The five questions the board will ask
Score yourself in ten minutes. Five questions, two points each.
Free online session, Monday 26 October, 12:00–1:00pm AEDT.
You’ve just become responsible for security and there is no CISO: the five questions the board will ask.
Score what is true today, not what is planned. Ten minutes, honestly, is worth more than an afternoon generously. Pick one answer per question; your total and where to start update as you go. Nothing you click here is stored or sent anywhere.
“If something goes wrong tonight, who decides what we do, and when do we hear about it?”
Who decides what, and what gets escalated to whom?
“How much of this are we prepared to lose?”
What level of risk will we carry, in numbers an operating team can use?
“Will this still work when the people who built it leave?”
How are standards written so they survive the next reorganisation?
“We passed the audit. How do you know it’s actually working?”
Where does assurance come from between audits?
“What should we be looking at, and how will we know if it gets worse?”
What does the board actually see, and how often?
What the total means
0 to 3: a policy library. The policies exist; the decisions don’t. Start with question 1: a one-page decision list, signed by the CEO. It costs a page and a signature.
4 to 6: a framework in parts. Usually questions 1 and 5 are done and 2 to 4 are missing. Start with question 3: the owner list tells you which standards are already orphaned.
7 to 10: governance. The remaining points are the ones a regulator, an insurer or a court would ask about first. Start with the lowest row.
The Monday list
- Write the decision list: five decisions, who makes each, the threshold, the turnaround in days. Get it signed.
- Take three questions to the CEO or the chair: how many hours down before the board hears; how much one incident can cost before the board hears; how many control failures a quarter before someone acts.
- List every standard and its owner. Mark the ones whose owner has left.
- Pick three controls you would be embarrassed to find broken. Pull the evidence yourself this month.
- Put your last four board updates side by side. Circle the metrics that appear in all four.
The five questions land differently in every organisation. Send Ilya your score, and he’ll tell you which of the five he would look at first in yours. Twenty minutes, no deck, nothing to prepare.
The email opens in your own mail app with your answers filled in; nothing is sent until you press send.