Cybersecurity for Boards and Executives: Asking the Right Questions

Cybersecurity has moved from a technical topic managed by IT departments to a governance issue that sits firmly within the responsibilities of boards of directors, elected officials, and senior executive leadership. Regulatory requirements increasingly mandate board-level engagement: the SEC now requires public companies to disclose material cybersecurity incidents within four business days and to describe board oversight of cybersecurity risk in annual reports. State attorneys general have brought enforcement actions against executives who failed to adequately oversee cybersecurity practices at their organisations.

Yet most boards and executive teams feel genuinely under-equipped to exercise meaningful oversight of cybersecurity. The technical complexity is intimidating. The terminology is impenetrable. The annual presentation from the CISO feels simultaneously alarming and impossible to evaluate. This guide is designed to change that.

Why Boards Must Engage with Cyber Risk

The financial exposure from cyber incidents is now sufficiently large and predictable to constitute a material business risk requiring board-level attention, in the same category as legal and regulatory risk, operational risk, and financial risk.

The average total cost of a data breach for an organisation of 10,000+ employees exceeds $5 million. For government entities, the combination of direct costs, remediation, legal liability, and reputational damage routinely reaches eight or nine figures. Ransomware attacks have forced local governments into bankruptcy proceedings. Healthcare ransomware has triggered patient safety events. Supply chain cyberattacks have disrupted operations for months.

These are not tail risks to be dismissed. They are foreseeable consequences of inadequate investment in a foreseeable risk that is well within an organisation's ability to substantially mitigate.

The Board's Role: Oversight, Not Operations

Boards and elected officials are not expected to understand the technical details of cybersecurity implementation. That is what CISOs, IT leaders, and security teams are for. The board's role is to ensure that:

1. The organisation has assessed its cyber risk

2. Appropriate resources have been allocated to address that risk

3. Management is held accountable for security outcomes

4. The organisation is prepared to respond effectively if a significant incident occurs

5. Disclosure obligations are met promptly and accurately

This is not fundamentally different from board oversight of other complex risk domains — legal, financial, environmental — where boards set direction and hold management accountable without personally conducting legal work, financial analysis, or environmental assessments.

The Questions Every Board Should Ask

The most effective board engagement with cybersecurity happens through the right questions — questions that require honest, specific, actionable answers rather than reassuring generalities.

On risk understanding:

- "What are our three most significant cyber risks right now, and how do we know?" A well-run security programme can answer this specifically. 'Our primary risk is ransomware delivered through phishing emails targeting our finance team, because our industry is specifically targeted and our email filtering does not block all malicious attachments' is a useful answer. 'We face various cyber threats' is not.

- "How do we compare to peers in our sector?" Benchmarking security investment and posture against comparable organisations provides context for whether current investment is appropriate.

On controls and investment:

- "What would an attacker need to do to access our most sensitive systems, and what is stopping them?" This question cuts through technical jargon to the fundamental security question.

- "What percentage of our IT budget goes to cybersecurity, and is that appropriate?" Industry guidance typically suggests 8-15% of IT budget for cybersecurity, varying by sector and risk profile.

- "When did we last test our defences with a third-party penetration test or red team exercise?" Organisations that only hear from their internal team about security posture have no independent validation.

On incidents and response:

- "Have we had any significant security incidents in the past year, including incidents that were contained before becoming serious?" Many boards only hear about incidents that become public crises, rather than the broader pattern of incidents that their security teams are managing.

- "If we experienced a ransomware attack tomorrow, what would happen in the first 24 hours?" This question should produce a specific, tested answer — not a reference to a written plan that has never been exercised.

- "Do we have cyber insurance, and have we verified that our actual practices meet the policy requirements?" Many organisations discover that their cyber insurance policies exclude coverage for incidents because they did not implement the controls the policy required.

On third parties and supply chain:

- "Who are our most significant third-party technology vendors, and have we assessed their security practices?" Most significant cyber incidents in recent years have involved third-party compromise.

- "What happens to our operations if our largest technology vendor is breached?" Understanding third-party dependencies is essential for business continuity planning.

Translating Technical Risk into Business Language

CISOs and security teams often struggle to communicate effectively with boards because they present technical findings rather than business risk. Boards are equipped to make decisions about business risk — decisions that involve trade-offs between investment and exposure, between operational impact and security benefit. They are not equipped to make decisions about whether to implement a specific technical control.

The appropriate framing for board communication is:

- *Risk*: "Our patient data systems have a vulnerability that an attacker could exploit to access 500,000 patient records."

- *Likelihood*: "This type of vulnerability is actively targeted by ransomware groups that have attacked three comparable hospital systems in the past year."

- *Impact*: "A successful attack would likely result in HIPAA notification requirements, OCR investigation, and average direct costs of $8 million based on comparable incidents."

- *Mitigation*: "Patching this vulnerability requires 8 hours of scheduled downtime and $45,000 of professional services. Not patching it maintains our current exposure."

This framing enables the board to make an informed governance decision. The question of whether to patch is not technical — it is a business decision about acceptable risk.

Regulatory Obligations for Boards

Board members and elected officials should be aware of their specific obligations around cybersecurity:

Public company boards must ensure timely disclosure of material cybersecurity incidents under SEC rules, and must assess whether board members have cybersecurity expertise (or disclosure that they do not).

Government entity leadership must ensure compliance with applicable frameworks (FISMA for federal agencies, state equivalents for state and local government) and bear political accountability for significant cyber incidents.

Healthcare board members must ensure HIPAA compliance and may face personal liability for breaches resulting from inadequate oversight.

Building Board Cyber Competence

Boards that are most effective in cyber oversight have invested in building their own understanding:

Annual cybersecurity briefings by the CISO, using consistent metrics that enable year-over-year comparison.

Periodic engagement with third-party security experts to provide independent perspectives on the organisation's security posture — not filtered through internal management.

At least one board member with cybersecurity expertise, or a board-level cybersecurity advisory committee.

Tabletop exercises that simulate significant cyber incidents and test the board's own role in responding — communications decisions, disclosure decisions, and management accountability.

0g0 Aegis provides executive and board-level cybersecurity briefing services that are specifically designed for non-technical leadership. We translate technical risk into the business language that governance requires, provide honest independent assessments of security posture, and facilitate tabletop exercises that test the full chain of response from technical incident to board communications decision.