Most boards hear about cyber security once a year, usually as a slide near the end of a longer pack, and usually written by the person who would look worst if it went wrong. That is not oversight. It is a status update. The problem is not that directors do not care; it is that they are rarely handed the few questions that turn a comfortable presentation into an honest one.
You do not need to be technical to govern cyber risk well. You need to ask the questions a regulator, an insurer or a large customer would ask, and to notice when the answer is vague. Below are five questions that do exactly that. For each, we set out why it matters and what a good answer actually sounds like, so you can tell reassurance from evidence.
A note on how to use them. Ask them as a set, once a quarter, and ask for evidence rather than assurance. The point is not a single grilling but a rhythm: the same five questions, asked regularly, quietly raise the standard of the answers over time, because the person accountable knows they will be asked again. That cadence is itself a control — it is how a board turns cyber security from an annual event into ongoing oversight.
1. Are we insurable, and do we actually meet the conditions of our policy?
Cyber insurance has become a useful proxy for basic hygiene, because underwriters now demand controls before they will quote. But a policy is only as good as the truthfulness of the questionnaire behind it. If you attested to multi-factor authentication everywhere and it is missing on one legacy system, an insurer can reduce or decline a claim on the day you need it most.
A good answer sounds like: “Yes, we hold cover of £X. The controls we attested to — multi-factor authentication, endpoint detection, tested backups, an incident response plan and 14-day patching — are all in place and we have evidence. Renewal is in [month] and we have reviewed the questionnaire against reality.” A weak answer is “we have insurance” with no mention of the conditions attached to it.
2. Could we restore from backup this week — and have we proved it?
Almost everyone has backups. Far fewer have restored from them recently and timed how long it took. Ransomware groups now target the backups first: Coalition has reported that in the large majority of ransomware cases it sees, attackers deliberately went after backup systems. A backup you have never test-restored is a hope, not a control.
A good answer sounds like: “We have automatic backups, at least one copy is offline or immutable, and we test-restored our critical system [X weeks] ago. Full recovery took [N] hours and that number is on record.” The board should be uneasy about “IT handles backups” with no restore test and no recovery-time figure.
3. Who owns security — and is it one named person?
Security fails in the gaps between people who each assumed someone else had it. In a smaller firm, the outsourced IT provider runs the systems but rarely owns the risk decisions; the risk stays with the business. Governance needs a single named accountable owner who can speak to posture, not a committee that meets when something has already gone wrong.
A good answer sounds like: “[Name] is accountable for security. They report to the board [quarterly] with a posture score, the top risks, and what changed. Our IT provider runs the systems; the accountability for risk sits with us.” “Our IT company deals with all that” is the answer that should prompt the next question.
4. What is our exposure through our suppliers?
Your security is now partly your suppliers’ security. The firms that hold your data, run your payroll, or connect into your systems are all routes in. This is why banks and enterprise customers increasingly audit their suppliers’ security, and why regulated financial firms are being pushed to manage their information and communications technology (ICT) third parties formally under rules such as the EU’s Digital Operational Resilience Act. Even an unregulated UK SME feels this through customer contracts.
A good answer sounds like: “We keep a supplier register, we know which ones hold sensitive data or have access to our systems, they are tiered by how critical they are, and the important ones are reviewed on a cadence.” If nobody can name the top five suppliers by risk, that is the finding.
5. What would the first hour of an incident actually look like?
The worst time to design your response is during the incident. The board does not need the technical runbook, but it should be confident one exists, that people know their roles, and that the plan has been rehearsed at least once. The UK’s National Cyber Security Centre is clear that preparation and a tested plan are what separate a contained incident from a chaotic one.
A good answer sounds like: “We have a written plan. Everyone knows who to call, including out of hours. We know our legal duties — the ICO must be told within 72 hours of a personal data breach where there is a risk to individuals. We ran a 30-minute tabletop exercise in [month] and fixed the gaps it exposed.” “We would work it out on the day” is not a plan.
From questions to a measurable answer
These five questions map neatly onto the six functions every good security framework uses — Govern, Identify, Protect, Detect, Respond and Recover — and onto the TrustOps Maturity Model, which places a business on a five-level scale from Ad hoc (Level 1) to Optimised (Level 5). A firm that can answer all five with evidence is typically operating at Level 4, Measured: controls are not just present, they are tested, and results reach the board. Most firms find they can answer two or three well, and that is a perfectly good place to start.
The value of asking is not to catch anyone out. It is to replace an annual slide with a live, honest picture the board can actually govern from — your security posture, live, not once a year.
A sensible next step
If you want to know how your firm would answer these five questions today, our free 15-minute assessment scores you out of 100 against those same six functions, locates you on the maturity model, and shows your top five gaps — whether or not we ever speak again. Start with the free assessment at trustops.co.uk/.
Sources
National Cyber Security Centre — Cyber incident response and preparation guidance: https://www.ncsc.gov.uk/collection/incident-management
Information Commissioner’s Office — Personal data breaches: a guide (72-hour reporting duty): https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/
Coalition — Cyber Claims Report (ransomware actors targeting backups): https://www.coalitioninc.com/blog/cyber-claims-report-mid-year-2023
Association of British Insurers — Cyber insurance claims data (controls insurers now expect): https://www.abi.org.uk/news/news-articles/2025/11/nearly-200-million-paid-in-cyber-claims-to-help-uk-businesses-recover/
