What Board Members Should Ask Their Security Team Every Quarter

Boards now carry formal responsibility for cyber risk under rules such as the SEC’s 2023 disclosure requirements and the EU’s NIS2 Directive. A short set of quarterly questions on exposure, detection, response, third parties, and operational technology gives directors real oversight without technical expertise. The answers matter less than how specific they are.

Why Should Boards Review Cyber Risk Every Quarter?

An annual cyber briefing tells a board what the security picture looked like months ago. Threats, systems, and suppliers change faster than that. Mandiant’s M-Trends 2026 report put the global median time an attacker stays undetected at 14 days in 2025, up from 11 the year before, which means a serious intrusion can begin and end between two annual reviews.

Regulation has also raised the stakes for directors personally. In July 2023, the US Securities and Exchange Commission adopted rules requiring listed companies to disclose material cyber incidents within four business days and to describe board oversight of cyber risk each year. The EU’s NIS2 Directive, which member states had to transpose by October 2024, makes management bodies responsible for approving cybersecurity measures and allows them to be held liable for failures.

A quarterly rhythm keeps oversight current without turning the board into a second security team. It also gives directors a pattern: the same questions asked every three months make it obvious when answers change, slip, or become vague. For organizations that run plants, utilities, logistics hubs, or smart buildings, the questions must reach beyond office IT, including whether operational technology is covered by the same team or by specialist OT security services, because a gap there can stop the business rather than just expose its data.

What Should Boards Ask About Exposure and Assets?

Security teams cannot protect what they do not know exists. These questions test whether the organization has a current, honest picture of what it owns and where it is exposed:

A team that answers with numbers and dates is managing its exposure. A team that answers with general reassurance probably is not.

What Should Boards Ask About Detection and Response?

Detection and response questions show whether the organization would notice an attack and how fast it could act. Directors should ask how long it currently takes, on average, to detect and contain a confirmed incident, and how that compares with the previous quarter. They should ask who watches alerts outside working hours, and whether that cover is in-house, outsourced, or missing.

Testing matters as much as tooling. Boards should ask when the incident response plan was last exercised, whether senior leaders took part, and what the exercise revealed. They should also ask whether backups of the most important systems have been restored in a test, not just taken, since a backup that has never been restored is an assumption rather than a control.

Finally, directors should ask what the security team would need to report a material incident within regulatory deadlines. If the answer depends on a process nobody has rehearsed, the board has found a gap worth fixing before it is tested for real.

What Should Boards Ask About Third Parties and Operational Technology?

Suppliers and industrial systems are where many board-level blind spots sit. A few targeted questions bring them into view:

• Which suppliers have privileged or remote access to our systems, and when was that access last reviewed?
• How quickly would we know if a major supplier suffered a breach?
• Which operational technology systems, such as control systems, building management, or production lines, are connected to the corporate network?
• Who is accountable for OT security, and does that person report to the same leadership as IT security?
• When were our OT environments last assessed, and what were the most serious findings?

Answers to the OT questions often reveal that nobody owns the area outright. Engineering teams run the systems, IT teams secure the network, and the space between them goes unwatched.

What Does a Good Answer Sound Like Compared With an Evasive One?

Directors do not need technical knowledge to judge answers. They need to listen for specifics. The table below shows the difference across common question areas.

The pattern is consistent: good answers include numbers, dates, owners, and trends, while evasive answers describe intentions. When a director hears the second kind, the right response is a polite follow-up asking for the figure, the date, or the name, and a note to check the answer again next quarter.