Board portal security checklist for IT

Cybersecurity and risk are among the top concerns of boards – and a major reason why boards are adopting secure board software. Boards of directors have access to some of the most confidential material a company owns. Read on to see why evaluating board portal security is important and what IT teams need to assess.

Why is Board Portal Security for IT important?

The pressure on IT teams to safeguard data has never been greater. As executive teams and boards of directors work remotely or in a hybrid model, many boards are seeking ways to share confidential company information and collaborate while reducing the risk of rising cyber attacks.

When it comes to protecting your organization’s information, vetting technology partners to ensure they meet the highest security standards is imperative – and includes many facets from data storage to transit and access. The best means of protection is to be practical, proactive, and selective in choosing your board management software.

Despite the claims, not all board portal software offers the same level of security. When comparing board management systems, it’s worth evaluating security very closely.

To help IT teams compare and evaluate board portals, we’ve provided a step-by-step checklist of the key areas to review for board portal security.

The essential components of a board portal data security checklist for IT

Step 1: Review data hosting and Service Level Agreements (SLAs).

Secure board portals use dedicated, secure cloud servers so they are not prone to hardware issues. Vendors should be managing the data security and encryption of their software and systems exclusively, and not sharing with other tenants. 

Review the Service Level Agreement (SLA) uptime guarantees, how often servers are monitored by security personnel, and disaster recovery capabilities. 

Step 2: Check data encryption for both in transit and at rest.   

There are two central types of encryption: how data is stored when no one is accessing it (at-rest encryption), and how data is encrypted when it’s sent from the server to a device (in-transit encryption). Choose a board portal with RSA 4096-bit encryption for data in transit and AES 256-bit encryption for data at rest.

Step 3: Align with data storage with your data governance policy.   

Typically, organizations seek to store their data within their country, such as Canada or the United States. Secure board portal software solutions allow you to choose where to store your data so they align with your data governance policy. Beware of vendors who do not provide a choice in where your data is located and who only meet the legal jurisdiction of where they select your data to be stored.

Step 4: Meets the highest security certifications for the industry.  

Secure board software should be subject to rigorous third-party testing to ensure it meets the various agreements and compliance certifications, including ISO 27001. If your organization is highly regulated such as healthcare or a federal agency, you’ll also need to ensure the board portal is compliant to relevant industry standards, such as HIPPA or FISMA. 

Check that the board portal technology meets the following certifications:

• ISO 27001/27002 certification

• AT 101 SOC 2 Type 2, SOC 3, GLBA, FERPA, HIPAA, FISMA, and SSAE 16/ ISAE 3402
• Certifications under trusted Microsoft Azure cloud services
• GeoTrust certification
• Intrusion detection and Distributed Denial of Services (DDoS) protection.

Step 5: Ability to control user access.   

Server security alone is not enough to safeguard data. Your board portal technology needs to give you access control for specific users and groups to use information so that your data stays within the virtual board portal environment. 

Features to help control user access should include:

• Role-based and granular access permission capabilities including document level security 
• Immediate erasing of data from a lost or stolen device
• Ability to lock out users from their account
• Multi-factor authentication and single sign-on capabilities
• Automatic time-out after period of inactivity 

Step 6: Encourages robust passwords.   

One of the first ways to protect sensitive board material from a user perspective is to ensure the use of robust passwords. Your board portal software should encourage use of strong passwords with features such as:

• Specified password structure and length
• Forces users to change password regularly
• Lockout after multiple failed attempts
• Passwords transmitted in encrypted format

Step 7: Strong security track record.  

Board portals with high security standards have no prior data breaches as well as comprehensive communication protocols in place to deal with one in the event that it should occur.  As part of your secure board portal evaluation, ask your vendors if they’ve had any data breaches and how they would deal with potential problems if they arose.

Regular security audits: How to maintain ongoing board portal security for IT

IT teams should conduct regular security audits to ensure that their board portal software remains secure and that any vulnerabilities are identified and addressed promptly. Regular security audits can help identify any gaps or weaknesses in the system and help IT teams stay up-to-date with emerging threats and best practices.

How can IT ensure ongoing board portal security? While some features like data encryption and data loss prevention tools will automatically help you ensure ongoing security, you’ll also want to routinely:

• Ask your vendor about regular software updates to ensure they are updating the software with the latest security patches to help prevent vulnerabilities from being exploited.
• Check on access controls to ensure role-based access controls and multi-factor authentication are being used to ensure that only authorized users have access to the board portal.
• If you don’t already have one, create an incident response plan that outlines the steps to take in the event of a breach or security incident to help mitigate the impact of an attack and minimize downtime.
• Provide ongoing security training and awareness programs to staff members who use the board portal can help ensure that they are aware of the latest threats and best practices for maintaining board portal security.

How Aprio offers an industry-leading secure board portal

Aprio offers robust security to protect board members from cybersecurity risk as they work, balancing convenient, mobile access to board meeting materials with the most robust technical methods to continuously protect your organization’s data.

• We adhere to the industry’s highest level of security protection and provide layers of advanced security features.
• Choose to store and protect your data on any of our secure Canadian, US or international servers – which each adhere to independent, third-party requirements for security certifications.
• Arm your team with the power to control user access, guarantee compliance and remotely wipe lost or stolen devices. 

Ready to see how Aprio offers an easy-to-use and secure board portal that safeguards protects your organization’s data while providing convenient access to board materials?  Talk to our sales team – book a demo today.