Governance Churn Exposes Firms to Heightened Cyber Risk During Transitions

A silent crisis is unfolding in corporate boardrooms and compliance departments, one that significantly elevates cyber risk during critical transition periods. Recent data reveals a concerning pattern of high-level governance resignations and appointments across Indian companies, including STEL Holdings, Kimia Biosciences, Utkarsh Small Finance Bank, and Lyons Corporate Market. This churn at the highest levels of oversight coincides with regulatory tightening, such as the Securities and Exchange Board of India's (SEBI) mandate for specialized certification of Alternative Investment Fund (AIF) compliance officers by January 2027. For cybersecurity leaders, this governance instability is not merely an HR issue—it is a direct threat to organizational resilience, creating windows of vulnerability that attackers are adept at exploiting.

The core of the problem lies in the disruption of institutional knowledge and oversight continuity. Roles like Company Secretary, Chief Compliance Officer, and Non-Executive Director are not just administrative; they are integral to the governance of information security, data privacy policies, third-party vendor risk assessments, and regulatory reporting. When a Company Secretary resigns, as seen at STEL Holdings effective February 28, 2026, or a Non-Executive Director steps down, like Vipul Goel from Kimia Biosciences at the end of 2025, the formal oversight of cybersecurity reporting lines and board-level risk committees can become ambiguous. The incoming appointee, such as Mr. Ritesh Kumar as Chief Compliance Officer at Utkarsh Small Finance Bank or Mrs. Madhu Jain as Additional Independent Director at Lyons Corporate Market, inevitably faces a steep learning curve. During this transition, critical security decisions may be delayed, approval processes for security budgets can stall, and the nuanced understanding of the company's specific threat landscape is temporarily diluted.

From a technical and operational standpoint, these transitions create several tangible risks. First, there is the risk of insider threat escalation. Departing personnel, especially those disgruntled or under pressure, may have access to sensitive systems, shared drives containing network diagrams, or compliance reports detailing security controls. Standard offboarding procedures for IT access must be meticulously enforced and audited, a process that can be overlooked during a chaotic C-suite transition. Second, third-party and supply chain risk management often suffers. Compliance officers play a key role in vetting the security posture of vendors and partners. A gap in this role or a new appointee's lack of context can lead to rushed approvals or lapsed security assessments for critical suppliers, expanding the attack surface.

Third, and perhaps most critically, is the regulatory and audit readiness risk. SEBI's move to mandate NISM certification for AIF compliance officers underscores a broader trend of increasing regulatory scrutiny on governance controls, which inherently include cybersecurity. A new compliance officer, even if certified, will need time to understand the organization's legacy systems, past audit findings, and the intricacies of its incident response plan. In the interim, the organization may fail to adequately prepare for an audit or misreport a material cybersecurity incident to regulators, leading to significant fines and reputational damage.

Mitigation Strategies for Cybersecurity Leaders:

To navigate this period of governance flux, cybersecurity teams must adopt a proactive stance:

1. Formalize Cybersecurity Handover Protocols: Work with HR and Legal to create mandatory cybersecurity briefings as part of the onboarding and offboarding process for all C-level and board positions. This should include a review of access privileges, incident response roles, and pending security decisions.
2. Implement Continuous Control Monitoring: Reduce dependency on individual knowledge by automating the monitoring of key security controls and compliance status. Tools that provide real-time dashboards on the security posture can help new leaders get up to speed quickly and identify gaps.
3. Elevate Deputy and Team Knowledge: Ensure that no critical security process is reliant on a single person. Cross-train deputies within the compliance and legal teams on essential cybersecurity governance procedures to maintain continuity.
4. Treat the Board as a Critical User Group: Develop a dedicated, concise briefing package for new directors and officers, outlining the company's top cyber threats, key performance indicators (KPIs) for security, and their specific governance responsibilities in overseeing cyber risk.

The current wave of governance changes is a stark reminder that people risk is cybersecurity risk. The integrity of security controls is only as strong as the governance framework that oversees them. By recognizing leadership transitions as high-risk security events and implementing structured processes to manage them, organizations can turn a period of potential vulnerability into an opportunity to reinforce and refresh their cyber governance posture, ensuring resilience in the face of both internal change and external threats.