Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

When do we…

When do we tell the board during an incident?

5 decision pointsThe pack behind this answer: Board Cybersecurity Reporting

Add to board memo

The short answer

Recommendation
Tell the chair of a major incident early, while the facts are still coming in: in the pack's defaults the note is due within 5 working days at the latest. If the board may have to decide within hours, such as on a ransom, bring it in at once through your incident plan.
Reasoning
The board is better served by hearing early and plainly, with the gaps named, than by a complete account a week late. What damages trust is the board learning of a problem from the press, a regulator, a customer or an auditor. Some decisions, such as paying a ransom, belong to the board and may be needed within hours, so they follow the incident plan's escalation route instead of the reporting calendar. A gap is named with the date it will be answered, never filled with a guess.
Considerations
  • 'The chair' is the chair of your top body: the board, a board risk committee it has delegated to, the management board in a two-tier structure, or executive management where there is no board.
  • The same note is due when any top risk moves outside its tolerance limit. A move outside appetite but within tolerance waits for the next report.
  • Keep contained, recovered and cause removed apart. Calling an incident fixed when only the immediate cause is closed is the trap boards remember.
  • The pack sets no fixed update interval during an incident. Update the chair whenever a new fact changes the position, the harm or the cost.

The decision, step by step

Select any step for the reasoning behind it and where the pack covers it.

  • Start
  • Step
  • Decision
  • Outcome
  • Loop back
StartAn incident is under way and the facts are incompleteDecisionIs it a major incident, or may it become one?DecisionDoes it push a top risk past its tolerance limit?OutcomeReport it first in the next full reportDecisionMight the board have to decide within hours?StepBring the board in now, through the incident planStepTell the chair early: the note is due within 5 working daysStepHave the executive sponsor agree the note before it goesStepState what is known, in business termsStepName what is not yet known, and when it will beStepKeep contained, recovered and cause removed apartDecisionDoes the response need money, priority or a risk acceptance?StepPut the decision in the note, with optionsDecisionHas a new fact changed the position, harm or cost?OutcomeThe incident opens the next board report

Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.

Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one.

Read as text

The same flow written out: each step, its reasoning and where the pack covers it. 15 steps.

  1. Start

    An incident is under way and the facts are incomplete

    The pull is to wait until the picture is clear. The board is better served by hearing early and plainly, with the gaps named, than by a complete account a week late. What damages trust is the board learning of a problem from the press, a regulator, a customer or an auditor.

    In the pack

  2. Decision

    Is it a major incident, or may it become one?

    Use the definition in your own incident procedure. Early in an incident the scale is often unclear, so if you cannot yet rule it out, treat it as major. Record the time it became known: the board note is measured from the incident.

    In the pack

    See also

  3. Decision

    Does it push a top risk past its tolerance limit?

    A smaller incident can still move a top risk past the point at which the board said it must act, for example a fraud loss above the limit the board set. If you cannot yet tell, take the cautious branch.

    In the pack

  4. Outcome

    Report it first in the next full report

    A significant incident that is not major and moves no risk past tolerance goes in the first report after it is known, in the Position, with what is being done and by when. If it grows, come back to the start of this flow.

    In the pack

    See also

  5. Decision

    Might the board have to decide within hours?

    Some decisions belong to the board and may be needed within hours. Paying a ransom is one, with legal, ethical and insurance consequences. Your incident plan should name the points at which the board is brought in. If you are not sure whether one has been reached, treat it as reached.

    In the pack

  6. Step

    Bring the board in now, through the incident plan

    Use the escalation route in your incident plan, not the reporting calendar. Give the decision, the options and what is known, and have legal counsel's advice ready where the law is involved. Never present your own view as the organisation's policy on a matter the board has not decided.

    In the pack

  7. Step

    Tell the chair early: the note is due within 5 working days

    The pack says to tell the chair first, and soon. In its defaults the note to the chair is due within 5 working days of a major incident at the latest, and its worked example told the chair within 24 hours. Keep the date the incident was known and the date the note went.

    In the pack

  8. Step

    Have the executive sponsor agree the note before it goes

    The executive sponsor agrees the finished note before it goes to the chair. During an incident this also keeps the chair from receiving different accounts from the response team and from management.

    In the pack

  9. Step

    State what is known, in business terms

    Which service is affected, whom it affects, and what it has cost or may cost, as a range with its basis. Keep system names and technical detail out of the note. Keep the four parts: position, what has changed, the exposure, and any decision needed.

    In the pack

  10. Step

    Name what is not yet known, and when it will be

    For each open question, say what is being done to answer it and by what date, as the pack's example does for other suppliers' accounts that may be affected. Never fill a gap with a guess.

    In the pack

  11. Step

    Keep contained, recovered and cause removed apart

    Say which stage each part of the response has reached. Declaring an incident fixed when only the immediate cause is closed is the trap boards remember. Separate labels let the board see what is still open.

    In the pack

  12. Decision

    Does the response need money, priority or a risk acceptance?

    If it does, the note asks for a decision. A risk now past tolerance always needs one: the board decides to fund or order treatment, accept the risk explicitly, or change the appetite.

    In the pack

  13. Step

    Put the decision in the note, with options

    Give at least two real options, the recommended one, the cost and the risk of not deciding. Propose how the board will decide before its next meeting, such as a short call on a named date.

    In the pack

    See also

  14. Decision

    Has a new fact changed the position, harm or cost?

    Send each promised answer by the date you gave. When a new fact changes the position, the harm or the cost, update the chair on the same basis. The pack does not set a fixed interval for updates during an incident; your incident plan may.

    In the pack

  15. Outcome

    The incident opens the next board report

    At the next meeting the incident opens the Position, before any good news, with what caused it, what has been fixed and what remains. Its actions stay in the board's action log until they are closed.

    In the pack

Practical checklist

  1. Decide whether it is, or may become, a major incident under your own procedure, and record when it became known.
  2. If the board may need to decide within hours, bring it in now through the incident plan's escalation route.
  3. State what is known in business terms: the service affected, whom it affects, and the cost as a range with its basis.
  4. Name each open question, what is being done to answer it and the date it will be answered.
  5. Say which parts are contained, which are recovered and where the cause has been removed.
  6. If the response needs money, priority or a risk acceptance, put the decision in the note with at least two options.
  7. Have the executive sponsor agree the note before it goes to the chair.
  8. Open the next full report with the incident, before any good news.

Evidence to have ready

  • The date the incident became known and the date the note went to the chair.
  • The note as sent, agreed by the executive sponsor.
  • Each promised answer and the date it was sent.
  • The board's decision on any ask, and the incident's actions in the board's action log until closed.

Assumptions

  • Your incident procedure defines what a major incident is and names the points at which the board is brought in. The incident pack that covers this in depth is not yet published.
  • The top body depends on how you are governed: the board, or a board risk committee it has delegated to; the management board in a two-tier structure; executive management where there is no board. 'The chair' is the chair of that body.
  • The 5 working days is the pack's default. Your own reporting procedure may set a shorter limit.

Not covered here