Chapter 8 of 14 · Months 3–4
Your First Board Meeting
- What does the board actually want from me?
- How technical should I be?
- What if a director asks a question I can't answer?
Your first board meeting feels like an exam. It is closer to a conversation with people who are responsible for the company and are trying to work out whether they can rely on you. They are not testing your technical knowledge. They are testing your judgement.
What directors usually need
- What are the few risks that could seriously hurt the company?
- Are we doing enough about them, and how would we know?
- What decisions do you need from us?
- If something happened tomorrow, who would do what?
In the United States, listed companies must describe in their annual report how the board oversees risks from cybersecurity threats, and management's role and expertise in managing them. That means directors have their own reason to care about how you report to them. If you work elsewhere, the framing still helps: NIST's Cybersecurity Framework 2.0 added a Govern function, which treats strategy, roles, policy and oversight as part of security, not something separate from it.
How to prepare
- Meet the board chair or the chair of the relevant committee beforehand. Ask what they want to hear and what worried them last time.
- Read past minutes that mention security. Know what was said before you.
- Keep your material short. Three risks, what you are doing, what you need.
- Bring one clear ask: a decision, a risk acceptance, or funding.
- Practise the answers to the questions you hope they won't ask.
The question you might not ask out loud
What if I don't know the answer?
Say so, say when you will come back with it, and then do. "I don't know yet, I will confirm by Friday" is a strong answer. A confident guess that turns out wrong costs you far more credibility than an honest gap.
How technical to be
Use plain words. Translate every technical point into what it could do to customers, revenue, operations or the company's reputation. If you need a technical term, explain it in one sentence the first time. Directors are often experienced and sharp. They just do not share your vocabulary.
Afterwards, write to the chair with a short summary of what was asked, what you promised and when you will report back. Then keep those promises early. Your second meeting will go better if the board can see that what you said last time actually happened.
Rule of thumb:The board does not need you to be certain. It needs you to be clear about what you know, what you do not, and what you are doing about it.