What Is IT Governance? A Guide for EU Organisations

EU regulation has transformed IT governance from a best-practice aspiration into a legal obligation for many organisations. NIS2 Article 21(2)(e) specifically mandates security in network and information systems acquisition, development, and maintenance — a core IT governance concern. Article 21(2)(a) requires policies for risk analysis and information system security, which presuppose an IT governance framework that defines how technology decisions incorporate security requirements. The management body obligations under Article 20 extend to IT governance decisions that affect the security of network and information systems, meaning the governing body cannot remain uninformed about how IT strategy intersects with cybersecurity risk.

DORA goes further, dedicating its entire Chapter II to ICT risk management governance. Article 5(1) requires the management body of financial entities to define, approve, oversee, and be responsible for the implementation of the ICT risk management framework. Article 5(2) specifies a detailed list of management body responsibilities including setting risk tolerance levels for ICT disruptions, approving the ICT business continuity policy, approving ICT audit plans, allocating adequate ICT budget, and approving arrangements for the use of ICT third-party service providers. This is prescriptive IT governance — the regulation tells governing bodies not just that they must govern IT risk but specifically what governance activities they must perform.

The General Data Protection Regulation (GDPR) introduces IT governance obligations through the lens of data protection. Article 25 (data protection by design and by default) requires that data protection considerations be embedded into IT acquisition and development processes — a governance-level decision about how technology procurement and software development are conducted. Article 32 requires appropriate technical and organisational measures for data processing security, which must be risk-assessed and proportionate. The Data Protection Officer role under Article 37 itself represents a governance mechanism, providing independent oversight of data processing activities. Organisations subject to multiple EU frameworks must ensure their IT governance structure accounts for all applicable regulatory requirements as first-class governance concerns, not afterthoughts appended to existing IT decision-making processes.

IT governance does not operate in isolation — it must integrate with cybersecurity governance, data governance, and broader compliance governance to form a coherent oversight system. The historical separation of IT governance (focused on value delivery and resource optimisation) from cybersecurity governance (focused on risk management and protection) has become untenable in the EU regulatory environment. NIS2 treats information system security as inseparable from system acquisition, development, and maintenance. DORA treats ICT risk as a unified domain encompassing operational resilience, security, and third-party management. Maintaining separate governance silos for IT and security creates gaps, inconsistencies, and duplicated effort.

Integration can take several forms. The strongest model is unified governance, where a single committee oversees IT strategy, cybersecurity risk, and regulatory compliance together. This ensures that technology investment decisions automatically incorporate security requirements and compliance obligations. The moderate model uses separate committees with formal coordination mechanisms — the IT governance committee and cybersecurity governance committee share members, align meeting schedules, and use common risk language and taxonomies. The weakest model (and unfortunately the most common) is informal coordination, where IT governance and cybersecurity governance operate independently and alignment depends on personal relationships between the CIO and CISO.

For EU organisations, the integrated approach is increasingly the regulatory expectation. DORA Article 6(8) requires the ICT risk management framework to be documented and reviewed at least once a year, or upon the occurrence of major ICT-related incidents, and following supervisory instructions or conclusions derived from relevant testing or audit processes. This presupposes an integrated governance cycle where ICT risk assessment feeds into both technology investment decisions and cybersecurity measure prioritisation. Organisations should establish a common governance calendar that aligns IT strategy reviews, cybersecurity risk assessments, compliance audits, and regulatory reporting into a single cadence, ensuring that governance decisions are informed by the full picture rather than fragmented views of technology, security, and compliance.

Implementing IT governance is itself a governance decision — it requires executive sponsorship, defined scope, and a phased approach that delivers early value while building toward a mature capability. Begin with an IT governance maturity assessment that evaluates your current state across the dimensions described in this guide: structural clarity, decision-making effectiveness, regulatory conformance, integration with cybersecurity and compliance, and performance measurement. Use the assessment results to identify the highest-priority gaps and build a remediation roadmap that sequences improvements by regulatory urgency and organisational readiness.

Phase 1 (foundation, months 1-3) should establish the structural basics: define and document the IT governance framework charter, establish or formalise the governing committee(s), create a decision rights matrix for the five key IT governance decisions, and implement a basic governance meeting cadence with agenda templates and minute-taking protocols. These structural elements cost nothing to implement but create the foundation for everything that follows. For organisations already subject to NIS2 or DORA compliance obligations, Phase 1 should also include mapping current IT governance activities to the specific regulatory requirements to identify critical gaps.

Phase 2 (operationalisation, months 3-9) activates the governance processes within the established structures: implement a governance-level IT risk assessment cycle aligned with enterprise risk management, establish IT investment prioritisation criteria that include security and regulatory requirements, define governance-level performance metrics and build the initial governance scorecard, and integrate IT governance reporting with cybersecurity and compliance governance reporting. Phase 3 (maturity, months 9-18) focuses on optimisation: implement quantitative IT risk analysis to inform governance decisions, establish peer benchmarking, conduct a formal governance effectiveness review using an independent assessor, and evolve governance practices based on lessons learned from regulatory examinations and audit findings.

Throughout all phases, remember that IT governance is a means to an end, not an end in itself. The purpose of IT governance is to ensure technology serves the organisation's objectives while managing risk and meeting regulatory obligations. If governance processes become bureaucratic overhead that slows decision-making without improving outcomes, the governance framework needs recalibration. The best IT governance programmes are those where the governing body feels genuinely informed and empowered to direct technology strategy, and where technology leaders feel accountable to governance decisions without being paralysed by them.