Non-Executive Director — Technology and Cyber Risk

Oversight responsibilities

Challenge the technology-risk framework, investment priorities and the quality of assurance over critical systems. Examine how management identifies dependencies between operational assets, communications, data and external providers. Review recovery planning with attention to safe service restoration and the practical limits of testing.

The director should ask how management decides which systems can be updated routinely and which require engineering review, controlled testing or an alternative mitigation. Review the evidence supporting isolation, remote access and supplier maintenance arrangements. A risk decision should state the service consequences of both action and delay. The board needs a coherent view of legacy exposure and planned remediation, with exceptions revisited as circumstances change rather than accepted indefinitely because replacement is complex.

Board decisions to improve

Help the board evaluate risk acceptance, remediation sequencing and major supplier commitments. Ask whether apparently low-cost deferrals increase exposure or make future change harder. Ensure incident reporting explains service impact, decision options and residual uncertainty rather than presenting technical indicators without context.

Candidate qualifications

Candidates should have substantial technology, cyber-risk or infrastructure-governance experience. They need familiarity with environments where service continuity constrains change and where engineering and IT teams must work together. Financial literacy and the ability to challenge specialist assurance are essential.

Professional boundaries

The director provides oversight and judgement rather than directing technical incident response. Current executive responsibilities, advisory work and vendor relationships should be reviewed for conflicts. Candidates should discuss a decision where improving one aspect of security could have weakened availability, and explain how the trade-off was evaluated and governed.