The first board conversation after a cyber incident

The first briefing after a cyber incident may contain more uncertainty than the board would like. That is a reason to organise the uncertainty carefully. Pressing management for a confident explanation before the evidence exists can make the briefing less reliable.

Directors need to understand the business consequences and whether management has the authority and resources to respond. Technical investigation and recovery remain with the responsible teams and specialists.

Separate evidence from assessment

Ask what has been confirmed, what is currently suspected and what is still unknown. Record when the information was checked. Affected services, information exposure and the cause of an incident may become clear at different times.

Management should describe the immediate actions taken and the basis for them. Where an action interrupts an important service, explain the operational consequence and available alternatives. The board needs to understand the judgement without trying to direct the technical response itself.

Avoid treating an early estimate of restoration time as a commitment. Ask which dependencies could change it and when management expects better evidence.

Identify the decisions that cannot wait

Confirm who leads the response and which decisions require escalation. Material expenditure, significant service restrictions or commitments outside existing authority may need a prompt decision through the organisation's agreed arrangements.

Bring the relevant legal, communications, operational and technical specialists into their defined roles. Notification and disclosure questions depend on the organisation, the incident and applicable requirements. The responsible advisers should establish what applies and the deadlines involved.

Use communication arrangements appropriate to the incident. Management should know how it will reach directors if normal channels are unavailable or suspected to be affected.

Agree the next useful update

Set a briefing frequency that reflects the changing situation. Each update should show new evidence, changes in business impact and decisions needed. Directors should receive consistent information through the agreed channel rather than build separate accounts through individual contacts.

Keep a record of significant decisions and their basis. As the situation develops, distinguish a changed judgement based on new evidence from an action that was never taken.

Once operations stabilise, establish how the organisation will check recovery, address outstanding exposures and examine the response. Allocate responsibility for following the resulting actions to completion.

A useful exercise before an incident is to rehearse this first conversation. Give the executive team an incomplete scenario and ask it to brief the chair. The gaps in authority, contact arrangements and business information are often more useful to discover in an exercise than during a real interruption.

Nasaq Partners works with a network of experts on governance, strategy and execution. Explore our advisory services.