Twelve Questions to Ask Your CISO
You don't need to be technical to oversee cyber risk. You need to ask good questions and listen to the answers.
This is a short book for directors and senior leaders who oversee cyber risk but do not work in security. You do not need to understand the technology. You need to know which questions reveal whether the company is prepared, and how to tell a strong answer from a weak one.
Each chapter is one question. For each, we describe what you should hear, the red flags in an answer, and one follow-up question to ask. The last chapter is the question boards most often wish they had asked before an incident.
Ask one or two questions per meeting, not all twelve at once. The aim is a steady, honest conversation over a year, not an interrogation. A good CISO will welcome these questions. If they do not, that is itself worth noticing.
Contents
Risk and money
What could hurt us, how much, and whether we are spending in the right places.
- Q1: What Could Stop This Company From Operating?First meeting with a new CISO
- Q2: How Much Risk Are We Carrying, in Money?Annual planning
- Q3: Are We Spending the Right Amount on the Right Things?Budget cycle
- Q4: Which Suppliers Could Take Us Down?Annually, and after any big supplier change
Readiness
If something happens tomorrow: who decides, have we practised, can we recover, and when do we tell the market.
- Q5: Who Decides What in the First 24 Hours?Before any incident
- Q6: When Did We Last Practise, and What Broke?Annually
- Q7: Can We Recover, and How Long Would It Take?Annually
- Q8: Who Decides If an Incident Is Material?Before any incident (listed companies)
People and oversight
How the CISO reports to you, what they need, new risks, and the question you will wish you had asked.
- Q9: Are You Reporting Outcomes or Activity?Every board report
- Q10: What Do You Need From Us That You Aren't Getting?Once a year, ideally in a private session
- Q11: What New Risk Are We Taking On With AI?Now, and whenever AI plans change
- Q12: The Question You Didn't Ask Before the IncidentToday
Glossary
- Backup restore test
- Actually recovering data from a backup to prove it works.
- Board oversight
- The board's duty to make sure management is handling risk properly, without running the work itself.
- CISO
- Chief Information Security Officer. Leads the company's security program.
- Containment
- Stopping an incident from spreading.
- Cyber risk
- The chance that an attack or failure of technology harms the business, and how badly.
- Decision rights
- Who is allowed to make which decisions, agreed in advance.
- Exercise
- A practice run of an incident, often a discussion called a tabletop.
- Form 8-K Item 1.05
- The US SEC filing for material cybersecurity incidents, generally due within four business days of deciding an incident is material.
- Govern function
- The part of NIST CSF 2.0 covering cyber strategy, roles, policy and oversight.
- Incident
- An event that harms, or could harm, systems or data.
- Incident lead
- The one person who coordinates the response to an incident.
- Materiality
- Whether an incident is important enough that a reasonable investor would want to know.
- MFA
- Multi-factor authentication. Signing in with something beyond a password.
- NIST CSF
- The US National Institute of Standards and Technology Cybersecurity Framework, a common way to organise security.
- Outcome metric
- A number that changes when risk changes, rather than one that counts activity.
- Privileged access
- Accounts that can change systems or reach sensitive data.
- Ransomware
- Malicious software that locks or steals data and demands payment.
- Recovery time
- How long it takes to get a system working again after an incident.
- Regulation S-K Item 106
- The SEC rule requiring listed US companies to describe cyber risk management and board oversight in their annual report.
- Risk acceptance
- A recorded decision by the right owner to live with a risk.
- Risk appetite
- How much risk the company is willing to carry to pursue its goals.
- Risk owner
- The business leader with authority to decide how a risk is handled.
- Risk quantification
- Estimating cyber risk as a range of possible money losses.
- SEC
- The US Securities and Exchange Commission.
- Supplier risk
- The risk that a vendor's weakness or failure harms your company.
- Tabletop
- A discussion-based exercise where leaders walk through an incident.
Frequently asked questions
What questions should a board ask the CISO?
Start with what could stop the business operating, how much risk that represents in money, who decides what in an incident, and whether recovery has been tested. Finish with: what are you worried about that you haven't told us?
How often should the board hear from the CISO?
Regularly enough that the conversation is ongoing rather than a yearly event. Many boards hear from the CISO at least once a year in full and get shorter updates in between, plus some time without management present.
Does the board need technical knowledge to oversee cyber risk?
No. Directors need to understand the business impact of cyber risk and ask questions that test whether management is prepared. The CISO should explain technical points in plain words.
What is SEC Form 8-K Item 1.05?
It is the filing a US listed company must make for a material cybersecurity incident, generally within four business days of deciding the incident is material.
Other handbooks
- The First 180 Days as a CISO
- Your First Night Shift: The First 180 Days in a SOC
- The Auditor Is Coming: The First 180 Days in GRC
- Shipping Without Saying No: The First 180 Days in AppSec and AI Security
- Your First Security Job: The First 180 Days for Students and Career Changers
Updated 2026-11-14. General guidance, not legal advice. Where a chapter states a law or standard, its sources are listed at the end of that chapter.