10 Questions Every Board Should Ask Its CISO

For each question below you get why it matters, what a good answer sounds like, and the warning sign that should make you ask a follow-up.

1. What are our most critical assets, and how do you know the list is complete?

Why it matters: The Code’s first risk management action asks boards to gain assurance that the technology processes, information and services critical to the organisation’s objectives “have been identified, prioritised and agreed”. You cannot protect everything equally, so this list drives everything else.

A good answer sounds like: A short list of the services and data the business cannot run without, each with a named owner and a link to a business objective. The NCSC Toolkit says it is a good sign if critical assets “can each be cross referenced to a clearly stated core business objective”. Expect evidence that the asset inventory is checked and independently audited.

Warning sign: A spreadsheet of hundreds of servers with no ranking, or nobody able to say which systems payroll or customer orders depend on.

2. How much cyber risk are we willing to accept, and where are we outside that today?

Why it matters: Setting and communicating cyber risk appetite is a board job under the Code (Action A3). The NCSC gives a practical example: you might be unwilling to tolerate any significant risk to personal data, yet accept email being unavailable for a day. It also warns about cumulative risk, where several accepted risks land at once.

A good answer sounds like: Specific statements by type of impact (data, downtime, money, reputation), a count of risks inside and outside the agreed threshold, and the cost of bringing the high-priority ones back within it.

Warning sign: “We have a low risk appetite” applied to everything. That sentence cannot guide a single decision.

3. What are our top threats, and how do we know our defences against them work?

Why it matters: The NCSC suggests boards check whether members can name the top threats and the measures in place against them. It notes that for many organisations, ransomware attacks by organised cyber criminal groups are at or near the top of the list.

A good answer sounds like: Three to five threats explained in business terms, each linked to entries in the risk register and to the controls that address it, plus evidence those controls have been tested. Independent testing such as penetration tests or red team exercises gives the board a view that is not marked by the people who built the defences; our post on red and blue teams explains the difference.

Warning sign: A summary of news headlines or vendor threat reports with no link to your business, or controls that have never been tested.

4. When did we last rehearse a serious incident, and what changed afterwards?

Why it matters: The Code asks boards to gain assurance that there is “at least annual exercising” of the incident plan, involving internal and external stakeholders, with lessons fed back into the plan and risk assessments (Action D2). Plans are not universal: the government’s Cyber Security Breaches Survey 2025/2026 found 57% of medium businesses and 76% of large businesses had a formal incident response plan.

A good answer sounds like: A date, a scenario drawn from the risk register, who took part (including board members), and a list of fixes with owners. The NCSC says a plan must set out how severity is determined, delegation of authority for key decisions, and who contacts board members, suppliers and regulators. The NCSC’s Exercise in a Box is a free way to start.

Warning sign: A plan that exists but has never been exercised, no board involvement, or no one sure who can authorise taking a critical system offline at 2am.

5. Which suppliers could hurt us most, and how are we gaining assurance over them?

Why it matters: Action A4 of the Code covers resilience to risks from the supply chain and business partners. It is often weak: the Cyber Security Breaches Survey 2025/2026 found 48% of large businesses reviewed the cyber security risks posed by their immediate suppliers, and 24% looked at their wider supply chain.

A good answer sounds like: Critical dependencies mapped (not just IT services), assessments proportionate to each supplier’s risk, and board-level metrics such as the percentage of suppliers assessed, when they were last assessed and any high-severity issues found. Better still, incident exercises run with key suppliers.

Warning sign: Reliance on contract clauses and questionnaires nobody reviews, or no plan for what happens if a key supplier is compromised.

6. If ransomware hit tonight, how long would it take to restore critical services, and have we proved it?

Why it matters: The NCSC states that up-to-date backups are “the most effective way of recovering from a ransomware attack” and warns that ransomware actively targets backups. The Toolkit asks whether cyber incidents are considered in disaster recovery and business continuity plans.

A good answer sounds like: Recovery times for each critical service, backups kept separate from the main network (offline, or in a cloud service designed for this), and regular restore tests with results reported. Business continuity plans should cover how you operate while systems are down; the NCSC’s own example is making sure staff still get paid if payroll fails.

Warning sign: “We back up everything” with no restore test, or backups that can be deleted using the same administrator accounts an attacker would steal.

7. Would our people report a mistake, and how do we know?

Why it matters: The Code asks boards to promote a cyber security culture that encourages positive behaviours and accountability across all levels (Action C1), and to improve their own cyber literacy (Action C3). The NCSC is clear that “No blame doesn’t mean no accountability”.

A good answer sounds like: Evidence that security policies were designed with HR and the wider business, rising rates of staff reporting suspicious emails, and incident reviews that focus on root causes rather than individuals. Board members should model the behaviour they ask of others.

Warning sign: Incident reports that hunt for someone to blame, or senior staff treated as exceptions to security rules.

8. Which metrics show whether we are getting better, and what tolerances have we agreed?

Why it matters: The Code asks boards to require formal reporting at least quarterly, with suitable metrics and agreed tolerances for each, aligned to the cyber strategy and risk appetite (Action E2). The NCSC warns that if you appear to value the absence of reports of problems, “you incentivise people to keep quiet about issues”.

A good answer sounds like: A small set of trends with target ranges, for example time to patch high-risk vulnerabilities, time from detection to remediation, mean time to detect and recover, and how many staff reported a phishing email, not just how many clicked.

Warning sign: Volume figures such as “attacks blocked” with no context, or a dashboard that is green every quarter.

