# How often should the board discuss cyber security?

At least every quarter as a standing item, and immediately after any serious incident. A quarterly review keeps the same few metrics in front of the board, records decisions and shows trends: open incidents, monitoring coverage, backup tests, overdue patches and reporting deadlines met. Once a year, go further: review the risk register and risk appetite, the incident plan and the insurance cover, and hold a short exercise. Under NIS2, the management body of an entity in scope approves the security measures and oversees their implementation, which is hard to show without regular minutes. Keep the minutes and papers: they are evidence that oversight happened. NetSenX PDF reports, available from the Starter plan, can serve as the network annex to each quarterly pack.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

FAQ: [For the board and finance](https://netsenx.com/en/faq/board) · https://netsenx.com/en/faq/how-often-should-the-board-discuss-cyber-security

## Read next

- https://netsenx.com/en/problems-we-solve
- https://netsenx.com/en/blog/2026-10-09_cybersecurity-for-the-board
- https://netsenx.com/en/pricing

## Related questions

- [How do we check a key supplier before giving it access to our systems?](https://netsenx.com/en/faq/how-do-we-check-a-key-supplier-before-giving-it-access)
- [How do I answer the board when they ask if we have been hacked?](https://netsenx.com/en/faq/how-do-i-answer-the-board-when-asked-if-we-have-been-hacked)
- [Can any tool prove that a company is not hacked?](https://netsenx.com/en/faq/can-any-tool-prove-that-a-company-is-not-hacked)
- [What can a network sensor tell the board that antivirus cannot?](https://netsenx.com/en/faq/what-can-a-network-sensor-tell-the-board-that-antivirus-cannot)
- [What security evidence does a buyer ask for in due diligence?](https://netsenx.com/en/faq/what-security-evidence-does-a-buyer-ask-for-in-due-diligence)