What CEOs should know about cybersecurity: 12 questions to ask your team

Cyberattacks and data leaks affect organisations of every size, and they are growing in sophistication. Managing that risk needs the attention of the CEO and the leadership team, not only the IT department.

The questions and practices below are adapted from guidance published by the US Cybersecurity and Infrastructure Security Agency (CISA), based on lessons from real incident response.

Questions about the threats you face

• How could a cyber incident affect each part of the business: supply chain, finance, HR and public relations?
• What critical information could we lose: trade secrets, customer data, research or personal data?
• How can we build long-term resilience to reduce our cyber risk?
• Which industry groups do we share threat information with, and could we do more?

Questions to ask your management team

1. When should cybersecurity issues be escalated to executive leadership?
2. What is our current level of cyber risk?
3. What would the business impact be at that level of risk?
4. What is our plan to address the risks we know about?
5. What cybersecurity training do our staff receive?
6. How do we reduce insider threats?
7. How does our security programme apply industry standards and best practice?
8. Are our security metrics measurable and meaningful?
9. How complete are our incident response, business continuity and disaster recovery plans?
10. How often do we exercise those plans?
11. Do our plans cover the whole company or only IT?
12. How prepared are we to work with authorities, incident responders and vendors during an incident?

Seven best practices for leadership teams

1. Make cyber risk a leadership topic. The CEO, with the CISO and CIO, should own the risk strategy and acceptable risk levels, and brief the board regularly. Set policy from the top down so roles are clear.
2. Go beyond compliance. Certifications set a minimum. Adopt recognised best practice, such as the CIS Controls, and tailor it to your business.
3. Assess your specific risks. Identify critical assets and the financial, competitive, reputational and regulatory impact of losing them. Plan for "what if", not "it can't happen here".
4. Use meaningful metrics. Time to patch a critical vulnerability is useful; the number of alerts per week is not.
5. Exercise your plans. Test incident response, business continuity and disaster recovery across the whole organisation, with clear escalation points.
6. Keep skilled people. Tools are only as good as the people using them. Invest in training and plan for the extra workload.
7. Stay aware of threats. Subscribe to threat alerts, join sector information-sharing groups and share recent attack trends with staff outside IT.

Frequently asked questions