# What questions should the board ask the IT manager about security?

Questions that can be answered with facts. Five that work well: How would we know today if someone were inside our network, and who would receive the alert at night on a Sunday? When did we last restore a complete system from backup, and how long did it take? Which accounts can still log in without multi-factor authentication? Which suppliers can reach our systems, and how? What can we not see, and what would it cost to see it? Ask for the answers in writing and come back to them each quarter. Good answers name a person, a date and a document; a weak one is “we have a tool for that”. NetSenX helps answer the first and the last question for the network: who receives alerts, and which segments are and are not monitored.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

FAQ: [For the board and finance](https://netsenx.com/en/faq/board) · https://netsenx.com/en/faq/what-questions-should-the-board-ask-the-it-manager

## Read next

- https://netsenx.com/en/problems-we-solve
- https://netsenx.com/en/blog/2026-10-09_cybersecurity-for-the-board
- https://netsenx.com/en/pricing

## Related questions

- [What should cyber security training for the board cover?](https://netsenx.com/en/faq/what-should-cyber-security-training-for-the-board-cover)
- [Who should own cyber security in a small company?](https://netsenx.com/en/faq/who-should-own-cyber-security-in-a-small-company)
- [What should the CEO do in the first hour of a cyber incident?](https://netsenx.com/en/faq/what-should-the-ceo-do-in-the-first-hour-of-a-cyber-incident)
- [Who in the company should decide on a ransom demand?](https://netsenx.com/en/faq/who-should-decide-on-a-ransom-demand)
- [Which payment controls stop invoice fraud and fake CEO requests?](https://netsenx.com/en/faq/which-payment-controls-stop-invoice-and-ceo-fraud)