How can a board reduce cybersecurity risk? What to ask and oversee

A board reduces cybersecurity risk by governing, not by operating: set the risk appetite, make sure accountable owners exist, ask for measurable evidence on a regular rhythm, and rehearse the response. NIST's Cybersecurity Framework 2.0 now puts Govern first among its six functions for exactly this reason.

What does NIST say governance is?

CSF 2.0 has six Functions: Govern, Identify, Protect, Detect, Respond and Recover. Govern is the one in which the organization's cybersecurity risk management strategy, expectations and policy are established, communicated and monitored. NIST says it provides outcomes to inform what an organization may do to achieve and prioritize the outcomes of the other five. Its categories include Organizational Context, Risk Management Strategy, Roles, Responsibilities and Authorities, Policy, Oversight, and Cybersecurity Supply Chain Risk Management.

CSF also names its audience broadly: besides cybersecurity program leaders, executives, boards of directors, risk managers and lawyers can use it to guide cybersecurity related decisions. It describes outcomes meant to be understood by executives, managers and practitioners alike, regardless of their cybersecurity expertise.

What do US securities rules require?

For public companies, the SEC's 2023 rules require disclosure of material cybersecurity incidents on Form 8-K Item 1.05, generally due four business days after the company determines an incident is material, with a possible delay if the US Attorney General determines immediate disclosure would pose a substantial risk to national security or public safety. They also add Regulation S-K Item 106, requiring companies to describe their processes for assessing, identifying and managing material cybersecurity risks and to describe the board of directors' oversight of those risks and management's role and expertise. These go in the annual report on Form 10-K. This is a summary of an SEC press release, not legal advice. Your counsel should confirm what applies to you.

What should a board actually ask?

Questions that produce evidence, not reassurance:

• What are our most important assets and what would a serious incident cost us?
• Who is accountable for cyber risk, and do they have authority and budget?
• What is our risk appetite, and where are we outside it?
• How do we know our controls work? When did we last test them?
• What is our plan for a ransomware or data theft event, and when did we last exercise it, with directors in the room?
• Which third parties and software suppliers could take us down?
• When would the board learn of a material incident, and who decides it is material?

A constructed example

A mid-sized company's audit committee asks for a one page quarterly dashboard. It shows four items: percent of critical systems with multifactor authentication, time to patch actively exploited vulnerabilities, last successful backup restore test, and the status of the top three open risks with owners and dates. In the second quarter, restore testing shows a failure for the order system. The committee does not ask for a technical explanation. It asks for a date by which the test passes and an owner, and puts the item on the next agenda. That is governance: attention, accountability, follow up.

How to check or apply this

1. Put cyber risk on a regular board or committee agenda with a standing report.
2. Define risk appetite in business terms and review it annually.
3. Name an accountable executive and confirm they can reach the board directly.
4. Agree a small set of measures that show control effectiveness, and keep them stable so trends are visible.
5. Run a tabletop exercise with directors at least once a year.
6. Ask for a map of key suppliers and software dependencies, and how they are monitored.
7. Agree in advance how incidents are escalated and who determines materiality.
8. Use CSF 2.0 Govern categories as a checklist for gaps.

Quick check

Sources

• NIST: The NIST Cybersecurity Framework (CSF) 2.0
• NIST: Cybersecurity Framework
• SEC press release 2023-139: SEC Adopts Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies

Last reviewed: 18 October 2026.