Supervisory Board Member — Digital and Cyber

Supervisory responsibility

Challenge the digital strategy, cyber-risk assessment and prioritisation of investment. Ask whether essential service dependencies are mapped, recovery assumptions have been exercised and unresolved vulnerabilities receive proportionate attention. Review how executive management obtains assurance over outsourced systems and access to sensitive information.

Questions for the executive team

Which services can continue during a prolonged outage? Have recovery tests included frontline workflows and data reconciliation? Who can authorise a service restriction when technology risk becomes unacceptable? The member should seek evidence and clear ownership rather than technical reassurance alone.

The board should receive an account of recovery evidence that includes clinical and administrative dependencies, not only technical restoration. A system may restart while records require reconciliation or staff cannot safely resume the normal workflow. The member should ask how management establishes readiness to return to service and who makes that decision. Review whether supplier assurances have been independently tested and whether investment proposals address the most consequential gaps rather than the most visible technology weaknesses.

Qualified candidates

Candidates should bring senior technology, cybersecurity or digital-governance experience with an understanding of healthcare operations. Supervisory or board experience is valuable, particularly where safety, public trust and financial constraints intersect. They must be able to translate technical uncertainty into decisions the full board can evaluate.

Independence and practical contribution

Current executive roles, supplier relationships and other appointments should be screened for conflicts and sufficient availability. The member oversees and challenges; executives retain operational incident command and delivery responsibility. Effective service will improve the board’s understanding of residual risk, investment choices and the evidence supporting claims of resilience.