Five Questions Every Board Should Ask About Cyber Risk

Cybersecurity has moved from the IT agenda to the board agenda. Customers, insurers, regulators and investors increasingly expect directors to understand how the organization manages cyber risk. Yet many board conversations still focus on tools and technical metrics that make it hard to judge whether the business is actually protected.

Directors do not need to become security specialists. They need to ask questions that reveal whether cyber risk is understood, owned and managed in business terms.

1. What are the few things we cannot afford to lose or have disrupted?

Every organization has a small number of services, data sets and relationships that matter most: the payment platform, the customer database, the production line, the regulator's trust. Security effort should be visibly concentrated on protecting them. If management cannot name them quickly, prioritization is probably unclear.

2. Who owns cyber risk, and how is it reported to us?

Security teams manage controls, but risk ownership belongs to the business. Ask who is accountable, how risk is measured, and how often the board receives an update that describes exposure and trend, not just activity.

3. How would we know if we were compromised, and what happens next?

Detection and response matter as much as prevention. Ask how quickly a serious incident would be identified, who would lead the response, when the board would be informed, and what obligations apply. In Canada, for example, PIPEDA requires organizations to report breaches of security safeguards involving personal information that create a real risk of significant harm. Across Africa, laws such as South Africa's POPIA, Nigeria's Data Protection Act and Kenya's Data Protection Act carry their own notification requirements.

4. Which third parties could hurt us most?

Cloud providers, software vendors, managed service providers and outsourced functions all extend the attack surface. Ask which suppliers have access to critical systems or sensitive data, how they are assessed, and what the contingency is if one of them fails.

5. Are we investing in the right things, and how do we know?

Security budgets should follow risk, not trends. Ask how investment decisions are prioritized, what has measurably improved over the past year, and what risks management is consciously accepting.

The goal is not to eliminate cyber risk. It is to make informed decisions about it, with clear ownership and evidence.

Turning questions into oversight

These questions work best as a recurring structure rather than a one-off conversation. A short, consistent cyber risk report aligned to them, reviewed at least annually in depth and whenever the risk landscape shifts, gives directors what they need to provide meaningful oversight without getting lost in technical detail.