The cyber dashboard is green. What has actually been tested?

The cyber report is reassuring. Training is complete. Backups are running. Most actions are closed, and the dashboard is green.

Those measures can be useful. To assess readiness, the board also needs to understand what has been tested, under which conditions and with what result.

A completed activity and a demonstrated ability to respond answer different questions.

Start with the service the business needs

Choose a critical business service, such as processing payments or serving customers. Ask what would prevent it from operating and how long the business could tolerate the disruption.

Management should explain the important dependencies: systems, data, people and suppliers. An exercise focused on one application may say little about the ability to restore the whole service.

Agree what a credible recovery would look like. A server starting again is one step. Staff also need access, reliable data and a workable process for dealing with the interruption.

Ask what the last recovery test proved

A successful backup does not, on its own, demonstrate that the business can restore what it needs within an acceptable time.

Ask when relevant data was last restored, whether its integrity was checked and whether the people responsible could complete the recovery. Understand which dependencies were included and which were assumed to be available.

The board does not need every technical detail. It needs the result, the limits of the test and an explanation of the gaps that could affect the business. Management should arrange appropriate testing with the teams and suppliers responsible.

Exercise the decisions as well as the technology

In an illustrative incident exercise, the normal email service is unavailable and a key executive cannot be reached. Who can authorise urgent action? How are customers informed? Which decisions belong with management, and when is the board involved?

A discussion exercise can expose unclear authority, outdated contacts or assumptions about supplier support. It has a different purpose from a technical test; both can reveal important weaknesses.

Include the people who would actually respond. Ask what they found difficult, what information was missing and which decisions took too long. Use the findings to improve the arrangements before the next exercise.

Keep unresolved findings in view

A test that reveals a weakness has produced useful information. The concern is a finding that returns at every review without an effective response.

Give significant actions an owner and a deadline. Where a fix is delayed, explain the exposure, any temporary measures and who has accepted the remaining risk. Retest important changes rather than relying solely on a report that the work is complete.

A green dashboard should be understandable. Ask what would turn it amber or red, whether the thresholds reflect the business's critical services and whether any important uncertainties sit outside the reported measures.

One useful question for the next review is: “Which test gave us the strongest evidence that we could recover, and what did it leave unanswered?”

Further reading: NIST's Incident Response Recommendations and Considerations for Cybersecurity Risk Management and Cybersecurity Framework 2.0 reference material.