Chapter 10 of 12 · Once a year, ideally in a private session
Q10: What Do You Need From Us That You Aren't Getting?
- Does our CISO have the authority to do the job?
- How can the board help?
CISOs often carry responsibility without matching authority. This question gives them a safe way to say so, and gives you a way to fix it.
What you should hear
- A specific answer: a decision, a reporting line, access to a committee, a budget line, a hire.
- Where they feel unable to act on a risk they own.
- Which business leaders they struggle to get decisions from.
Red flags in the answer
- "Nothing, everything is fine," every year.
- A CISO who only ever meets the board with their manager present and never privately.
- Requests that have been raised before and quietly dropped.
The question you might not ask out loud
Isn't it awkward to ask this with the CEO in the room?
It can be. That is why many boards give the CISO some time without management present, as they often do with auditors. It is not about distrust. It is about making sure bad news can reach you.
Follow-up
"Is there a risk you have raised that you feel has not been decided? Who owns that decision?"
Why this matters: if the CISO lacks authority over the systems they are judged on, problems will be raised but not fixed. The board is one of the few bodies that can change reporting lines, settle disputes between executives and make sure security has a voice in big decisions.
Watch for a mismatch between what the CISO is held accountable for and what they can actually change. If a CISO is responsible for cloud security but has no say over cloud spending or design, the board should know that.
Rule of thumb:A CISO who never asks for anything is either unusually lucky or not telling you something.