Short answer
A bank board should ask fewer questions about activity and more about outcomes: which essential services matter most, how long customers can tolerate them being down, what evidence shows the bank can recover within that time, and who is accountable if it cannot. A green dashboard does not answer any of those questions.
Five questions worth asking at the next meeting
- Which of our important business services would cause the most customer harm if disrupted, and are they the ones our cyber reporting focuses on?
- When did we last prove, not assume, that we could restore those services within tolerance?
- Which suppliers could stop one of those services, and what would we do on day one if they did?
- What has changed in our risk position since the last report, and why?
- Which senior manager is accountable for each answer, and would they be comfortable defending it to a supervisor?
What a good answer looks like
- It is specific to named services, not to the organisation in general.
- It is backed by tested evidence such as exercises, recovery tests and independent review, not self-assessment alone.
- It admits gaps and shows a dated plan to close them.
- It lets the board make a decision, such as accepting, funding or challenging a risk.
Warning signs
- Reporting dominated by counts: patches applied, phishing click rates, training completion.
- Every indicator is green, yet nobody can describe the last serious incident or near miss.
- Third-party risk is reported as a percentage of suppliers assessed rather than by critical dependency.
Professor Buck Rogers' view
Boards are not expected to be technical. They are expected to be curious and to insist on evidence. The most useful question I have seen a non-executive ask is simply: how do we know?
Former CISO at the Bank of England and creator of the CBEST framework.