What should the board ask the CISO? Seven questions that get real answers

Don't ask "are we secure?" There's no honest answer to it. Ask instead: what are the three things that would hurt this company most, and how exposed are we to each? How would we know if it was happening right now? Who can make the big decisions during an incident, and have they rehearsed? What have we actually tested this year, and what did it find? Where are we accepting risk on purpose, and who signed for it? What's changed since you last briefed us? And: what do you need from this board that you're not getting? A CISO who can answer those seven, with evidence, is doing the job. A board that asks them is doing its job.

Why the usual questions fail

"Are we secure?" and "are we compliant?" invite reassurance, and a CISO under pressure will give it. The result is a quarterly slide with green dials that tells directors nothing they could act on. The oversight guidance that boards actually get judged against has moved past this. NACD's current handbook for directors frames cyber risk as a strategic risk to be governed, not a technical report to be received, and expects boards to guide how it's measured and reported rather than accept whatever arrives (National Association of Corporate Directors & Internet Security Alliance, 2026). The SEC now requires public companies to describe the board's oversight of cybersecurity risk and management's role in assessing it (U.S. Securities and Exchange Commission, 2023). "We received a briefing" is a thin description.

The seven questions, and what a good answer sounds like

1. What would hurt us most, and how exposed are we? A good answer names specific scenarios in business terms: a ransomware outage of the plant, theft of the customer database, a fraudulent payment, a compromised product update. Then it says, for each, how likely and how bad, and what's been done about it. A weak answer lists threats from the news.

2. How would we know? This is the detection question. The answer should describe what's monitored, what isn't, and how long an attacker could plausibly operate before being seen. "We have a SOC" isn't an answer. "We'd see a compromised admin account within an hour; we wouldn't reliably see data leaving through a cloud service" is.

3. Who decides during an incident, and have they rehearsed? You want names, a decision structure, and the date of the last exercise that involved executives, not just the technical team. If the answer is "we have a plan," ask when it was last used.

4. What did we test, and what did it find? Penetration tests, restore tests, phishing exercises, tabletop results. The point isn't the pass rate. It's whether the findings were fixed and whether the same things keep being found. A CISO who brings you an uncomfortable finding is giving you something valuable.

5. Where are we accepting risk, and who signed? Every organisation runs with known gaps. The question is whether they're written down, owned by a named executive, and revisited. NIST's framework puts this squarely under governance: risk appetite and accountability are leadership decisions, not security-team ones (Pascoe et al., 2024).

6. What's changed? New systems, new vendors, new regulations, new threats that matter to us specifically, departures from the team. A programme that reports the same thing every quarter either isn't changing or isn't looking.

7. What do you need from us? Budget, authority, a decision, air cover with a business unit that won't cooperate. If the CISO says "nothing," they're being polite. Press.

How often, and in what form

A full discussion at least annually, a short update each quarter, and an immediate briefing when something material happens. The format should be a page of narrative with evidence behind it, not a deck of dials. CISA's cross-sector performance goals are a reasonable baseline for a board to ask about: they're a short, prioritised list of practices that measurably reduce risk, and "where do we stand against these" is a fair question to put to any security leader (Cybersecurity and Infrastructure Security Agency, 2025).

What I'd do next

Send the seven questions to your CISO a week before the next meeting, with a note that you'd like evidence, not assurance. The quality of the answers will tell you more about your programme than any audit. If you'd like an independent read on what comes back, or help preparing the board for the conversation, request a briefing. I've written at length about what a board report should contain in What a Cybersecurity Board Report Should Actually Answer.