Question: What is your experience with applying IT policy to the Board of Directors? 

Please mention the country and industry you have experience in, since the advice you're sharing may or may not be the same across all industries.

**[Edit]**

It isn't uncommon for a single Board Member to be involved in more than one board/company. If this is the case, it's entirely possible that that individual may have conflicting IT policies in place if they were both applied to the same machine. How does this ultimately impact the way they do business?

Answer: 
I work in healthcare and write the IT policies (among other things). All of my policies are reviewed by the corporate compliance team and others before being finalized. Once a policy is approved the first people I hold to the policy are the ones who asked for it or helped write it.

My thinking is that the people who helped create the policy should be the ones who have to deal with it first so that they know whether it works. When I changed the password complexity requirements our CEO needed to get information off of his PC for a meeting. Rather than accept a temporary exemption from the password policy change he insisted on being held to the same standard as everyone else.

If someone on our board is using a system connected to our network they can either use the guest wireless or they can abide by the policies. All of the policies I write have an exception clause, but the exception must be in writing and reviewed. All exceptions are sent to the compliance auditor within 30 days of the exception and annually the full list is sent. Any exception expires no more than a year from the exception to force a review.

I'm okay with there being reason able exceptions, as long as it is documented and necessary. When that happens I just require a compensating control to be demonstrated.
If you're lucky enough to operate in a jurisdiction where [**directors would be personally liable**](http://www.soxlaw.com/s802.htm) for knowingly violating the protections in place, you can just wave that piece of law at them until they realise they had better comply with the policy.