The National Association of Corporate Directors (NACD) says boards must treat technology as a governance and strategy responsibility—not merely an operational or cybersecurity issue. Its 2024 Blue Ribbon Commission report, Technology Leadership in the Boardroom: Driving Trust and Value, organizes ten recommendations around three imperatives: strengthen oversight, deepen insight and develop foresight.
What the NACD report says boards must change
Released on October 7, 2024, the report was produced by a 24-member commission. Its central argument is that directors need enough structure, knowledge and agenda time to govern technology while leaving day-to-day execution to management.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
On Board: The Modern Playbook for Corporate Governance | $19.93 | Buy on Amazon |
| 2 |
|
Corporate Governance Matters | $65.09 | Buy on Amazon |
| 3 |
|
Corporate Governance | $41.72 | Buy on Amazon |
| 4 |
|
Corporate Governance: Principles, policies, and practices | $70.50 | Buy on Amazon |
| 5 |
|
Corporate Governance: Principles, Policies, and Practices | $96.11 | Buy on Amazon |
The report is guidance, not a legal mandate. It does not require every company to create a technology committee or adopt one fixed governance model. Instead, it asks each board to make accountability explicit and connect technology decisions to organizational purpose, values, trust and long-term value creation.
| Imperative | What it requires | Board-level outcome |
|---|---|---|
| Strengthen oversight | Clear responsibilities, structures, data governance and decision authority | Technology is governed deliberately rather than handled ad hoc |
| Deepen insight | Director proficiency, proficiency evaluation and useful metrics | Directors can challenge assumptions and interpret management reporting |
| Develop foresight | Technology in long-term strategy, exploratory discussion and forward-looking agendas | The board can prepare for disruption instead of reviewing only past results |
Strengthen oversight: four recommendations
Align technology use with purpose and values
Boards should ask whether the organization’s use of data, artificial intelligence, platforms and other technologies is consistent with its stated purpose and values. Trust is the test: a technically feasible initiative may still be inappropriate if it creates unacceptable effects for customers, employees, investors or other stakeholders.
#1 Best Overall
Upgrade board structures for technology governance
Each board should examine whether its current committee map, charter language and reporting routes support effective technology oversight. The right structure depends on the company’s size, business model, regulatory exposure and technology dependence. NACD presents structures as choices to assess, not a universal prescription.
Define the board’s role in data oversight
Directors should know which data matters to strategy and risk, who is accountable for its quality and use, and how management handles issues such as access, privacy, retention and integrity. The board’s role is to oversee the framework and outcomes, not to approve routine data-processing decisions.
Set decision-making authority between the board and management
A written understanding of authority prevents both gaps and micromanagement. The board should establish which technology investments, risk decisions, capability changes or strategic shifts require director review, while management retains responsibility for implementation and operations.
Rank #2
Deepen insight: build the board’s ability to understand technology
Establish and maintain technology proficiency
Technology proficiency does not mean every director must become an engineer. It means the board collectively can understand the company’s critical systems, data dependencies, major technology risks, investment logic and emerging options well enough to exercise informed judgment. Proficiency must be maintained as the business and technology environment change.
Evaluate director and board proficiency
Boards should assess their technology knowledge as deliberately as they assess other capabilities. A skills matrix, annual self-assessment, director education and targeted recruiting can reveal gaps. The relevant question is whether the board has the expertise needed for its specific strategy and risk profile, not whether it has a particular job title represented.
Require clear, decision-useful metrics
Management reporting should help directors decide, not simply display activity. Metrics need context: trend, target, materiality, risk exposure and the management action being considered. A dashboard that reports incidents or spending without explaining business impact can leave the board with data but little insight.
Rank #3
NACD’s October 7, 2024 release reported that 34% of directors in its 2024 Public Company Board Practices Oversight Survey said the board and management were “strongly aligned” on the company’s vulnerability to transformative technologies. That is a 2024 survey finding, not a 2026 measurement and not a claim about all boards.
Develop foresight: make technology part of strategy
Recognize technology as a core element of long-term strategy
Technology should appear in strategic planning as a source of capability, competitive advantage and risk—not as a separate technical appendix. Boards should connect major technology choices with the company’s business model, capital allocation, workforce plans and resilience objectives.
Create exploratory board-management discussions
Exploratory sessions let directors and executives examine plausible futures before a proposal is fully formed. Useful questions include: Which technologies could alter customer expectations? Which assumptions in the current strategy could become invalid? What capabilities would take years to build? What should the company learn before committing significant capital?
Protect agenda time for forward-looking issues
Annual calendars should reserve time for emerging technology, long-term scenarios and strategic options. If technology appears only after an incident or inside a crowded committee packet, the board is likely to remain reactive. Forward-looking discussion should complement, not replace, oversight of current performance and risk.
Should a board create a technology committee?
NACD says a technology committee can provide deeper discussion, but technology oversight must remain a responsibility of the full board. Depending on circumstances, a board might use an existing fiduciary committee, create a dedicated committee or establish an advisory board. The choice should follow the company’s needs and preserve clear accountability.
| Structure | Potential advantage | Question to resolve |
|---|---|---|
| Full-board oversight | Keeps technology tied to enterprise strategy and collective fiduciary judgment | Is there enough agenda time and director proficiency? |
| Dedicated fiduciary committee | Allows more detailed review within formal board authority | How will findings and decisions reach the full board? |
| Advisory board or panel | Adds specialist perspective and exploratory capacity | What authority, expertise and reporting obligations will it have? |
Any charter should specify scope, escalation thresholds, management interfaces and reporting cadence. A committee should add depth without becoming a silo that separates technology from strategy, finance, people or risk.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsHow to put the recommendations into practice
- Map accountability. List board, committee and management responsibilities for strategy, data, major investments, resilience and technology risk.
- Review the calendar and charters. Identify where technology appears, whether the full board receives the right matters and whether committee mandates overlap or leave gaps.
- Assess proficiency. Use a board skills review to identify collective knowledge gaps and decide whether education, external advisers or recruitment is appropriate.
- Redesign reporting. Ask management to connect technology metrics with strategic objectives, risk appetite, financial impact and decisions required from directors.
- Schedule foresight conversations. Hold recurring sessions on emerging technologies, alternative scenarios and capabilities the company may need to build.
- Test the arrangement. After major decisions or incidents, review whether information arrived at the right level, authority was clear and the board had enough time to act.
What the report means for directors
The practical shift is from occasional technology briefings to an operating model for board oversight. Directors do not take over architecture, procurement or incident response. They ensure that management’s technology choices are connected to purpose, governed with clear authority, measured in a useful way and considered as part of the company’s future.
Cora Carmody’s January 2, 2025 CIO analysis of the NACD report captures the logic: “Without adequate oversight, it’s impossible to get reliable insight. Without reliable insight, foresight of enterprise technology will be wrong, incomplete, a bad bet, a waste of money, or non-existent.” The statement is Carmody’s commentary, not a quotation from NACD’s report.
NACD president and CEO Peter Gleason said in the October 7, 2024 release, “This moment demands greater technology focus and strategic leadership from every director.” The report’s ten recommendations provide a framework for making that focus specific: assign responsibility, build competence, improve information and create room to look ahead.
Access and limits of the NACD material
NACD’s complete report is available to members. The organization also makes an executive summary, recommendation overview and online toolkit available through its report materials, with some tools gated or member-only. The surfaced recommendations should therefore be read as the framework NACD publicly describes, not as a substitute for every detail in the full report.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
