After a cyber incident, the board does not run the response. Management does. The board's job is to ask the questions that keep the response honest, complete, and focused on the people who were affected. Those questions are few: what we know, who must be told, what it cost the people we serve, what our controls missed, and how we will know the fix worked.
What do we know, and what do we only believe?
In the first days, facts and assumptions blur. Ask management to separate them. What has been confirmed? What is still an estimate? What would change the picture? When a board hears "we believe no customer data was taken," it should ask what that belief rests on and when it will be confirmed.
Who has been told, and who must be?
Notification duties come from regulators, contracts, and the public, and they have deadlines. For U.S. public companies, the SEC requires disclosure of a material cybersecurity incident within four business days of determining that it is material. Ask who owns the materiality decision, when it will be made, and who else is on the list: regulators, customers, partners, insurers, and law enforcement.
What did it cost the people we serve?
Incident reports tend to measure systems: hours of downtime, records exposed, servers restored. Ask about people. Who could not get service? Whose information is now at risk? What are we doing for them, and will they hear it from us before they read it somewhere else? The answer to this question often decides whether trust recovers.
What did our controls miss, and why?
Every incident is a test the organization did not choose to take. Ask which controls failed, which worked, and which did not exist. Then ask why. Was it a known risk that was accepted? A budget decision? A gap no one owned? The goal is not blame. It is an accurate map of where the organization is weaker than it thought.
What will we change, and how will we know it worked?
Remediation plans are easy to write and hard to finish. Ask for owners, dates, and a way to test each fix. Then put it on the agenda for a later meeting. The board's follow-up is often the only thing that keeps a remediation plan alive once the urgency passes.
When should the board hear about an incident?
Earlier than most plans say. Agree in advance on what kind of event reaches the board, how fast, and through whom. A short, early call about something that turns out to be minor costs little. A board that learns about a serious incident from the press has lost time it cannot recover, and so has the company.
What should the board ask of itself?
One more question belongs to the board alone. Did we see this risk clearly before the incident? If the answer is no, the board should ask what it would need to see it next time. That might be different reporting, a different committee structure, or outside expertise.
A cyber incident is a hard week for any organization. It is also the clearest view a board will ever get of how its organization works under pressure. The right questions make sure that view is not wasted.