Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

When do we…

When do we tell the board about bad news between meetings?

3 decision pointsThe pack behind this answer: Board Cybersecurity Reporting

Add to board memo

The short answer

Recommendation
Tell the chair within 24 hours of becoming aware of a major incident, then send a short written note within 5 working days. When a top risk moves past its tolerance limit, send the note within 5 working days. All other bad news, including a risk outside appetite but within tolerance, goes first in the next full report.
Reasoning
Boards lose trust through surprise, not through bad news. A problem the board hears about late, or from a regulator, a customer or the press, makes every later report less credible, and directors of regulated entities have duties that depend on being told in time. Tolerance is the point at which the board said it must act, not just be told, so a risk past it needs the board's decision now. The position follows from the risk register, not from how bad the news feels, so the affected risks are re-tested, after the chair has been told of a major incident. The note keeps the four parts of a board report so the chair can read it in minutes.
Considerations
  • The 24 hours and the 5 working days are the CISO Times board reporting pack's defaults. Agree your own times with the board and write them into your reporting procedure. Where your incident procedure sets a faster time for the most severe incidents, that faster time governs.
  • If you cannot yet tell whether it is a major incident, take the incident route. A call to the chair that was not needed costs little; one the chair did not get costs trust.
  • A risk past tolerance always needs a board decision: fund or order treatment, accept the risk explicitly and record why, or change the appetite. Other bad news needs one when fixing it needs money, a change of priority or an acceptance of risk.
  • The chair is the chair of whichever body you report to: the board, or a board risk committee it has delegated to; the management board in a two-tier structure; executive management where there is no board.

The decision, step by step

Select any step for the reasoning behind it and where the pack covers it.

  • Start
  • Step
  • Decision
  • Outcome
StartSomething has gone wrong between board meetingsStepName the bad news and the date it became knownStepRe-test the affected top risks against appetiteDecisionIs it a major incident, or may it become one?StepTell the chair within 24 hours of becoming awareStepRe-test the affected top risks against appetiteDecisionHas a top risk moved past its tolerance limit?OutcomePut it first in the next full reportStepSend the written note to the chair within 5 working daysStepHave the executive sponsor agree the note before it goesStepWrite it in the four parts, Position firstStepSay what is not yet known, and when it will beDecisionDoes it need a board decision?OutcomePut the decision to the board now, with optionsOutcomeNote sent: it opens the next report as well

Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.

Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one. A code beside a source, such as RR-17, is the number of a rule in that pack document; the document lists its rules.

Read as text

The same flow written out: each step, its reasoning and where the pack covers it. 15 steps.

  1. Start

    Something has gone wrong between board meetings

    Boards lose trust through surprise, not through bad news. A problem the board hears about late, or from a regulator, a customer or the press, makes every later report less credible. Directors of regulated entities also have duties that depend on being told in time.

    In the pack

  2. Step

    Name the bad news and the date it became known

    Bad news includes a significant incident, a risk moving outside tolerance, a failed recovery test, a supplier failure, a missed commitment to the board, a regulator's enquiry and a serious audit finding. Keep the date it became known: an auditor will compare it with the dates the chair was told and the note was sent.

    In the pack

  3. Step

    Re-test the affected top risks against appetite

    A failed recovery test or a supplier failure may change a risk's score. Compare each affected top risk's new residual level with its category's appetite and tolerance. The position follows from the register, not from how bad the news feels.

    In the pack

    See also

  4. Decision

    Is it a major incident, or may it become one?

    Use the definition of a major incident in your own incident procedure. If you cannot yet tell, treat it as major: a call to the chair that was not needed costs little, and one the chair did not get costs trust.

    In the pack

  5. Step

    Tell the chair within 24 hours of becoming aware

    In the pack's defaults the chair is told within 24 hours of the organisation becoming aware of a major incident. If you cannot yet say what happened, say what is known and when the next update comes. Where the Incident Response pack's most severe level applies, its faster time (the chair within 4 hours of declaration) governs. The incident flow shows how to report while facts are incomplete.

    In the pack

    See also

  6. Step

    Re-test the affected top risks against appetite

    A failed recovery test or a supplier failure may change a risk's score. Compare each affected top risk's new residual level with its category's appetite and tolerance. The position follows from the register, not from how bad the news feels.

