There is a comfortable version of security governance that many boards have already adopted. Name an executive to own the risk. Add cyber to the audit committee agenda. Report annually. Job done.
By Hendrik Kruger, chief technology officer (CTO) and CISO, Cloud On Demand
It is not done. Naming an owner is where governance starts, not where it ends. The organisations that build real cyber resilience are not the ones with the biggest security budgets. They are the ones where a junior account manager, an intern, a warehouse supervisor and the chief executive all answer the same question: what is my role in reducing risk today.
Security stopped being an annual compliance exercise some time ago. It is not something a business does once a year for an ISO 27001 assessor or a POPIA review. It is a decision made hundreds of times a day: where a file gets saved, whether an unusual request gets questioned, whether a password gets reused for convenience. Technology can catch some of those decisions after the fact. It cannot make them well in the moment. Only a person can do that.
Leadership and accountability are not the same problem. Leadership sets direction and makes accountability visible. It sits with whoever is actually making the decision, not the executive who signed off the policy. A phishing email that lands in one inbox tests one person’s judgement, not the security stack. In an incident we triaged recently, it stayed contained because the person who received it paused, questioned it and reported it. Nothing on our technology roadmap did that. A decision did.
That does not let leadership off the hook. It means keeping cyber risk in the same rooms as revenue, continuity and reputational exposure, reinforced until it becomes instinct. In South Africa, POPIA’s notification obligations mean a governance gap does not stay private for long.
Escalation is where accountability most often breaks down quietly. Does everyone know who owns a security decision, who it gets escalated to and who accepts the residual risk? Most organisations only discover the answer during an incident, at the worst possible time. The ones that contain incidents well rehearsed the answer in advance.
None of this means security should default to no. A function that only blocks requests stops being consulted, and loses influence when it matters most. The better test is whether a risk gets explained on its merits, with a workable alternative offered. I have turned down tools on data-sovereignty and POPIA grounds more than once. What mattered was not the no. It was showing the reasoning and giving the business another way forward.
Technology decides what an attacker can attempt. Accountability, held by everyone rather than filed under one executive’s name, decides what your organisation actually does about it. That is the part you fully control, and it is worth building governance around that fact rather than a title on an org chart.
A practical next step
Frameworks and policy documents are easy to write. Rehearsing them with the people who would make the call during an incident is harder. Cloud On Demand distributes BlueVision’s Fusion Cloud, pairing continuous attack-surface monitoring with managed detection and response, so escalation does not depend on someone happening to notice in time. Visit www.cloudondemand.co.za or email info@cloudondemand.co.za to learn more.
