If your NFP suffers a cybersecurity breach, a data handling failure, or a serious operational outage, the Australian Institute of Company Directors is clear about what happens next. The board carries the responsibility, not the IT team or service provider.
If reasonable steps were not taken, directors can be held personally liable for the failure.
This is the shift that most NFP boards have yet to absorb. Cybersecurity, data handling, and disaster recovery used to sit with IT. They now sit with the board.
2 Reasons Why This Matters
First, the information held in these organisations is among the most sensitive of any sector outside the hospital system. Medical records, NDIS plan details, behavioural support information, and family contact details. The people whose data is held are, in many cases, the most vulnerable people in the community.
Second, the duty of care that defines this sector has always extended to the people you serve. It now extends to the information you hold about them. A breach in this sector is not a regulatory event with a fine attached; it is a breach of trust in an organisation whose entire purpose is to be trustworthy.
What’s at Stake
A serious incident in this sector does not end when the data is recovered.
Funders closely review governance after an incident, and funding may be paused or withdrawn. Reputational damage takes longer to repair in an NFP than in a commercial business, because the relationship with the community is built on something more fragile than transactional trust. Staff burnout spikes when the team feels it has let down the people it exists to serve. And the board bears the visible weight of it all.
What “Reasonable Steps” Means
Boards are expected to have done sensible, demonstrable work. Knowing where the organisation stands. Having a plan for the gaps and being able to point to evidence that someone is actively managing the risk.
Five questions every NFP board should be able to answer:
- When was the last independent cybersecurity assessment?
- Who on the board oversees cybersecurity?
- Are there written information policies that staff have been trained on?
- Is there a disaster recovery plan, and has it been tested?
- If a breach happened today, could the board demonstrate that reasonable steps had been taken?
Most boards cannot confidently answer yes to all five. That is a failure of resourcing and specialist knowledge.
Where Tango fits
We provide the independent assessment and the plan. We tell you where the organisation stands, what needs to be fixed, and in what order. We document the work in a way the board can point to if questions are ever asked.
Talk to Tango about supporting your board.
(08) 6234 1734 | info@tangoit.com.au
