Questions directors and executives should ask before a cyber incident tests governance, decision rights and resilience. Use it to prepare for a board discussion, or as a checklist before commissioning training or an exercise.
Strong cyber governance is easier to build when ownership, decision rights and priorities are explicit before an incident, not during one.
Directors cannot oversee cyber risk without knowing which services and information the organization cannot afford to lose. This list drives recovery priorities, investment and exercise scenarios.
Questions to ask
Cyber risk is a business risk. Someone in management should own it, and the board should know who that is and how it is reported.
Questions to ask
In a major incident, decisions come fast: shutting down systems, notifying regulators, engaging law enforcement, communicating publicly and, in ransomware cases, whether to engage with the attacker. Decide in advance who can make each call.
Questions to ask
Many notification obligations depend on how quickly an incident is recognized as material. Escalation thresholds should be written down and tested.
Questions to ask
Critical services often depend on a small number of suppliers, cloud providers or managed service providers. A failure or compromise at one of them can become your incident.
Questions to ask
A plan that has never been exercised is an assumption. A facilitated tabletop exercise lets directors and executives practise decisions under time pressure and reveals gaps safely.
Questions to ask
Last reviewed September 24, 2026. This guide is general information, not legal advice. Print or save this page to use it as a workshop handout or pre-engagement checklist.
C3SA can help validate the current state, identify material gaps, define the target state and support implementation, testing and readiness.
