Chapter 2 of 12 · Annual planning
Q2: How Much Risk Are We Carrying, in Money?
- Can cyber risk be put in money terms?
- How precise should I expect those numbers to be?
Boards make decisions in money. Asking the CISO to talk the same way is fair, as long as you accept that the numbers will be estimates.
What you should hear
- A range for the likely cost of the main risks, not a single precise figure.
- How the range was worked out, in plain words, and what assumptions it rests on.
- How the range would change if a planned investment went ahead.
Red flags in the answer
- Very precise numbers with no explanation of where they came from.
- A refusal to estimate at all because "cyber is too unpredictable".
- Generic industry averages presented as if they were this company's numbers.
The question you might not ask out loud
If the numbers are only estimates, why bother?
Because a rough range lets you compare a security investment with other uses of the same money. Without it, every security request is a matter of trust or fear. A stated estimate can also be challenged and improved over time.
Follow-up
"Which single assumption, if wrong, would change this number the most?" A good CISO knows where their estimate is weakest.
Why this matters: without some sense of scale, the board cannot weigh a security request against a new product, a hire or a price cut. A range also lets you set limits, such as the largest loss the company could absorb without changing its plans, and ask whether insurance covers the rest.
Do not expect the first estimate to be good. Expect it to improve. Ask to see the same range next year and what changed it. A CISO who updates their estimate when they learn something is doing the job well.
Rule of thumb:Ask for ranges, and for the reasoning behind them. Precision without reasoning is decoration.