    In the pack

    See also

  7. Decision

    Has a top risk moved past its tolerance limit?

    Tolerance is the point at which the board said it must act, not just be told. One top risk past it makes the whole position 'Outside tolerance'. If the re-test is not finished, take the cautious branch.

    In the pack

  8. Outcome

    Put it first in the next full report

    This includes a risk outside appetite but within tolerance. Report it in the first report after it is known, opening the Position before any good news, with what is being done and by when. Never place it in the appendix or on the last slide. If it later reaches tolerance, it becomes out-of-cycle news.

    In the pack

  9. Step

    Send the written note to the chair within 5 working days

    In the pack's defaults, the written note reaches the chair within 5 working days: for a major incident, after the chair has been told; for a top risk past tolerance, of the move past tolerance. Do not wait for the next meeting. Keep the dates the event was known, the chair was told and the note was sent: they are the evidence the rule works.

    In the pack

  10. Step

    Have the executive sponsor agree the note before it goes

    The executive sponsor agrees the finished note before it goes to the chair. That keeps the chair from hearing one account from security and another from management, and it puts an executive behind any decision the note asks for.

    In the pack

  11. Step

    Write it in the four parts, Position first

    Position: where we now stand against appetite, in one sentence. Direction: what has changed since the last meeting. Exposure: which service, what harm, what it cost or may cost as a range. Ask: what the board must decide. The same shape as a quarterly report lets the chair read it in minutes.

    In the pack

  12. Step

    Say what is not yet known, and when it will be

    Never fill a gap with a guess. Name each open question and the date you will answer it, as the pack's example does for funds that may be recovered and other accounts that may be affected. Then send the answer by that date.

    In the pack

  13. Decision

    Does it need a board decision?

    A risk past tolerance always does: the board must decide, not just note. Otherwise, a decision is needed when fixing it needs money, a change of priority or an acceptance of risk.

    In the pack

  14. Outcome

    Put the decision to the board now, with options

    State the options, the recommended one, the cost and the risk of not deciding. For a risk past tolerance the options are to fund or order treatment, to accept the risk explicitly and record why, or to change the appetite. The pack's example proposes a short call to decide rather than waiting for the meeting.

    In the pack

    See also

  15. Outcome

    Note sent: it opens the next report as well

    An out-of-cycle note does not replace the next report. The event opens its Position, and the actions stay in the board's action log until they are closed. Note it against the next meeting in your reporting calendar so it is not forgotten.

    In the pack

Practical checklist

  1. Name the bad news, record the date and time it became known, and decide whether it is a major incident, or may become one, using your own incident procedure's definition.
  2. If it is, including any Severity 1 or Severity 2 incident, tell the chair within 24 hours of becoming aware (sooner where the incident pack sets a faster time), saying what is known and when the next update comes.
  3. Re-test each affected top risk against its appetite and tolerance.
  4. If it is neither a major incident nor a move past tolerance, put it first in the next full report, with what is being done and by when.
  5. Otherwise, write the note to the chair in the four parts: Position, Direction, Exposure and Ask, and say what is not yet known and the date you will answer each open question.
  6. Have the executive sponsor agree the note, then send it within 5 working days (for a major incident, of the chair being told; for a risk past tolerance, of the move).
  7. Where a decision is needed, put it to the board now, with options, a recommendation, the cost and the risk of not deciding.
  8. Open the next report's Position with the event, and keep its actions in the action log until they close.

Evidence to have ready

  • The date the event was known, the date and time the chair was told, and the date the written note was sent.
  • The re-tested risk register entries for the affected top risks.
  • The board's decision, if one was asked for, and the minute recording it.
  • The next report, opening with the event, and the action log carrying its actions to closure.

Assumptions

  • The board has set a cyber risk appetite, and each top risk has a tolerance limit.
  • The top body depends on how you are governed: the board, or a board risk committee it has delegated to; the management board in a two-tier structure; executive management where there is no board. 'The chair' is the chair of that body.
  • The 24 hours and the 5 working days are the pack's defaults. Agree your own times with the board and write them into your reporting procedure.

Not covered here