There's a conversation I seem to be having more often in boardrooms lately, particularly with not-for-profit organisations.

It usually starts with a fairly simple question about cybersecurity. How are we managing our risk? What protections do we have in place? What would happen if something went wrong?

Quite often, the response is, "Our IT provider looks after that."

I understand why that's the answer. Most not-for-profits don't have the resources or the need for an internal IT department, let alone a dedicated cybersecurity team. They rely on external providers to manage their systems, keep things running and provide technical advice.

Having spent more than a decade working in the managed IT industry, I know the value of having a good IT provider. I've been on that side of the table, advising organisations on their technology, security and the risks they face.

These days, sitting on the other side of the table as a director, I've found myself looking at that same relationship a little differently.

The issue isn't whether the IT provider is doing a good job. It's whether we, as directors, actually understand the risks we're relying on them to manage.

I think the response of "our IT provider looks after that" can become an easy way to close down a conversation that we really should be having.

Not deliberately, of course. I don't think directors are necessarily avoiding their responsibilities. More often, I think it's because cybersecurity feels technical, and when something feels outside our expertise, it's natural to defer to someone who knows more about it.

The trouble is that by doing so, we can leave ourselves poorly equipped to ask the questions that matter.

We wouldn't accept the same answer about our finances

One of the comparisons I often make is with financial governance.

Most boards have a treasurer. We engage accountants, bookkeepers and auditors. We rely on their expertise to help us understand and manage the financial affairs of the organisation.

But if someone asked about our financial sustainability and the response was simply, "Our accountant looks after that", I suspect there would be a few raised eyebrows around the table.

We expect directors to understand the financial position of the organisation. We review financial statements, question variances, discuss cash flow and consider whether we're operating sustainably.

Not every director has a financial background, nor should they need one. But we do expect them to understand enough to participate in the conversation and make informed decisions.

I've been wondering why we don't approach cybersecurity in much the same way.

A cyber incident can have a significant financial impact on an organisation. It can interrupt services, create regulatory obligations, damage relationships and undermine years of trust built with the community.

Yet we can be remarkably comfortable accepting assurances about cybersecurity without necessarily understanding what those assurances mean.

I don't think that's a technology problem. I think it's a governance problem.

Being informed doesn't mean being an expert

I recently read an article published by the Institute of Community Directors Australia, an organisation I'm a member of, featuring advice from experienced board director Alice Tay.

One of the points that resonated with me was the tendency for boards to defer cybersecurity and other technology matters to the one director with IT expertise, while everyone else disengages from the conversation.

It's something I've been conscious of in my own board roles.

I bring a technology background to the table, and naturally that means I can contribute a different perspective when these issues arise. But I don't want to be the only person asking questions about cybersecurity, any more than I would expect the treasurer to be the only person asking questions about our finances.

In fact, I think part of my responsibility as someone with that experience is to help make these conversations more accessible to the rest of the board.

The goal shouldn't be to have one person who understands cybersecurity. It should be to have a board that understands its cyber risk.

There's a difference.

I don't need every director to understand how a firewall works or how multifactor authentication is configured. I do want them to understand what could happen if our systems were compromised, what that would mean for the organisation and whether we're comfortable with the level of risk we're carrying.

That doesn't require technical expertise. It requires an understanding of the organisation, its responsibilities and the people it serves.

It also requires a willingness to ask questions, even when we're not entirely sure what the answer might be.

The people behind the risk

I think this is particularly important in the not-for-profit sector, where our conversations about risk should always come back to people.

It's easy to talk about cybersecurity in terms of systems, data, insurance and compliance. Those things are important, but they're not really why we're having the conversation.

Many of our organisations work with people experiencing some form of vulnerability. We might hold information about their health, disability, financial circumstances, family relationships or personal experiences.

People trust us with that information, often because sharing it is necessary for us to provide the support they need.

That trust carries a responsibility.

If someone's personal information is exposed, the consequences can go well beyond the inconvenience of changing a password or receiving a notification about a data breach.

If our systems are unavailable, the consequences might be felt by a support worker who can't access critical information, a family waiting for assistance or a person who relies on our organisation to provide an essential service.

When I think about cybersecurity from a governance perspective, those are the things I'm interested in understanding.

What could go wrong? Who would be affected? How significant could the impact be? What have we done to reduce that risk, and what would we do if it happened anyway?

Those questions feel far more relevant to the work of a board than whether we're using a particular piece of security software.

Our responsibility isn't simply to protect the organisation from financial loss or regulatory action. It's also to protect the people who have placed their trust in us.

