Emily Heath’s 5 Key Questions CISOs Should Ask Before Board Meetings

This piece provides a practical framework for CISOs to communicate effectively with boards by centering security discussions on business priorities and critical assets. It outlines five guiding questions: identifying what matters most (“crown jewels”), where these assets reside, how they are protected, how vulnerable and at risk they are, and how prepared the organization is to respond to incidents. The guidance emphasizes aligning controls, vulnerability management, and incident response with business value and clarity for both technical and non-technical stakeholders.