The Context
On Tuesday, 31 March 2026, the Iranian Islamic Revolutionary Guard Corps (IRGC) named Dell Technologies among 18 US companies as potential military strike targets. The warning specified attacks could begin as early as 8 p.m. local time the following day. Dell’s immediate response was operational: a ban on all business travel to Israel, Lebanon, and seven Middle Eastern nations through 15 April; a mandate for regional staff to work from home; and activation of its Security & Resiliency Operations team. The root cause is external—a geopolitical conflict ignited in late February 2026. But for a director, the trigger is irrelevant. The company is now a named entity in an active state-sponsored conflict. That changes everything.
The Risk
Your duty of care just escalated from operational to existential. While Dell’s travel ban and work-from-home orders are prudent first steps, they address the symptom, not the strategic threat. The moment your company was publicly named, the risk profile for every employee, contractor, and asset in or connected to that region transformed. The ‘Court of Public Opinion’ is now in session, and its first question will be: “What did the board know, and when did they act?” Psychosocial damage from sustained threat anxiety can erode workforce morale and productivity globally, not just in the Middle East. Brand erosion is immediate; customers and partners will question the stability of a supply chain under threat. In a New Zealand context, while the HSWA 2015 may not have extraterritorial reach for physical sites, a director’s overarching duty to exercise reasonable care, diligence, and skill under the Companies Act 1993 is unequivocal. Failing to oversee a robust, strategic response to a direct threat of this magnitude may be viewed as a failure of that duty. The liability isn’t in a fine yet; it’s in the lost trust, the talent exodus, and the shattered shareholder confidence that follows a perceived leadership vacuum during a crisis.
The Control
Move beyond incident response to enterprise-wide resilience. The board must mandate that management’s plan transcends temporary travel bans. It must be a holistic strategy that protects people, secures critical data and IP, ensures business continuity for core functions, and communicates with unwavering clarity to all stakeholders—employees, investors, and customers. This is not an IT problem; it is a total corporate survival exercise. The board’s role is to stress-test the comprehensiveness of this plan and the speed of its execution.
The Challenge
These are the critical questions you should be raising at the board table:
| Beyond travel restrictions, what is our validated, executable plan to extract or safeguard personnel if the threat materialises in a country where we have a physical presence? | |
| How are we measuring and supporting the psychosocial well-being of our entire global workforce, who now work for a company under explicit threat, not just those in the immediate region? | |
| What single point of failure in our supply chain or data architecture does this threat expose, and what is the board-level timeline to mitigate it? |