The short answer: Your board will ask whether security spending works, and NACD’s 2026 handbook gives directors the questions. Answer four before the meeting: which critical assets carry the most exposure, whether dashboards match the board’s risk appetite, how threats move enterprise value, and what the risk could cost. Only 10% of directors in Gartner’s global survey strongly trust security’s value.
Written for CIOs, CISOs and IT directors who report to a board: it covers how to prepare for the board’s cybersecurity questions, not which security tools to buy.
Only 10% of non-executive directors express strong confidence in the value of their company’s cybersecurity investments, according to Gartner’s survey of 330 directors (Gartner, 2025). The sample spans North America, Latin America, Europe and Asia/Pacific, so read it as a global mood. Now picture the other 90% at your next board meeting. They won’t ask about patch counts. They’ll ask whether the money is working.
In our campaign research, one buyer question cuts straight to it: who can give us evidence before the next board meeting? Buyers also say they want assessments that prioritize the most critical risks instead of listing every possible issue. A board doesn’t want the list. It wants the ranking.
This guide covers why directors are asking harder questions now, the four questions to answer first, and what a checkable answer looks like for each. It then shows how to rehearse with the Board-Ready Security Report and how to tell the meeting worked. It draws on the buyer questions behind C4’s cybersecurity campaign.
Why Are Boards Asking Harder Cybersecurity Questions Now?
Boards are asking harder cybersecurity questions because directors now have the questions in hand. NACD’s 2026 Director’s Handbook on Cyber-Risk Oversight gives boards eight questions to put to management, from financial exposure on critical assets to how incident reporting is validated. The questions are specific. An update that lists activity won’t answer them.
Directors want better answers, too. In NACD’s surveys, 57% of private-company directors called better cyber-risk reporting from management very or extremely important for the coming year, against 43% of public-company directors (NACD, 2026). A private board may want it more.
Gartner’s survey adds the business frame: one in three non-executive directors named cyber-risks, technology disruption and innovation challenges together among the top external threats to shareholder value for the year ahead. Cyber is one of the threats directors name.
Public companies carry a disclosure duty on top. Since December 2023, SEC rules have required annual 10-K disclosure of the board’s oversight of cybersecurity risk, plus a Form 8-K generally due four business days after an incident is judged material (SEC, 2023). Our piece on board-level governance covers why the status update stopped working. Public or private, the question is the same. Can you show it?
What Cybersecurity Questions Should a Board Ask Management?
NACD lists eight questions a board should ask management about cyber risk, and four of them set the foundation for the rest. Which critical assets carry the most exposure? Do dashboards tie to the board’s risk appetite? How do threats move enterprise value? What could the risk cost? Start with those four.
The other four cover how often reporting is tested, systemic vendor and cloud risks, how complete incident reporting is, and forward-looking projections. They matter, but a CIO who can answer the first four aloud has the spine of every other answer.
1. Which critical assets carry the most financial exposure?
Here’s a detail that’s easy to miss. NACD asks about critical assets and business initiatives in the same breath. A board thinks in revenue lines and launches, not servers. Name the three or four systems that carry a revenue line, a launch or a regulatory duty. Then say which kind of loss each one risks: productivity, incident response costs, fines or reputational damage. Those four loss types are NACD’s own list.
2. Do our dashboards tie to the risk appetite the board approved?
This is where a ranked list beats a complete one. Buyers say they want assessments that prioritize the most critical risks instead of listing every possible issue. A dashboard full of metrics with no line back to the board’s risk appetite is that exhaustive list in chart form. Show directors which measures sit outside the appetite, ranked by business impact. Keep the rest in the appendix. If the board hasn’t set an appetite yet, our explainer on the Govern function is where that conversation starts.
3. How do threats move enterprise value over time?
NACD asks for trendlines across quarters and years, not point-in-time snapshots. Verizon’s 2026 Data Breach Investigations Report gives the outside view: exploiting a vulnerability was the way in for 31% of breaches, and third parties were involved in 48% (Verizon, 2026). That dataset is global, built on more than 22,000 confirmed breaches. Put your own numbers beside last quarter’s. Then say what the change means for operations or revenue.
4. What could the risk cost, in a range?
NACD asks for plausible loss ranges and likelihood, not a single number. IBM’s 2026 Cost of a Data Breach study puts the global average breach at $4.99 million, across 602 organizations (IBM, 2026). Use it as an outside anchor, never as your own number. Then close the loop. Write down the range you gave, and check it against what actually happened before the next meeting.
If you can’t answer all four aloud, one sentence each, your board will find the gap first. Each answer should name a risk, a range, an owner or a date. One that needs a follow-up email reads as no answer. Stuck on one? Let’s work through it
Four Director Questions, Four Answers They Can Check
A credible answer to a board’s cybersecurity question can be checked at the next meeting: it names a risk, a range, an owner or a date. An activity metric can’t be weighed against business risk. Verizon found a median of 43 days to fully fix known exploited vulnerabilities, so a finding is never the whole answer.
