Security is not a feature. It is a posture. It is how a system behaves under stress, mistakes, and attacks.

Directors do not need to be programmers to lead security well. Clear questions create clear expectations. The following checklist is a minimum for your software vendor to provide clear answers to.

The 5-Question Executive Security Checklist

1) How is data protected in transit and at rest?

Look for:

Encrypted connections
Encrypted storage for sensitive data
Clear handling of backups

2) Who can access what, and how is it controlled?

Look for:

Role-based access
Least privilege
Separation of duties for high-risk actions

3) What gets logged, and who reviews it?

Logs are accountability.

Login attempts
Permission changes
Data exports
Admin actions
Errors

Responsibility means the system can explain what happened.

4) What is the plan for patches and vulnerabilities?

Security is ongoing.

How often are updates applied? This should be part of your maintenance contract.
How fast are critical fixes shipped?
Who owns response time?

Speed matters here, with control.

5) What happens when something goes wrong?

Ask about incident response.

Backup and recovery targets
Disaster recovery plan
Tabletop exercises
Clear escalation contacts

Craftsmanship shows up as tested recovery, not promises.

Mini Case Study. Legal Document System Risk

Problem: A legal firm built a client document portal for sharing sensitive files and case updates.

Mistake: Security was treated as “IT will handle it.” Access controls were loose, logging was minimal, and recovery steps were not tested.

Fix: The firm used the 5-question checklist before launch.

Tightened role-based access
Added audit logs for downloads and shares
Implemented routine patching and monitored alerts
Tested backup restore with real timelines
Ran a simple incident drill so everyone knew the process

Result: The portal launched with confidence, reduced risk exposure, and created a clear security posture that clients could trust.

Quick Takeaways

Security leadership comes from clear questions, not technical jargon.
Logs and access control are non-negotiable for trust.
Patch and recovery plans must be practiced, not written.
Speed matters most during incidents, but only with control.

Critical Action: Run the 5-question checklist with your vendor and require written answers before you sign the statement of work.

Executive Security Checklist. 5 Questions To Ask Your Custom Software Vendor