Information Technology and Digital Governance
Scope
Information Technology and Digital Governance tests board-level oversight of IT: strategy alignment, cyber risk, data privacy, digital records and control of outsourced technology.
Core rules
- IT governance vs management. Governance sets direction, risk appetite and accountability; management runs systems and operations. The board owns oversight, not server administration.
- Frameworks. COBIT links IT goals to business goals; ISO/IEC 27001 provides an information security management system; ITIL supports service management.
- Cyber risk. Identify assets, patch, control access, back up, test recovery, monitor and rehearse incident response. Board reporting should cover material incidents and control gaps.
- Data privacy. Under the Nigeria Data Protection Act 2023, determine whether the organisation is a controller or processor, apply lawful basis, minimise data and secure it.
- Electronic records. The Evidence Act 2011 supports admissibility of electronic records subject to authenticity and integrity conditions.
Worked example
A ransomware attack encrypts the sales database. The response should isolate affected systems, activate the incident team, preserve logs, restore from tested backups, assess notification duties, and report to the board. Paying the ransom is not a control strategy and may create legal and ethical risk. The reasoning is that resilience depends on preparation, not on a single recovery tool.
Traps
Do not confuse IT governance with IT management; do not treat backup as sufficient without restoration testing; do not ignore third-party cloud risks; and do not assume privacy compliance ends with a website notice.
Key check
Ask: what could fail, how would we know, how fast could we recover, and who is accountable?