If the board asks "are we secure?", then how do I answer honestly?

Start

A director asks: "Are we secure?"

The board will judge the organisation's security partly by whether it trusts the person reporting. Trust comes from accurate answers, not confident ones. A 'yes' goes in the minutes and is hard to live with after an incident; a vague 'mostly' tells the director nothing.

• Then: Answer it as "are we within the risk we agreed?"

Step

Answer it as "are we within the risk we agreed?"

Security is not a state an organisation reaches. What the board can judge is whether the risk it carries is within the amount it agreed to carry. That is the one question only the board owns, because it set the appetite. Say so in a sentence, then answer that question.

• Then: Has the board approved a cyber risk appetite?

Decision

Has the board approved a cyber risk appetite?

Without an appetite there is no yardstick, so there is no position to report. An appetite that says only 'low' cannot be tested either. It needs a level for each kind of risk that a register score can be compared with.

• Yes: Do you have the current, signed-off position to hand?
• No, or not known: Say you cannot yet answer, and ask the board to set one

Outcome

Say you cannot yet answer, and ask the board to set one

Say: 'The board has not yet set a cyber risk appetite, so we cannot say whether our exposure is acceptable.' Do not invent a position. Make agreeing an appetite the first decision you put to the board, drafted from the register and agreed by the executives who own each kind of risk.

Decision

Do you have the current, signed-off position to hand?

The answer should come from the figures signed off for this meeting, not from memory. If you do not have them with you, say so and promise the position by a date. A position guessed in the meeting goes in the minutes.

• Yes: Is any top risk past its tolerance limit?
• No: Promise the answer by a date, and send it

Decision

Is any top risk past its tolerance limit?

The position follows a rule, not a feeling. One top risk past its own tolerance limit makes the whole position 'Outside tolerance', however many others are within appetite and whatever the other measures say.

• Yes, or not known: Lead with "outside tolerance" and the decision it needs
• No: Is any top risk above appetite?

Step

Lead with "outside tolerance" and the decision it needs

Say it first, before any good news. The board must decide, not just note: fund or order treatment, accept the risk explicitly and record why, or change the appetite. If there is no decision on the agenda, say one is needed.

• Then: Add the count, the movement and the date back

Decision

Is any top risk above appetite?

Above appetite but within tolerance means a risk the board accepted for a time, while a plan brings it back. The board allowed it for a time; it is not 'secure' either.

• Yes, or not known: Say "outside appetite, within tolerance", with the plan
• No: Say "within appetite", and what that does not mean

Step

Say "outside appetite, within tolerance", with the plan

Name how many top risks are above appetite, that none is past tolerance, and the plan and date to bring each back. The board may note the plan, challenge it, or decide if it needs money or a change of priority.

• Then: Add the count, the movement and the date back

Step

Say "within appetite", and what that does not mean

Every top risk is at or below the level the board accepted. That does not mean nothing can happen: it means the risks carried are the ones the board chose to carry. If every measure has been on target quarter after quarter while incidents happen elsewhere, check the targets: the pack treats that as a sign of measuring the wrong thing.

• Then: Add the count, the movement and the date back

Step

Add the count, the movement and the date back

One sentence: how many of the top risks are above appetite and past tolerance, how that compares with last time, and when each will be back within appetite. That is the whole answer; the rest supports it.

• Then: Do not reassure beyond the evidence

Step

Do not reassure beyond the evidence

Avoid 'we are fully protected', 'it could not happen here' and an unqualified 'we are compliant'. Say instead that a control is in place, when it was tested, and that it reduces the risk without removing it. A certificate shows a management system works; it does not show a risk is within appetite.

• Then: Label facts, estimates and opinions

Step

Label facts, estimates and opinions

'The figure is…', 'We estimate…', 'My view is…'. A director should never mistake one for another. If asked whether you have been breached, say what you have found no evidence of, and what you would be able to see.

• Then: Was there a figure or fact you did not have?

Decision

Was there a figure or fact you did not have?

'I don't know' is a complete and acceptable answer when it is followed by what you would need to find out, and when. A figure said in the meeting goes in the minutes and outlives the meeting, so never guess one.

• Yes: Promise the answer by a date, and send it
• No: Answered: the minutes record the position, not a promise

Outcome

Promise the answer by a date, and send it

Give a date, normally within 5 working days in the pack's defaults. Have it recorded as an action, and send a one-page written answer to the chair through the board secretary by that date.

Outcome

Answered: the minutes record the position, not a promise

The board now knows where it stands against its own appetite, in words it can hold you to. Afterwards, add the question and the answer that worked to your own copy of the question bank.