What should the board know about the cost of IT downtime?
That it is usually the largest cost of a cyber incident, and one you can estimate yourself. A day without systems means lost sales or production, staff paid to wait, overtime to catch up, contractual penalties and customers who go elsewhere. Ask finance to estimate one day for your own company from revenue, payroll and key contracts, then ask IT how many days a full restore would really take; the product of the two is a better guide than any industry average. That figure helps the board judge backups, recovery plans and insurance limits. What NetSenX changes is the timing: it can surface the steps that usually come before ransomware locks systems, such as lateral movement and data leaving, while there is still time to act. It does not restore systems.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.