Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

When do we…

When do we tell the board about bad news between meetings?

3 decision pointsThe pack behind this answer: Board Cybersecurity Reporting

Add to board memo

The short answer

Recommendation
Send a short note to the chair, without waiting for the meeting, when there is a major incident or a top risk moves past its tolerance limit. All other bad news, including a risk outside appetite but within tolerance, goes first in the next full report.
Reasoning
Boards lose trust through surprise, not through bad news. A problem the board hears about late, or from a regulator, a customer or the press, makes every later report less credible, and directors of regulated entities have duties that depend on being told in time. Tolerance is the point at which the board said it must act, not just be told, so a risk past it needs the board's decision now. The position follows from the risk register, not from how bad the news feels, so the affected risks are re-tested first. The note keeps the four parts of a board report so the chair can read it in minutes.
Considerations
  • The 5 working days is the CISO Times board reporting pack's default. Agree your own number with the board and write it into your reporting procedure.
  • If you cannot yet tell whether it is a major incident, or the re-test is not finished, take the out-of-cycle route. A note the chair did not need costs little; one the chair did not get costs trust.
  • A risk past tolerance always needs a board decision: fund or order treatment, accept the risk explicitly and record why, or change the appetite. Other bad news needs one when fixing it needs money, a change of priority or an acceptance of risk.
  • The chair is the chair of whichever body you report to: the board, or a board risk committee it has delegated to; the management board in a two-tier structure; executive management where there is no board.

The decision, step by step

Select any step for the reasoning behind it and where the pack covers it.

  • Start
  • Step
  • Decision
  • Outcome
StartSomething has gone wrong between board meetingsStepName the bad news and the date it became knownStepRe-test the affected top risks against appetiteDecisionIs it a major incident, or may it become one?StepUse the incident route for timing and contentDecisionHas a top risk moved past its tolerance limit?OutcomePut it first in the next full reportStepSend a note to the chair within 5 working daysStepHave the executive sponsor agree the note before it goesStepWrite it in the four parts, Position firstStepSay what is not yet known, and when it will beDecisionDoes it need a board decision?OutcomePut the decision to the board now, with optionsOutcomeNote sent: it opens the next report as well

Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.

Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one.

Read as text

The same flow written out: each step, its reasoning and where the pack covers it. 14 steps.

  1. Start

    Something has gone wrong between board meetings

    Boards lose trust through surprise, not through bad news. A problem the board hears about late, or from a regulator, a customer or the press, makes every later report less credible. Directors of regulated entities also have duties that depend on being told in time.

    In the pack

  2. Step

    Name the bad news and the date it became known

    Bad news includes a significant incident, a risk moving outside tolerance, a failed recovery test, a supplier failure, a missed commitment to the board, a regulator's enquiry and a serious audit finding. Keep the date it became known: an auditor will compare it with the date the note to the chair was sent.

    In the pack

  3. Step

    Re-test the affected top risks against appetite

    A failed recovery test or a supplier failure may change a risk's score. Compare each affected top risk's new residual level with its category's appetite and tolerance. The position follows from the register, not from how bad the news feels.

    In the pack

    See also

  4. Decision

    Is it a major incident, or may it become one?

    Use the definition of a major incident in your own incident procedure. If you cannot yet tell, treat it as major: a note the chair did not need costs little, and one the chair did not get costs trust.

    In the pack

  5. Step

    Use the incident route for timing and content

    An incident still under way has its own problems: facts are missing, and the board may need to decide within hours. The out-of-cycle rule still applies, and the incident flow shows how to report while the facts are incomplete.

    In the pack

    See also

  6. Decision

    Has a top risk moved past its tolerance limit?

    Tolerance is the point at which the board said it must act, not just be told. One top risk past it makes the whole position 'Outside tolerance'. If the re-test is not finished, take the cautious branch.

    In the pack

  7. Outcome

    Put it first in the next full report

    This includes a risk outside appetite but within tolerance. Report it in the first report after it is known, opening the Position before any good news, with what is being done and by when. Never place it in the appendix or on the last slide. If it later reaches tolerance, it becomes out-of-cycle news.

    In the pack

  8. Step

    Send a note to the chair within 5 working days

    In the pack's defaults, the note reaches the chair within 5 working days of the major incident or of the move past tolerance. Do not wait for the next meeting. Keep the dates the event was known and the note was sent: they are the evidence the rule works.

    In the pack

  9. Step

    Have the executive sponsor agree the note before it goes

    The executive sponsor agrees the finished note before it goes to the chair. That keeps the chair from hearing one account from security and another from management, and it puts an executive behind any decision the note asks for.

    In the pack

  10. Step

    Write it in the four parts, Position first

    Position: where we now stand against appetite, in one sentence. Direction: what has changed since the last meeting. Exposure: which service, what harm, what it cost or may cost as a range. Ask: what the board must decide. The same shape as a quarterly report lets the chair read it in minutes.

    In the pack

  11. Step

    Say what is not yet known, and when it will be

    Never fill a gap with a guess. Name each open question and the date you will answer it, as the pack's example does for funds that may be recovered and other accounts that may be affected. Then send the answer by that date.

    In the pack

  12. Decision

    Does it need a board decision?

    A risk past tolerance always does: the board must decide, not just note. Otherwise, a decision is needed when fixing it needs money, a change of priority or an acceptance of risk.

    In the pack

  13. Outcome

    Put the decision to the board now, with options

    State the options, the recommended one, the cost and the risk of not deciding. For a risk past tolerance the options are to fund or order treatment, to accept the risk explicitly and record why, or to change the appetite. The pack's example proposes a short call to decide rather than waiting for the meeting.

    In the pack

    See also

  14. Outcome

    Note sent: it opens the next report as well

    An out-of-cycle note does not replace the next report. The event opens its Position, and the actions stay in the board's action log until they are closed. Note it against the next meeting in your reporting calendar so it is not forgotten.

    In the pack

Practical checklist

  1. Name the bad news, record the date it became known, and re-test each affected top risk against its appetite and tolerance.
  2. Decide whether it is a major incident, or may become one, using your own incident procedure's definition.
  3. If it is neither a major incident nor a move past tolerance, put it first in the next full report, with what is being done and by when.
  4. Otherwise, write a note to the chair in the four parts: Position, Direction, Exposure and Ask.
  5. Say what is not yet known, and the date you will answer each open question.
  6. Have the executive sponsor agree the note, then send it within the agreed number of days.
  7. Where a decision is needed, put it to the board now, with options, a recommendation, the cost and the risk of not deciding.
  8. Open the next report's Position with the event, and keep its actions in the action log until they close.

Evidence to have ready

  • The out-of-cycle note, with the date the event was known and the date the note was sent.
  • The re-tested risk register entries for the affected top risks.
  • The board's decision, if one was asked for, and the minute recording it.
  • The next report, opening with the event, and the action log carrying its actions to closure.

Assumptions

  • The board has set a cyber risk appetite, and each top risk has a tolerance limit.
  • The top body depends on how you are governed: the board, or a board risk committee it has delegated to; the management board in a two-tier structure; executive management where there is no board. 'The chair' is the chair of that body.
  • The 5 working days is the pack's default. Agree your own number with the board and write it into your reporting procedure.

Not covered here