Information security governance: pending legal responsibilities of non-executive boards

The study shows that a structural conflict of interest in non-executive boards exists due to missing corporate governance structures and a lack of awareness for legal issues with regard to information security risks. Non-executive boards receive information on strategic security threats as a part of their oversight function to fulfill investor interest in transparency. At the same time, they act as representatives of company stakeholders and have an interest to counteract to information security risks based on the stakeholder’s risk disposition. If not properly structured by corporate governance rules, these different interests may lead to regulatory aberrations on non-executive board level. The study analyses a Deutsche Telekom AG case where non-executive board members, employees, and journalists fell victim to a spying scandal subject to the German telecommunications secrecy law in 2005–2006. The analysis demonstrates how the handling of information security on non-executive board level bears governance risks as well as legal risks that are insufficiently addressed in corporate governance research. The paper contributes to avoid a reproduction of events in the future, by suggesting the principle of a segregation of duties on non-executive boards as well as providing an overview of relevant legislative requirements that clarify tasks of non-executive board members with regard to information security. The study therefore helps protecting corporations and their stakeholders from similar consequences of missing corporate security governance.