What cyber security questions should a finance director ask?
The ones about money moving and money at risk. Who can change supplier bank details, and how is a change verified? Which computers can make payments, and is anyone watching them? What would one day without systems cost, and what does our insurance cover, with which conditions and exclusions? Are our answers on the insurer's questionnaire still true today? What do our security tools cost per year in total, including staff time, and what risk does each reduce? Which contracts carry penalties for downtime or data loss? These questions turn security into figures a board can weigh. NetSenX helps with one of them directly: on every plan it flags a payment PC that starts contacting an unknown server at regular intervals, a common sign of banking malware.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.