Cyber risk and governance: Why board oversight matters more than ever

For many years, cybersecurity was viewed primarily as a technical matter delegated to IT departments and security teams. Today, that perspective is no longer tenable.

Across Malta and the wider European Union, regulators have made it increasingly clear that cyber risk is a business risk, requiring active oversight from boards and senior management rather than passive reliance on operational teams.

The emergence of regulatory frameworks such as the Digital Operational Resilience Act (DORA), the NIS2 Directive and the Cyber Resilience Act (CRA), together with sector-specific requirements such as those imposed by the Malta Gaming Authority (MGA), reflects a common theme: accountability for cyber resilience begins at the top.

Boards are increasingly expected to understand cyber risk, challenge management, allocate appropriate resources and ensure that security objectives are aligned with the organisation’s strategic goals.

Under NIS2, management bodies are explicitly responsible for approving cybersecurity risk management measures and overseeing their implementation. The Directive reinforces the principle that while operational activities can be delegated, accountability remains with management. Members of management bodies are also expected to have sufficient knowledge to understand cyber risks and assess cybersecurity risk management practices.

A similar approach is evident under DORA, which applies to financial entities and places responsibility for ICT risk management on the management body. Boards are expected to define and oversee the implementation of the organisation’s ICT risk management framework and ensure that digital operational resilience receives appropriate governance attention.

The Malta Financial Services Authority (MFSA) also treats ICT risk and cybersecurity as a cross-sectoral supervisory priority and considers digital operational resilience from the authorisation stage. Financial services entities applying for authorisation may be required to provide structured information relating to ICT governance, security risk management, digital operational resilience and third-party arrangements.

This demonstrates that regulators are assessing not only whether technical controls exist, but whether those controls are supported by clear governance, ownership and oversight.

The Cyber Resilience Act extends this discussion to products with digital elements. While many of its requirements will apply from December 2027, certain reporting obligations relating to actively exploited vulnerabilities and severe incidents have applied since September 2026.

For organisations developing or placing relevant digital products on the EU market, the CRA introduces requirements around secure design, vulnerability management and security throughout the product lifecycle. This means boards should consider whether cyber governance extends beyond internal systems and encompasses products, services and supply chains where relevant.

In Malta’s gaming sector, MGA licensees also face requirements relating to information security, governance, incident reporting, business continuity and technical assurance. Cybersecurity therefore needs to be considered not only through technical controls, but also through effective governance structures, oversight and management accountability.

For organisations operating in regulated environments, cyber risk increasingly forms part of the wider corporate governance framework rather than remaining an isolated IT concern.

Against this backdrop, boards should be asking fundamental questions:

• Do we understand our most significant cyber risks?
• Is cyber risk regularly discussed alongside financial, operational and compliance risks?
• Do we receive meaningful information and metrics that enable effective oversight?
• How dependent are we on critical third parties and digital supply chains?
• Are we confident in our ability to respond to and recover from a significant cyber incident?

The role of the board is not to become a group of technical experts. Rather, it is to provide direction, challenge assumptions, ensure accountability and foster a culture in which cyber resilience is embedded across the organisation.

As regulatory expectations continue to evolve, organisations that treat cyber governance, risk and compliance as a strategic governance function will be better positioned to respond to emerging threats, meet regulatory obligations and maintain stakeholder confidence.

The era of “the IT team has it covered” is over. Today, boards need to understand what is being covered, who is accountable and whether the organisation is sufficiently prepared.

RSM Malta supports organisations in assessing cyber governance, risk and compliance arrangements, strengthening oversight and understanding how evolving regulatory requirements affect their business.

To discuss how your organisation can strengthen its cyber governance and resilience framework, contact RSM Malta’s Governance, Risk and Compliance team.

Article written by Duncan Kirkpatrick – Senior Consultant, Cyber Security, GRC