The Questions Your Board Should Be Asking About Ransomware Risk: What Unclear Answers Mean

This is a board-focused guidance document on ransomware governance that lists the essential questions executives and boards must ask about strategy, operational readiness, supplier risk, detection and response, and recovery confidence. It emphasizes testing incident response and backups, the need for quantifiable risk metrics tied to business outcomes, the role of AI in both attacker and defender workflows, and urges boards to demand clear, actionable answers rather than technical minutiae.