Assessing Cyber Risk: 13 Critical Questions for the Board

This guidance for Boards of Directors summarizes key cybersecurity governance priorities — assigning accountability, defining behavior baselines, tracking detection and response KPIs (MTTD, MTTR, etc.), evaluating security solutions, preparing incident response teams, managing third-party and supply-chain risk, and benchmarking security posture against peers — to help directors hold executives accountable and prioritize security investments.