Before the breach: seven questions a board can ask this quarter

Boards are accountable for cyber risk whether or not they understand it. Regulators increasingly expect directors to show that they oversee it actively, and courts and shareholders tend to judge them by what they asked before an incident far more than by what they said after it. Effective oversight rests on the right questions, asked regularly, and a willingness to press when the answers are vague.

What follows are seven questions any board can put to management this quarter. None needs specialist knowledge to ask. All of them reveal a great deal from the way they are answered.

1. What are the few things we cannot afford to lose?

Some systems matter far more than others. Management should be able to name the handful of services and data sets whose loss or exposure would do the most harm to customers, citizens or the institution itself, and explain how each is protected. A long list suggests the work of prioritising has not been done.

2. How quickly would we know?

Many breaches are discovered months after they begin, often by outsiders. Ask how an intrusion would be detected, by whom, and how quickly the chief executive and the board would be told. If nobody can describe the path from alert to boardroom, it probably does not exist.

3. Who decides, at three in the morning?

Serious incidents force fast decisions: whether to shut down a service, whether to pay a ransom, whether to notify a regulator. Ask who has authority to make each one, and whether they know it. Ambiguity costs hours that cannot be recovered.

A board that has rehearsed an incident recovers faster than one that meets it for the first time.

4. What do we owe, and to whom, and when?

Data protection law and sector rules often set strict deadlines for notifying regulators and the people affected. Ask management to set out those obligations, and to show the drafts that would be used. Writing them during the incident is too late.

5. Which suppliers could hurt us?

Many incidents begin at a supplier: a payroll provider, a software vendor, a cloud host. Ask which third parties hold sensitive data or run critical systems, what the contracts require of them, and how their security is checked.

6. Can we restore, and have we tried?

A backup that has never been restored is only a hope. Ask when the institution last recovered a critical service from backup under realistic conditions, how long it took, and what went wrong.

7. When did we last rehearse?

The most reliable predictor of a good response is practice. Ask when the board last took part in an incident exercise alongside management and the communications team, and what changed as a result. If the answer is never, that is the first thing to fix.

A note on answers

The value of these questions lies as much in how they are answered as in what is said. Precise, candid answers that acknowledge gaps are a good sign. Reassurance without evidence is a warning. Directors should feel entitled to ask for the evidence, and to return to the same questions until the answers improve.