Question: What is your experience with applying IT policy to the Board of Directors? 

Please mention the country and industry you have experience in, since the advice you're sharing may or may not be the same across all industries.

**[Edit]**

It isn't uncommon for a single Board Member to be involved in more than one board/company. If this is the case, it's entirely possible that that individual may have conflicting IT policies in place if they were both applied to the same machine. How does this ultimately impact the way they do business?

Answer: 
I work in healthcare and write the IT policies (among other things). All of my policies are reviewed by the corporate compliance team and others before being finalized. Once a policy is approved the first people I hold to the policy are the ones who asked for it or helped write it.

My thinking is that the people who helped create the policy should be the ones who have to deal with it first so that they know whether it works. When I changed the password complexity requirements our CEO needed to get information off of his PC for a meeting. Rather than accept a temporary exemption from the password policy change he insisted on being held to the same standard as everyone else.

If someone on our board is using a system connected to our network they can either use the guest wireless or they can abide by the policies. All of the policies I write have an exception clause, but the exception must be in writing and reviewed. All exceptions are sent to the compliance auditor within 30 days of the exception and annually the full list is sent. Any exception expires no more than a year from the exception to force a review.

I'm okay with there being reason able exceptions, as long as it is documented and necessary. When that happens I just require a compensating control to be demonstrated.
Agree with Steve - however a common source of non-compliance is director or board level. These individuals often want the latest technology, or want more freedom or flexibility than their staff, and are in a position of power so can demand it, so sometimes the Information Security team need to proactively identify solutions to upcoming technology issues in order to provide a secure solution by exception in these cases.

Where senior/executive management are utterly bought in to security policies, an organisation is typically more robust and governance and compliance are more easily demonstrated, but in the more usual business organisation the aim is to make compromises which allowm to enable business while not impacting security too much.

In my experience this doesn't vary that much between countries in Europe, America or the Middle East, or across industries. The point being that individuals in senior positions want to do business their way, and usually their way is considered right for the business if they make revenues and that is where we as Information Security professionals come in.

The circumstance where an individual sits on more than one board is a major problem. The security ideal is obviously to completely segregate each role, however getting a director to carry round multiple laptops is unlikely. What typically happens is they use one account and manage all emails and accesses from one machine - and you end up relying on them not making a mistake.

Dangerous!

Segregation by virtual machine would seem to be a logical next step, but I have only ever seen this once. This can be secured to a high level, but requires a certain amount of communication between organisations to agree the configs etc.