Asking questions that actually matter

I think we need to become more deliberate about the questions we're asking of management and our IT providers.

When we're told that our backups are working, that's good to hear. But what I really want to understand is how quickly we could get back to delivering services if we lost access to our systems tomorrow.

When we're told that our systems are secure, I'd like to understand what risks remain. No organisation can eliminate cyber risk entirely, so what have we identified, what are we doing about it and what have we decided to accept?

If staff are completing cybersecurity training, I'd like to know whether that training is helping them recognise threats and respond appropriately. More importantly, do they feel comfortable speaking up when something goes wrong?

If we have cyber insurance, do we understand what it covers, what it doesn't and how it would help us respond to an incident?

None of these are particularly technical questions. They're the sort of questions we should be asking about any significant organisational risk.

I also think there's an important role for the way information is presented to boards.

A technical report full of statistics, acronyms and green status indicators might tell us that work is being done, but it doesn't necessarily help us understand our exposure.

As a director, I'm more interested in what has changed, what we're concerned about, what decisions have been made and whether anything needs our attention.

That's the information that helps us exercise oversight.

It's the same reason we don't simply receive a list of financial transactions at every board meeting. We receive reports that help us understand the financial position of the organisation and make decisions about its future.

Cyber risk reporting should serve much the same purpose.

Compliance is part of the picture

There's also the question of compliance.

Depending on the services an organisation provides, its size and the information it holds, there may be obligations under privacy legislation, sector-specific regulations, funding agreements or other contractual arrangements.

Some not-for-profits are subject to the Privacy Act and the Notifiable Data Breaches scheme. Others have additional requirements because of the nature of their services or the people they support.

As directors, we need to understand which obligations apply to our organisations and be satisfied that management has appropriate arrangements in place to meet them.

But I think good governance goes further than simply asking whether we're compliant.

We can have policies in place, complete annual reviews and engage reputable service providers, yet still have significant risks that haven't been properly considered.

Compliance is important, but it shouldn't be the only measure of whether we're doing the right thing.

Particularly in the community sector, where the impact of our decisions is so often felt by people who may have limited ability to protect themselves.

Making space for the conversation

Something I've come to appreciate through my governance experience is that good boards aren't necessarily made up of people who know everything.

They're made up of people who bring different experiences, perspectives and skills, and who are willing to use those things to make better decisions together.

I think we need to create more space for that when it comes to cybersecurity.

Directors should feel comfortable asking questions without worrying that they're going to sound uninformed. Those with technical expertise should be helping others understand the issues, rather than unintentionally becoming the only voice in the conversation.

Management and IT providers should be encouraged to explain risks in a way that makes sense to the people responsible for overseeing them.

For smaller not-for-profits, this doesn't need to mean another lengthy report or a standing agenda item that consumes half the meeting. It might start with a simple discussion about the information we hold, the systems we rely on and what would happen if those systems weren't available.

From there, we can begin to understand where our greatest risks sit and whether we're doing enough to manage them.

The point isn't to make governance more complicated. It's to make our decisions more informed.

The responsibility still sits with us

I have a lot of respect for good IT providers. I've worked alongside some excellent people in that industry, and I know how much organisations rely on their expertise.

This isn't an argument against outsourcing IT, or even outsourcing cybersecurity services.

It's about recognising that outsourcing the work doesn't mean outsourcing the responsibility to understand the risk.

As directors, we're entrusted with overseeing organisations that exist for a purpose. We make decisions about finances, strategy, services and the people who depend on those services.

Cyber risk belongs in those same conversations.

I want to see boards where directors feel as comfortable questioning their cyber risk exposure as they do questioning a financial report. Not because everyone has become a technology expert, but because we've made the effort to understand what the risks mean for our organisation.

The next time someone around the board table says, "Our IT provider looks after that", perhaps it's worth asking one more question.

"That's great. But what do we, as a board, actually understand about our cyber risk?"

It's not a question intended to undermine the provider or challenge someone's technical expertise.

It's an invitation for the whole board to be part of the conversation.

Because ultimately, good governance isn't about having all the answers. It's about understanding enough to ask the right questions, make informed decisions and act in the best interests of the people who rely on us.

I think we owe them that.

This insight was partly prompted by an article from the Institute of Community Directors Australia featuring advice from experienced director Alice Tay on the importance of collective board responsibility for cybersecurity. As a member of ICDA, I value the conversations and resources they bring to the not-for-profit governance sector.