Directors tend to ask the same handful of questions: are we secure, what are our biggest risks, how do we compare, and what happens if we are hit. Answer each with a direct sentence, one supporting fact and one decision you need from them. Avoid jargon and avoid false comfort.
The questions and how to handle them
1. Are we secure? Nobody can say yes. Say what you are confident about, what you are not, and what you are doing about the gap.
2. What are our top risks? Give three to five, in business terms, each with an owner and a trend.
3. How do we compare to peers? Use a recognized framework to show maturity by area, and be candid that comparisons are rough. If you lack peer data, say so.
4. Are we spending enough? Tie spending to the risks it reduces. Offer a baseline and a stretch scenario, and what the difference buys.
5. What would happen if we were breached? Describe the response plan, who decides, how fast you can contain, and when you last practiced. Mention backups and restore tests.
6. How do we know the controls work? Point to evidence: test results, audit findings, exercise outcomes. Controls that are assumed are not controls.
7. What about our vendors? Explain how you tier suppliers, which ones hold sensitive data, and how you track their changes.
8. Are we meeting our legal duties? Work with counsel. For public companies in the United States, the SEC rules expect annual disclosure of risk management processes and board oversight, and prompt reporting of material incidents, so directors will want to know who decides materiality.
9. How are we using AI, and what risk does it add? Describe where AI is used, what data it touches and who approves new uses.
10. What do you need from us? Always have an ask: a policy decision, a budget line, or support for a hard trade with the business.
Preparing for the meeting
Send a short pre-read. Keep slides to what you would say aloud. Prepare one slide for each of the three questions you fear most, and keep them in your back pocket.
Practice with a friendly executive. They will point out the sentence that sounds like jargon.
What not to do
Do not read metrics without saying what changed. Do not bury bad news in the appendix. Do not promise that a breach cannot happen. Directors trust leaders who describe uncertainty clearly more than leaders who sound certain.
Quick check
How long should a board cyber update be?
Fifteen to twenty minutes with time for questions, plus a short pre-read. Depth belongs in the appendix.
What if I do not know the answer?
Say so, and commit to a date. A clear follow-up is better than a guess.
Sources
Last reviewed: 19 October 2026.
