Cybersecurity Governance in the King IV Era

The Boardroom's Digital Mandate

The King IV Report on Corporate Governance has profoundly changed how South African organizations approach technology and information. Principle 12 of King IV explicitly states that the board should govern technology and information in a way that supports the organization setting and achieving its strategic objectives. In 2026, this means that cybersecurity is no longer a peripheral topic relegated to the IT department: it is a core component of the board's fiduciary duty of care and a primary focus of corporate governance.

Beyond Compliance: Ethical Leadership

King IV moves the conversation from "compliance-based" governance to "principles-based" governance, emphasizing ethical leadership and the creation of value. For the board, this involves:

• Setting the Tone at the Top: Demonstrating a clear commitment to cybersecurity through policy approval and resource allocation.
• Oversight of Risk Management: Ensuring that the organization has a robust process for identifying, evaluating, and mitigating cyber risks.
• Ensuring Adequate Protection: Verifying that management has implemented "appropriate, reasonable technical and organisational measures" to protect sensitive information.
• Crisis Management Preparedness: Overseeing the development and testing of incident response and business continuity plans.

The Role of the Social and Ethics Committee

King IV highlights the role of the Social and Ethics Committee in overseeing the organization's "citizenship" in the digital realm. This includes the ethical use of data, the protection of customer privacy, and the organization's contribution to the broader security ecosystem. A major data breach is now viewed not just as a technical failure, but as a significant breach of the "social contract" with stakeholders, with potentially devastating consequences for the organization's reputation and brand value.

Reporting and Transparency

Transparency is a cornerstone of King IV. Boards are expected to provide stakeholders with regular, high-level reports on the organization's security posture and the effectiveness of its risk management efforts. This reporting should be integrated into the annual integrated report, providing a holistic view of how technology and information risk is being governed to support the long-term sustainability of the business.

Conclusion

In the King IV era, cybersecurity is a fundamental measure of corporate governance excellence. For South African boards, the challenge lies in moving beyond a superficial understanding of technology to a deep, strategic oversight of information risk. By embracing the principles of King IV and treating cybersecurity as a strategic asset, organizations can build the trust and resilience needed to thrive in the digital economy of 2026.