Our IT Manager handles our hardware and software support, but our exit advisors say we need a rigorous cyber security and data privacy seat to pass buyer due diligence. Can we just add these responsibilities to our existing IT Manager's seat, or do we need to split this into a new seat entirely?

Question

Tyler Smith · Accepted Answer

General IT support and rigorous data compliance are two fundamentally different disciplines that require different mindsets. Your IT Manager is focused on uptime, software access, and keeping the team productive. A cyber security and data privacy seat is focused on risk mitigation, access control, and strict regulatory compliance. If you simply stack security and compliance responsibilities onto your IT Manager's seat, you will likely end up with a seat that is too broad for one person to GWC. Furthermore, it creates a conflict of interest, as the person implementing the systems is also auditing them. To prepare for a clean exit, design a separate Security and Compliance seat on your Accountability Chart. This seat can report to your Integrator or your Head of Technology. If you do not have the budget to hire a full-time compliance officer, you can contract with a fractional provider or an external managed security service provider. Even with external help, one internal person must still sit in the seat and be accountable for the results. By separating these seats, you show buyers you take data security seriously and have a structured way to manage risk.