BOTTOM LINE Boards rarely ask “are we secure?” They ask what could stop the business, what it would cost, who decides, and whether the money is working. Prepare a short, defensible answer to each of ten questions, and say plainly what you do not know.
FOR CISOs and security leaders preparing for board and executive discussions. The decision it supports: what to measure, prioritize or change before the next board conversation.
Why the questions are sharper now
Board oversight of cyber risk is increasingly written into rules and codes. In the United States, the SEC requires listed companies to describe the board’s oversight of cyber risk and management’s role, and to report a material incident on Form 8-K Item 1.05 within four business days of determining it is material. The UK’s Cyber Governance Code of Practice, published by the National Cyber Security Centre, sets out five principles for boards: risk management, strategy, people, incident planning, response and recovery, and cyber assurance. The EU’s NIS2 Directive requires management bodies to approve and oversee cyber risk measures.
These rules differ in force and reach. The direction is the same. Directors oversee. They need answers they can act on and defend.
The ten questions
| # | Question | What the board is really asking | What a ready answer contains |
|---|---|---|---|
| 1 | What are our most important digital assets, and what would losing them cost? | Do you know what matters? | A ranked list tied to business processes, impact as operational and financial ranges, and a named owner for each. |
| 2 | Which cyber risks are we accepting, and who accepted them? | Is risk being chosen or drifting? | Top risks against stated appetite, exceptions with owners and expiry dates, and any decision needed from the board. |
| 3 | How would we know we are under attack, and how fast? | Can you see? | Detection coverage for the scenarios that matter, measured time to detect and contain from exercises, and known blind spots. |
| 4 | If ransomware hit tomorrow, what stops and for how long? | Can the business survive it? | Recovery times from tested restores set against business tolerance, manual workarounds, and the payment question considered in advance with legal advice. |
| 5 | Who decides what in the first 24 hours? | Is crisis authority clear? | Decision rights, thresholds for notifying regulators and customers, the legal and communications roles, and when executives last practiced it. |
| 6 | Which suppliers could hurt us, and what do we know about them? | Where is the risk we do not control? | A tiered list of critical suppliers, concentration points, notification terms, and which suppliers have been tested. |
| 7 | What are regulators requiring, and where are we short? | What is our compliance exposure? | Obligations by jurisdiction, gaps with dates, and a clear line between being compliant and being secure. |
| 8 | Is the investment working? | What are we getting for the money? | Spend mapped to risks reduced, measures that show change rather than activity, and the cost of not funding. |
| 9 | How do we compare with last period, and with peers? | Are we improving? | A small set of consistent measures over time. Peer comparisons only with stated scope and limits. |
| 10 | What should we be asking that we are not? | What are we missing? | Emerging exposures such as AI adoption, acquisitions, key-person dependence and cloud or identity concentration, plus honest unknowns. |
How to answer
-
Lead with the answer. Give the conclusion, then the evidence. Directors will interrupt anyway.
-
Use ranges. A range with stated assumptions beats a precise figure nobody can defend.
-
Separate fact from judgment. Say what is measured, what is estimated, and what is opinion.
-
Admit unknowns with a plan. “We do not know yet. We will know by this date, through this work” builds more trust than a confident guess.
-
Ask for something. If a decision, budget or risk acceptance is needed, say so on the page.
Measures that hold up under questioning
| Measure | Why it matters | Watch for |
|---|---|---|
| Time to recover critical services, from tested restores | Shows whether resilience is real. | Backup success rates that say nothing about restore. |
| Critical assets exposed to known exploited vulnerabilities | Links exposure to what matters. | Raw patch counts that ignore asset importance. |
| Privileged accounts without strong authentication or recent review | Shows identity risk where impact is highest. | Counting all accounts equally. |
| Critical suppliers assessed in depth, with a tested exit | Shows control over dependency risk. | Questionnaire completion rates. |
| Overdue risk exceptions | Shows whether acceptance is managed. | Exceptions that renew silently. |
| Exercise findings closed | Shows whether practice changes anything. | Exercises held, findings left open. |
Traps
-
A green dashboard that hides what is behind it. Directors learn to distrust it after the first surprise.
-
Compliance percentage presented as security posture. They answer different questions.
-
Industry statistics quoted without scope, source or relevance to your business.
-
Fear as a funding argument. Boards respond to specific scenarios, costed and prioritized.
-
Technical vocabulary where a business consequence would do.
Before the next board meeting
-
Write one-paragraph answers to the ten questions. Where you cannot, note what is missing.
-
Check every number for source, date and scope.
-
Agree with the CEO, CFO and general counsel who speaks to which question.
-
Choose the three decisions or risk acceptances you need from the board.
-
Practice the incident questions with the executives who would act on them.
Sources
-
U.S. Securities and Exchange Commission. Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure, final rule: Form 8-K Item 1.05 and Regulation S-K Item 106. sec.gov
-
UK Government and National Cyber Security Centre. Cyber Governance Code of Practice. gov.uk
-
European Union. NIS2 Directive, Articles 20 and 21, governance and cybersecurity risk-management measures. eur-lex.europa.eu
-
National Institute of Standards and Technology. Cybersecurity Framework 2.0, Govern function. nist.gov
How we label evidence
Facts carry a source. Analysis and recommendations are marked as ours. Examples that are hypothetical are labeled as hypothetical.
Part of the solutionManage Cyber Risk & ExposureKnow what attackers can reach and what it would cost.See how we work →Related service
Board & Executive Advisory
Use this to prepare for executive cyber-risk decisions.