Cyber risk has become a governance issue. Under the NIS2 Directive, management bodies of in-scope entities must approve cybersecurity risk-management measures, oversee their implementation and follow training. For financial entities, the Digital Operational Resilience Act places ultimate responsibility for ICT risk on the management body.
Board updates on cyber are often technical and hard to challenge. These questions help shift the conversation to resilience.
- What matters most? Which services and data would cause the most harm if disrupted or exposed?
- How fast can we recover? What are our tolerances for disruption, and have we tested them?
- Who decides in an incident? Are decision rights clear, and do we rehearse them — including regulatory notification?
- Where are we exposed through others? Which suppliers could take us down, and what do we know about their controls?
- How do we know controls work? What independent assurance do we receive, and what did it find?
Good answers will be specific, evidenced and honest about gaps. Vague reassurance is itself a finding.
