How often should the board discuss cyber security?
At least every quarter as a standing item, and immediately after any serious incident. A quarterly review keeps the same few metrics in front of the board, records decisions and shows trends: open incidents, monitoring coverage, backup tests, overdue patches and reporting deadlines met. Once a year, go further: review the risk register and risk appetite, the incident plan and the insurance cover, and hold a short exercise. Under NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies., the management body of an entity in scope approves the security measures and oversees their implementation, which is hard to show without regular minutes. Keep the minutes and papers: they are evidence that oversight happened. NetSenX PDF reports, available from the Starter plan, can serve as the network annex to each quarterly pack.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.
Read next
Related questions
- How do we check a key supplier before giving it access to our systems?
- How do I answer the board when they ask if we have been hacked?
- Can any tool prove that a company is not hacked?
- What can a network sensor tell the board that antivirus cannot?
- What security evidence does a buyer ask for in due diligence?
Terms used here
- NIS2 (the EU's second Network and Information Security directive)
- The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies.