and excessive access can allow attackers or insiders to reach critical systems and data. Identity and access management should be treated as a business control, not simply an administrative technology process. Strong governance connects employee, contractor, third-party, and system identities to reliable business records and removes access when it is no longer required. 

Evidence to request: 

• Are strong authentication and least-privilege access applied to critical systems?
• How quickly is access changed when roles, employment, or supplier relationships change?
• Are privileged and non-human identities monitored, reviewed, and time-limited where appropriate? 

8. Does our culture measurably reduce human and conduct risk?

Policies and technical controls depend on people making sound decisions. A mature program goes beyond annual training by addressing role-specific exposure, leadership behavior, phishing and social engineering, secure ways of working, speak-up channels, and consequences for repeated noncompliance. The Board should seek measurable evidence that behavior and risk are improving. 

Evidence to request: 

• Which roles face the highest security and compliance exposure?
• What do simulations, incidents, training results, and behavioral indicators show over time?
• How visibly do leaders reinforce expected behavior and accountability?

9. Are third-party and supply-chain risks continuously assessed and governed? 

Security and compliance obligations do not stop at the enterprise boundary. Critical suppliers, cloud providers, software dependencies, advisers, and other partners can create operational, regulatory, data, concentration, and geopolitical exposure. Third-party risk should be integrated into enterprise risk management and monitored throughout the relationship, not treated as a one-time procurement exercise. 

Evidence to request: 

• Which third parties are critical to operations, data, or regulatory obligations?
• What independent evidence supports their security, compliance, and resilience claims?
• How are concentration, subcontractor, geographic, and exit risks managed? 

10. Are we prepared to detect, contain, disclose, and recover from a major incident? 

Prevention alone is not enough. The Board should understand whether the organization can identify significant events early, contain their impact, make timely legal and regulatory decisions, communicate credibly, restore priority services, and learn from the event. Readiness should cover ransomware, account takeover, data compromise, fraud, third-party disruption, and other plausible business scenarios. 

Evidence to request: 

• When were crisis, incident response, business continuity, and recovery plans last exercised together?
• Are decision rights clear for regulatory disclosure, law enforcement, ransom demands, customer communication, and service restoration?
• What gaps were found in recent exercises or incidents, and are remediation actions closed?

From reactive oversight to demonstrable resilience 

These 10 questions help a Board move the discussion from technical activity to governance, accountability, evidence, and business outcomes. Effective oversight requires an ongoing dialogue with management, constructive challenge of assumptions, and decisions that reflect the organization’s risk profile, regulatory obligations, and digital maturity.

Modernization can be an important governance lever when it improves standardization, transparency, control automation, resilience, and the ability to produce reliable compliance evidence. Responsibility, however, remains shared across leaders, business owners, technology teams, security, compliance, legal, risk, audit, employees, and critical partners. 

Board takeaway

Security and compliance are not separate from business strategy. They are essential to continuity, lawful operation, stakeholder trust, and long-term value protection. 

Marielle Ehrmann is chief security officer and a member of the Supervisory Board of SAP SE.

Note: This piece has been adapted from the German article “Cybersicherheit – Zehn Leitfragen für den Aufsichtsrat” by original authors Dr. Friederike Rotsch and Sebastian Lange alongside Marielle Ehrmann.