Boards often encounter security through separate channels: cybersecurity, physical security, export controls, supply chain risk, and regulatory compliance. Each element has a responsible function, but an organization may lack a coherent enterprise view of security. Security should not be managed as a collection of disconnected technical and compliance functions. Leadership should treat security as an integrated management system spanning organizational activities, business processes, risk management, and external dependencies. In that sense, security is an enterprise risk tied to strategic decision-making, organizational value, and resilience.

The purpose of security management is the creation and the protection of value. Leadership at all levels should align organizational strategies, processes, policies, and resources to achieve the organization's security objectives. The board does not need to operate security programs. It does need enough visibility and structure to determine whether material security risks are being identified, assigned, resourced, monitored, and corrected.

Governance vs. Operations

The core distinction between the board and the executives is who owns which part of the organization's security management. Governance concerns direction, oversight, accountability, and the organization's long-term interests. Operations concern execution: translating that direction into procedures, controls, responsibilities, and workflows embedded in the day-to-day functioning of the organization.

A useful starting point is to distinguish between what questions and how questions. The board should principally establish and oversee what the organization expects security management to accomplish. Executives determine how those expectations are translated into systems, controls, personnel, and operating processes. Then, it is the purview of the security and functional teams to execute that direction, monitor performance, and respond to incidents.

The board owns what:

The executives own how:

Governance Questions the Board Should Be Asking

Integrated Security Management Concept

An integrated security management system provides a useful framework for thinking about organizational security as a combined management function rather than a collection of separate security disciplines. It gives each security function a common framework for assessing, assigning ownership of, and reporting security risk.

Security management should be integrated into organizational activity rather than treated as a stand-alone function. An organization needs to understand the internal and external conditions affecting security, identify relevant stakeholders and requirements, and determine which of those requirements must be addressed through the security management system.

If security management is not integrated, functional silos can develop. Cybersecurity, personnel security, legal compliance, protection of classified information, supply-chain risk, and physical security may each be competently managed within their respective functions while significant risks remain invisible at the enterprise level.

Silos may include:

These divisions of responsibility are not inherently problematic. In fact, specialized ownership is necessary. The governance problem arises when each function assesses and reports risk independently, without a common framework for determining how those risks interact, who owns cross-functional exposure, and what information must reach senior leadership.

Leadership should integrate security into business processes and require executives to ensure that security programs originating elsewhere in the organization complement the overall security management system.

In organizations with a Chief Security Officer, the CSO can serve as the senior executive responsible for integrating the security management system across functional boundaries. The CSO should not replace the responsibilities of the CISO, FSO, general counsel, human resources, procurement, facilities, or other functional leaders. Instead, the CSO provides the enterprise-level view: ensuring that security risks are assessed consistently, cross-functional dependencies are understood, material issues are escalated, and security performance is reported to executive management and the board.

In this model, functional leaders remain responsible for operating security within their respective domains, while the CSO is responsible for ensuring those functions operate as parts of a coherent security management system. Where there is no CSO, the board should confirm that a named executive holds this integrating role.

The Legal Dimension of Security Oversight

Where board duties end and executive duties begin is also a legal question. Under Delaware's Caremark doctrine, directors breach their duty of loyalty if they make no good-faith effort to set up a board-level reporting system, or if they ignore red flags that the system brings to them. Marchand v. Barnhill (2019) and In re Boeing (2021) made clear that when a risk is "mission critical," the board must oversee it directly. For companies built on sensitive technology, government contracts, or cleared facilities, security risk will likely meet that standard. The duty doesn't stop at the board, either. In re McDonald's (2023) extended a similar oversight duty to officers within their own areas. Federal regulators have turned these expectations into specific requirements. The Securities and Exchange Commission's (SEC) 2023 cybersecurity rules require public companies to disclose how the board and management oversee cyber risk, and to report material incidents on Form 8-K within four business days of determining they are material. Per the National Industrial Security Program Operating Manual, cleared contractors must name a senior management official accountable for the security program. An integrated oversight structure is therefore more than good practice. It is the record that regulators, customers, and plaintiffs will examine after an incident.

Staying private doesn't reduce a board's duties: directors of a private Delaware company owe the same Caremark oversight duty as public-company directors. What differs is where the pressure comes from. For startups, the pressure usually comes from investors, acquirers, regulators, and customers rather than shareholder suits. On the deal side, a breach that contradicts the data-security representations made in a financing or acquisition can lead to indemnification claims or a failed deal.

Case Study: Drizly and Executive Accountability

In 2023, the FTC finalized an order against alcohol-delivery startup Drizly following a data breach that exposed information belonging to approximately 2.5 million consumers. The order went beyond the company itself and imposed obligations directly on the CEO. Under the order, the Drizly CEO must implement specified information-security measures at any future company he leads if that company collects consumer information from more than 25,000 individuals. Those obligations follow him for ten years.

Defense contractors face another layer of exposure. They must meet Defense Federal Acquisition Regulation Supplement (DFARS) and Cybersecurity Maturity Model Certification (CMMC) requirements, and the Department of War uses the False Claims Act against companies that misstate their compliance.

None of this calls for an elaborate program. A standing board security update, a clear owner in management, and a written incident-response plan are usually enough to show that the board identified and addressed the risks. That same structure also protects the company's ability to raise money, sell itself, and win contracts.

Conclusion

The board is not expected to know everything occurring inside a complex organization. Good governance is intended to ensure that it is not structurally prevented from knowing what matters. For companies whose value depends on sensitive technology, government relationships, specialized personnel, and complicated supply chains, that requires a security oversight system capable of bringing the right information to the board before a security problem becomes an enterprise crisis.

Citations