9. What are our legal and regulatory obligations if something goes wrong, and who acts on each?

Why it matters: Under the Code, directors take responsibility for individual regulatory obligations, such as reporting, in an incident (Action D3). Under UK GDPR, a reportable personal data breach must be notified to the regulator without undue delay and, where feasible, within 72 hours of becoming aware of it. Some organisations also fall under the Network and Information Systems Regulations 2018 or sector rules, and directors have a general duty under section 172 of the Companies Act 2006 to promote the success of the company.

A good answer sounds like: A map of which regulators, customers and insurers must be notified, the deadlines, who decides, and pre-approved communications. The CISO should say which regimes apply and where legal and compliance colleagues take over.

Warning sign: “Legal will handle it” with no timeline, or uncertainty about whether the organisation is in scope of sector regulation.

10. If you had more budget, or less, what would change?

Why it matters: The Code asks boards to gain assurance that resources are allocated effectively to manage the agreed cyber risks (Action B3). The NCSC Toolkit asks: “Can new implementations of cyber security measures be traced to the risks they mitigate?”

A good answer sounds like: Priorities ranked by how much risk they reduce against the agreed appetite, an honest view of what will not be done, and what the board is accepting as a result.

Warning sign: A shopping list of tools with no link to risks, or a request for more money with no trade-offs.

How to use these questions without turning them into an interrogation

The NCSC describes its own board questions as a “starting point”, rather than a checklist. A few practical habits help:

• Spread them out. Take two or three per meeting across the year rather than all ten at once.
• Ask for evidence, not adjectives. Dates, numbers, owners and test results beat “robust” and “mature”.
• Make it two-way. The Code calls for regular two-way dialogue with senior executives, including the CISO (Action E3). Ask what the CISO needs from the board, too.
• Close the follow-ups. A warning sign should become an action with an owner and a date.

Board ownership is still uneven. The Cyber Security Breaches Survey 2025/2026 found 31% of businesses had a board member with responsibility for cyber security, up from 27% the year before and reversing a decline since 2020/2021, rising to 68% among large businesses.

The table below is our own suggested mapping of each question to the Code actions it most closely supports. It is an editorial aid, not part of the Code.

Building board confidence

Asking good questions is easier when directors share a baseline understanding of cyber risk. LSCS runs a Board Governance of Cybersecurity course for directors and senior leaders: 12 hours, delivered as one day in person or five days virtual instructor-led, BCS Tech 10 accredited, and including a role-play Board-CISO conversation simulation. For tailored sessions for a whole board, see enterprise training, or contact us for dates.

Frequently asked questions

What questions should a board ask its CISO?

Ask about critical assets, risk appetite, top threats, incident exercising, supplier risk, backup and recovery, culture, metrics, regulatory obligations and investment priorities. For each, ask for evidence such as dates, owners and test results.

How often should the board get cyber security reports?

The UK Cyber Governance Code of Practice asks boards to require formal reporting on at least a quarterly basis, with agreed metrics and tolerances.

How often should a board exercise its cyber incident plan?

The Code asks boards to gain assurance that the plan is exercised at least annually, involving relevant internal and external stakeholders, with lessons fed back into the plan.

Where can boards find official UK guidance on cyber governance?

Start with the Cyber Governance Code of Practice on GOV.UK and the NCSC’s Cyber Security Toolkit for Boards, which includes a full set of suggested board questions with possible answers.

References

• Department for Science, Innovation and Technology and National Cyber Security Centre, GOV.UK (2025). Cyber Governance Code of Practice. https://www.gov.uk/government/publications/cyber-governance-code-of-practice/cyber-governance-code-of-practice
• National Cyber Security Centre (n.d.). Cyber Security Toolkit for Boards. https://www.ncsc.gov.uk/collection/board-toolkit
• National Cyber Security Centre (2025). Board Toolkit: Questions for the board to ask about cyber security. https://www.ncsc.gov.uk/sites/default/files/documents/NCSC-Cyber-Security-Toolkit-For-Boards-full-question-set.pdf
• National Cyber Security Centre (2023). Cyber security 101 for board members. https://www.ncsc.gov.uk/sites/default/files/2026-08/Board-Toolkit-101_0.pdf
• National Cyber Security Centre (n.d.). Planning your response to cyber incidents (Board Toolkit). https://www.ncsc.gov.uk/collection/board-toolkit/principle-d-incident-planning-response-recovery/planning-your-response-to-cyber-incidents
• National Cyber Security Centre (n.d.). Cyber security regulations and directors duties in the UK (Board Toolkit). https://www.ncsc.gov.uk/collection/board-toolkit/principle-b-strategy/cyber-security-regulation-and-directors-duties-in-the-uk
• National Cyber Security Centre (n.d.). Mitigating malware and ransomware attacks. https://www.ncsc.gov.uk/guidance/mitigating-malware-and-ransomware-attacks
• Department for Science, Innovation and Technology and Home Office (2026, published 30 April 2026). Cyber Security Breaches Survey 2025/2026. https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026
• legislation.gov.uk (current version). UK GDPR, Article 33: Notification of a personal data breach. https://www.legislation.gov.uk/eur/2016/679/article/33
• legislation.gov.uk (2018). The Network and Information Systems Regulations 2018. https://www.legislation.gov.uk/uksi/2018/506/contents/made
• legislation.gov.uk (2006). Companies Act 2006, section 172. https://www.legislation.gov.uk/ukpga/2006/46/section/172