Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

How do we…

How do we prepare for the questions the board will actually ask?

4 decision pointsThe pack behind this answer: Board Cybersecurity Reporting

Add to board memo

The short answer

Recommendation
Rehearse before the papers go, not the night before. Have the executive sponsor mark every sentence a sceptical director would challenge, rehearse the likeliest and the uncomfortable questions, fix the report where you could not answer, and in the meeting never guess a number.
Reasoning
The report says where the organisation stands. The board's questions test whether it trusts that, and the person reporting it. A question you could not answer in rehearsal usually means the report is missing something, so it is fixed before the papers go. Trust is built by accurate answers, not confident ones: a figure said in the meeting goes in the minutes and outlives it, so a figure you do not have is promised by a date, then sent.
Considerations
  • The timings are the defaults in the CISO Times board reporting pack, counted in working days before the meeting: sponsor review at 9, rehearsal at 7, papers at 5, promised answers normally within 5 after. Your board calendar may set different ones. The order of the steps matters more than the days.
  • If you may be in scope of NIS2 or DORA, prepare for questions on compliance, the board's own duties, liability and training. Agree those answers with legal first, say what the law requires in plain terms, and never tell a director they are not liable.
  • After a breach in the news, never answer "it couldn't happen here". Check whether the same route exists here, and if it is not checked yet, say when it will be.
  • Some questions belong to the sponsor, finance or legal. Agree in advance who answers which, so nobody improvises outside their authority.

The decision, step by step

Select any step for the reasoning behind it and where the pack covers it.

  • Start
  • Step
  • Decision
  • Outcome

Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.

Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one.

Read as text

The same flow written out: each step, its reasoning and where the pack covers it. 17 steps.
  1. Start

    The draft report is ready for the sponsor's review

    The report says where the organisation stands. The board's questions test whether it trusts that, and the person reporting it. In the pack's default cycle, the sponsor reviews 9 working days before the meeting and the rehearsal is 7 working days before, leaving time to fix the report before papers go.

    In the pack

  2. Step

    Have the sponsor mark every sentence they would challenge

    The executive sponsor reads the draft and the one-page summary as a director would, and marks every sentence they would question. Each mark becomes a rehearsal question.

    In the pack

  3. Step

    Pick the questions: most likely, uncomfortable, and unanswered

    Take the most likely questions (ten in the pack's default), every uncomfortable one that applies, and any question the board asked last time that the report still does not answer. Uncomfortable ones include: why is this risk still outside appetite, have we been breached, would we pay a ransom, what would you do with more money, what keeps you awake at night.

    In the pack

  4. Decision

    Has a breach in your sector or supply chain been in the news?

    Directors read the same headlines and may be asked about them by customers, investors or their other boards. Check the news and sector alerts since the last meeting. If you are not sure whether a story will come up, prepare for it.

    In the pack

  5. Step

    Prepare a short 'could this happen to us?' note

    In a paragraph: how it happened, in two sentences; whether the same route exists here, checked and not assumed; the answer, yes, partly or no, with the reason; and what is being done. If it is not checked yet, say when it will be. Never answer 'it couldn't happen here', and do not use the headline to ask for money without a costed ask.

    In the pack

  6. Decision

    Is the organisation in scope of NIS2 or DORA?

    Both place duties on the management body itself, so directors ask about compliance, their own duties, liability and their own training. If scope has not been confirmed, prepare as if it applies.

    In the pack

  7. Step

    Agree the regulation and liability answers with legal first

    Expect these questions at every meeting until the board is confident of its duties. Say what the law requires in plain terms and point to legal advice; never tell a director they are not liable. Have the board's training record ready, and the minutes and action log that show its oversight.

    In the pack

  8. Step

    Rehearse with the sponsor, in the time you will have

    Book 60 to 90 minutes (the pack's default) with the sponsor and, if you can, someone who thinks like a director. Present as you will, and stop at the time limit. The sponsor asks the chosen questions in no set order, at least three of them uncomfortable. Answer each in about a minute, with the answer in the first sentence. With no one to rehearse with, record yourself and listen back.

    In the pack

  9. Decision

    Did any question go unanswered, or get a guess or jargon?

    Record each gap: a question you could not answer, answered with a guess, or answered with technical detail. A question you could not answer usually means the report is missing something.

    In the pack

  10. Step

    Fix the report or prepare the answer before papers go

    Correct the report where the rehearsal found a gap. Prepare 'have ready' material for the likeliest questions as a short appendix or notes you carry, not as extra slides. Every figure comes from the signed-off data workbook.

    In the pack

  11. Step

    Agree who answers which questions

    Some questions belong to the sponsor, to finance or to legal: a legal duty, a budget figure, a personnel matter. Decide in advance who takes them, so nobody improvises outside their authority.

    In the pack

  12. Step

    Send the papers, then freeze the figures

    Papers go to the board secretary, by default 5 working days before the meeting. From then on, no figure changes without telling the chair. The day before, brief the sponsor on anything that has changed and read the last minutes and action log.

    In the pack

  13. Decision

    In the meeting, can you answer from evidence you have?

    Trust is built by accurate answers, not confident ones. A figure said in the meeting goes in the minutes and outlives it. If you are not sure of the figure, treat it as not known.

    In the pack

  14. Step

    Answer in one sentence first, then give the reason

    Answer the question asked, first: yes, no, a number, a position. Label facts, estimates and opinions. Do not reassure beyond the evidence: 'it reduces the risk; it doesn't remove it'. Put bad news first. Answer technical questions briefly and offer the detail afterwards.

    In the pack

  15. Step

    Say you don't know, and give a date to come back

    'I don't know' is a complete answer when followed by what you would need to find out, and when. Never guess a number. Give a date, by default within 5 working days, and record it as an action.

    In the pack

  16. Step

    Record commitments, and add new questions to your bank

    Agree the record of decisions and actions with the board secretary, by default 3 working days after the meeting. Add every unexpected question to your own question bank with the answer that worked. If a question shows a measure is missing, check it against your metric selection.

    In the pack

  17. Outcome

    Send every promised answer by its date

    Use a one-page written follow-up to the chair through the board secretary: the question as minuted, a short answer, the detail, the source, what changes, and whether a decision is needed at the next meeting. Within a year your own question bank will be more useful than any template.

    In the pack

Practical checklist

  1. Have the executive sponsor read the draft and the one-page summary and mark every sentence they would challenge.
  2. Pick the likeliest and the uncomfortable questions, and prepare a short "could this happen to us?" note on any breach in the news.
  3. If NIS2 or DORA may apply, agree the regulation and liability answers with legal, and have the board's training record and the minutes and action log ready.
  4. Rehearse in the time you will have, answering each question in about a minute with the answer first.
  5. Record each gap: a question not answered, answered with a guess, or answered with jargon. Fix the report or prepare the answer, and agree who answers which questions.
  6. Send the papers, and change no figure afterwards without telling the chair.
  7. In the meeting, answer first, label facts, estimates and opinions, and give a date for anything you do not know.
  8. Agree the record of decisions and actions with the board secretary, and send every promised answer by its date.

Evidence to have ready

  • The record of questions, answers and commitments from the meeting, agreed with the board secretary.
  • The action log, with each promised answer, its owner and its due date.
  • The written follow-ups sent to the chair through the board secretary, with the date each was promised and sent.
  • Your own question bank, updated with the questions the board actually asked.

Assumptions

  • There is an executive sponsor, or another senior colleague, who can read the draft and play a sceptical director.
  • Timings shown are the defaults in the CISO Times board reporting pack, counted in working days before the meeting. Your board calendar may set different ones. The order of the steps matters more than the days.

Not covered here