The table below sets an activity answer against the checkable answer each question calls for.
| The director asks | An activity answer | An answer they can check |
| Which critical assets carry the most exposure? | A count of systems scanned | Three or four named assets, each with a loss type and an owner |
| Do dashboards tie to our risk appetite? | Every metric the tools produce | The few measures outside appetite, ranked by impact |
| How do threats move enterprise value? | This quarter’s incident count | A trend across quarters, tied to revenue or operations |
| What could the risk cost? | “We’re well protected” | A plausible loss range, with its source named |
Why does the right column work? Each cell gives a director something to compare at the next meeting. A count of systems scanned only goes up. A named asset with an owner can be asked about again, and that is what oversight means.
Remediation is where an answer can slip. Verizon found only 26% of vulnerabilities in CISA’s Known Exploited Vulnerabilities catalog were fully remediated in 2025. A board that hears “we found it” will ask “when is it fixed?” Have the date ready. Our piece on why the assessment alone isn’t the deliverable covers that gap.
One more play: answer in the pre-read, not the meeting. Send the four answers a week ahead, one sentence each, with the one decision you need. Directors arrive having read them. The meeting goes to the decision instead.
Where the Board-Ready Security Report Carries the Proof
Rehearse with the Board-Ready Security Report in hand, starting two weeks before the meeting. Its risk register ties each gap to a business impact, an owner and a priority, which is most of the risk-appetite answer already. Three steps turn the rest of the report into answers a director can check.
- Two weeks out, find each answer in the report. Where one isn’t there yet, such as a loss range, write it down as a gap to close before the meeting.
- One week out, send the pre-read. Four answers, one sentence each, and the one decision you need from directors.
- The day before, rehearse aloud with someone who’ll push back. Have them ask all eight NACD questions cold. Any answer that needs a slide gets rewritten.
Automate the timing, never the human moment. Put the pre-read on the calendar and pull dashboard numbers on a schedule. But the sentence that tells a director what a risk means for the business has to come from a person who can defend it.
No CISO to rehearse with? C4’s fractional CISO advisory can sit in as the skeptical director.
Picture a director asking for the exposure on your top three assets. You should answer with a range and a source in one breath. A pause, or “we’ll follow up,” tells the board the work isn’t done. Not sure your ranges hold? Get a second read
Signals the Board Left With Fewer Questions Than It Brought
Three numbers show the board meeting worked: follow-up requests, the share of answers carrying a range, owner or date, and decisions taken. Count all three from the minutes of your last meeting, then again after the next. NACD asks management for trendlines across quarters, and your own briefing deserves the same test.
Set the baseline before you change anything.
- Follow-up requests. Count every “can you get back to us” in the minutes. The target is fewer each meeting.
- Answers with a risk, range, owner or date. Of the questions directors asked, count how many got one in the room. Aim for all four of NACD’s priority questions.
- Decisions taken. Count the security decisions the board made: funding, a risk accepted or a deadline set. One per meeting is a good start.
Read them together. If follow-ups fall but no decisions get made, the board trusts the reporting but hasn’t been asked for anything, so put a decision in the pre-read. If answers carry ranges but follow-ups stay high, the ranges aren’t sourced well enough to stand, so tie each one to a named source. If all three improve, keep the format and start rehearsing earlier. Vendors get judged the same way, as our look at what CISOs expect shows.
Frequently Asked Questions
A Board-Ready Answer Names a Risk, a Range, an Owner and a Date
Ten percent. That’s the share of non-executive directors in Gartner’s global survey who strongly trust the value of their cybersecurity spending. A CIO can’t change that number alone. But you can walk in with four answers a skeptical director can check, each naming a risk, a range, an owner or a date. Rehearse the questions, not the slides.
The board conversation is yours, and so are the risk calls. C4 Technical Services brings senior practitioners who help get the evidence in shape, from the risk register to the remediation that closes the gaps, and they stay to do the work alongside your team. See how our IT consulting team works, or start a conversation before your next board meeting.
References
- “Gartner Survey Finds 90% of Non-Executive Directors Lack a Measure of Confidence in Cybersecurity Value.” Gartner. Published November 24, 2025. Verified live October 13, 2026.
- “Principle 5: Guide Cybersecurity Risk Measurement and Reporting,” Director’s Handbook on Cyber-Risk Oversight 2026. NACD. Published April 15, 2026. Verified live October 13, 2026.
- “SEC Adopts Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies.” US Securities and Exchange Commission. Published July 26, 2023. Verified live October 13, 2026.
- “2026 Data Breach Investigations Report.” Verizon. Published May 19, 2026. Verified live October 13, 2026.
- “IBM Study: One in Four Malicious Breaches are AI-Enabled, Costing Companies $6 Million on Average.” IBM (Cost of a Data Breach 2026). Published July 29, 2026. Verified live October 13, 2026.
- “NIST Releases Version 2.0 of Landmark Cybersecurity Framework.” NIST. Published February 26, 2024. Verified live October 13, 2026.
