Independent clarity on your board's digital governance
A thirty-minute conversation, answered by a director. You get a score, the gaps, and a dated record of what the board has asked and seen, tied to the Australian laws and standards that apply to your organisation.
· 30 minutes · no credit cardThe stakes
You are accountable for technology you do not run.
Directors are not expected to run the technology. They are expected to have asked the right questions and acted on the answers. That is what regulators and courts look for, and the consequences land on the person, not just the company.
The duty of care now covers cyber, and it is personal
The Corporations Act duty of care and diligence applies to cyber and data risk, and the Federal Court has treated it that way since 2022. A director who breaches it faces a civil penalty of up to the greater of 5,000 penalty units (about $1.8 million) or three times any benefit, and disqualification from managing companies. For charities, the ACNC's governance standards impose the same kind of duty on responsible persons.
The penalties are company-sized
A serious or repeated privacy breach now carries a penalty of up to $50 million, three times the benefit, or 30 per cent of turnover, whichever is greatest. The first court-ordered privacy penalty was $5.8 million. In February 2026 the Federal Court fined FIIG Securities $2.5 million for inadequate cyber security, ASIC's first penalty of its kind, and the privacy regulator is suing Medibank over the 2022 breach.
New obligations arrive without a memo
Since May 2025 a ransomware payment has to be reported within 72 hours. From December 2026 organisations must be transparent about automated decisions that affect people. Critical infrastructure boards sign off a risk program every year. Few boards hold a list of which of these apply to them, and the list changes.
What will you be able to show?
In the Star Entertainment case the court cleared the non-executive directors and penalised two executives, and the deciding question was what each person knew and what they did about it. After an incident, the first question put to a board is not whether the firewall held. It is what the board asked, when, and what it did with the answer. If that lives in memory and minutes, you have very little. A dated assessment, with the obligations it mapped and the actions it produced, is a record.
Penalty figures use the Commonwealth penalty unit of $364 from 1 July 2026. General information, not legal advice.
What changes
Thirty minutes buys you a record, a shortlist and the right questions.
A dated record of what the board has satisfied itself of on technology, data and cyber, in the board's own words, that you can point to later.
A short list of what to fix ranked by the obligation behind it, instead of a long list of everything that could be better.
The questions to ask management at the next meeting, with the answer you would expect to hear and the law that expects it.
A baseline you can re-run each year, so the board can show the auditor, the insurer and itself what has moved.
The nine areas
What a board should have satisfied itself of
Forty-nine scored questions across nine areas, written from a director's seat. Each answer scores 0 to 3, and Don't know is always an option.
Strategy
Is there an approved digital strategy, is it resourced, and does the board see how it is performing?
Governance structures
Reserved matters, delegations, committee coverage and a named executive accountable to the board.
Risk and compliance
The obligations register, cyber and ransomware readiness, breach response, data retention and supplier risk.
Conduct and culture
The human impact of technology on the people the organisation serves and the staff who use it.
Finance and audit
Digital investment decisions, budgets, technical debt and whether audit coverage reaches technology.
Board capability
Digital skills on the board and in the executive, director development and the CEO's technology targets.
Reserved policies
Which digital policies the board has kept for itself, and how often it reviews them.
Monitoring and outcomes
Reporting, assurance, horizon scanning and whether lessons from incidents reach the board.
Sector and contracts
Reportable incidents, government contract terms and card payments, asked only when your profile triggers them.
Tied to the law
Every question sits under the law that expects it.
Your first answers describe the organisation: entity type, charity status, jurisdictions, sectors, turnover and funding. From those, the assessment works out which of 44 Acts, standards and contract terms apply to you, and marks each one met, partly met, a gap, or a visibility gap. Anything that does not apply is set aside rather than counted against you.
- Directors' duties and governance. Corporations Act, ACNC Governance Standards, ASX Principles
- Privacy and cyber. Privacy Act, Cyber Security Act, SOCI Act, Spam Act
- Standards and frameworks. ISO 27001, ISO 38500, Essential Eight, AICD cyber principles
- Sector rules. APRA CPS 230 and 234, NDIS, aged care, child safe, PCI DSS
- Overseas. GDPR and US state privacy law when you serve people there
The question bank and the legislation mapping were developed with Digital Directors ANZ and reviewed by their legislation reviewer. The references are general information, not legal advice.
The outputs
Built to go straight into the board pack
The same figures, in the shape each audience needs: a dashboard for you, a list for the next agenda, a deck for the meeting and a PDF for the pack.
What you get
The whole assessment is free. The detail is Premium.
Complete every question without paying and get the score, the summary and the headline findings. Premium opens the detail behind them and the documents for the board pack, on the same account as StackUp's other assessments.
- ·Digital governance score out of 100 with a named band: Foundational, Developing, Established or Leading
- ·A score for each of the nine areas
- ·Visibility gap: how much of the picture the board could not answer
- ·Executive summary written for the board
- ·Your first three board attention items: the answers that need a decision at the next meeting
- ·Which laws, standards and contract terms apply to your organisation, each marked met, partial or gap
- ·AI CTO chat to talk through the results, and score history as you re-assess
- ·Every board attention item
- ·The answers, scores and obligations behind each of the nine areas
- ·Question-level detail under every obligation: which answer met it, which fell short
- ·Recommended actions in your Action Plan, each tied to the answer and the obligation that drove it
- ·Director report PDF for the board pack
- ·Editable board PowerPoint deck
- ·Evidence vault: upload charters, policies and reports against each question, with an AI review of how well each supports the answer
Premium runs on the same StackUp account as the other assessments, billed monthly. Money-back guarantee.
Why StackUp
Written from the director's seat, not the server room.
The rigour of a governance review, in a form a board can run itself before the next meeting.
Talk it through
Answer by voice or text in a guided conversation. It asks what the board has satisfied itself of, not what IT has configured.
Tied to the law
Every question sits under the laws, standards and contract terms it tests, with the rules for which organisations each one applies to.
Independent by design
No product or service upsell or kickbacks. A proudly independent platform.
Built for board cycles
Thirty minutes, a result the same day, and a re-run each year that shows the board what has moved.
Trusted by former CTOs of
“As a smaller business, it is incredibly difficult to know where to turn for truly impartial advice on technology and systems. StackUp provided a clear, unbiased assessment that helped us focus on what really matters, without the sales pitch.”
Andrew Mellett
Director, Beveridge Williams
“StackUp is your secret weapon for staying ahead.”
Steven Fulop
Director, xceltium
“We gained a clear understanding of the opportunities and challenges within our technology function and valuable insights into the type of leadership needed to drive our organisation forward.”
Paul Richardson
CEO, Illawarra Catholic Club
Questions
The things directors ask first
The rest of the platform
Six other things you can run
Each answers a different question. They all land in the same place.
Technology Assessment
The whole technology function, scored out of 100.
How it worksAI Maturity Assessment
Where you stand on the four questions boards ask about AI.
How it worksAI Leadership Skills
Whether your leaders could defend the AI strategy they set.
How it worksProject Assessment
A health score for one project, calculated not reported.
How it worksDiscovery Agents
Ask your team directly, rather than waiting for it to travel up.
How it worksCrisis Tabletop Simulation
An hour deciding your way through a year of incidents.
How it worksKnow where your board stands before someone else asks
Takes 30 minutes. Costs nothing. Leaves a record.