Ten questions a non-executive director should ask the CISO
The chief information security officer has twenty minutes, a detailed dashboard and more technical information than the board can reasonably absorb. Directors want to know whether the company is prepared and where their attention is needed.
A useful discussion gives the CISO room to explain uncertainty and the business choices behind it. These questions can help. Select those relevant to the company's risks, and leave time for the answers.
Which business service would hurt most to lose? Ask how cyber exposure affects customers, operations and obligations. The answer should connect to a service the board recognises and a business owner who understands the consequences.
What has changed since our last discussion? Look for changes in threats, systems, suppliers and business activity. A stable dashboard can conceal a material change in exposure or in the assumptions behind its ratings.
Which important risk are we accepting, and who approved it? Ask about exceptions, overdue actions and compensating measures. Acceptance should sit with someone who has the authority to carry the business consequence.
What evidence supports our recovery expectations? Ask for results from relevant exercises and restoration tests, including gaps and dependencies. Distinguish a backup existing from the business demonstrating that it can resume an important service.
Which supplier could stop us operating? Understand the dependency, available assurance and practical alternatives. Ask which parts of the supplier relationship require action from procurement, operations or leadership.
How would a serious incident reach the right people? Follow detection, escalation and decision authority. Check out-of-hours arrangements and who coordinates specialist advice, communications and applicable notifications.
Where does the security team need another function to act? Some problems depend on business processes, contracts or investment choices. Identify the owner and unresolved decision rather than leave every action against the CISO's name.
What does the next spending decision change? Ask which exposure would reduce, what evidence supports the proposal and what remains afterwards. Budget discussions should explain the consequences of both funding and deferring the work.
Where is our confidence weakest? Give the CISO space to describe incomplete coverage, uncertain data or an untested assumption. Directors need to hear what the reporting cannot yet establish.
What decision do you need from us today? Close with the choice, recommendation and consequence of delay. Agree the owner, deadline and evidence that will return to the board.
The quality of the discussion matters more than completing all ten questions. If the answer exposes uncertainty, follow it far enough to understand its practical significance.
After the meeting, check whether the decisions reached the people doing the work. An approved budget, a risk exception or a supplier action should have a named owner and a review point. Return to the evidence when the next report arrives.
Further reading: NCSC Cyber Security Toolkit for Boards and NIST Cybersecurity Framework.
Our technology, AI and cyber oversight service helps boards turn cyber reporting into decisions and accountable follow-up.