Chapter 12 of 12 · Today

Q12: The Question You Didn't Ask Before the Incident

What do boards wish they had asked?
How do I get the CISO to tell me the uncomfortable truth?

After an incident, boards often find that someone inside the company knew about the weakness. It was in a report, a ticket or a conversation, and it never reached the board. The question that would have surfaced it is simple.

"What are you worried about that you haven't told us yet?"

Ask it plainly. Ask it privately. Then wait, and do not fill the silence.

What you should hear

Something specific. A system that cannot be patched, a supplier they do not trust, a risk someone accepted that they think was a mistake.
Why it has not come up before: no forum, no time, or a sense the board did not want to hear it.
What it would take to deal with it.

Red flags in the answer

"Nothing." Every CISO worries about something.
A vague answer followed by a change of subject.
A worry that turns out to have been raised internally many times without action.

The question you might not ask out loud

What if the answer is alarming?

Then you have learned it before an attacker taught it to you. Thank the CISO, agree who owns the decision, set a date to hear back, and make sure raising it does not cost them anything. How the board reacts decides whether you hear the next one.

Follow-up

"If this were to cause an incident next year, what would we wish we had done this month?"

Why this matters: most of the questions in this book test the company's preparation. This one tests whether the board is told the truth.

Rule of thumb:The board sets the tone for bad news. Reward the people who bring it.