The CISO and the Board: partners against cyber crime
- John R. Childress
- Feb 16
- 4 min read
“United we stand, divided we fall” is a useful motto for cyber security—because the gap between technical controls and enterprise risk is usually where breaches get expensive.
The strongest risk reduction I see in organisations isn’t a new tool; it’s a better working relationship between the CISO, the executive team, and the Board.
Why the CISO–Board partnership matters
When cyber oversight sits close to the Board, losses tend to be lower.
No organisation can guarantee 100% cyber security, but the risk of incidents drops significantly when the CISO has a strong working relationship with business leaders—especially the Board.
As financial and reputational threats mount—from criminal gangs to nation-state actors—the alliance between the CISO and the Board becomes a practical necessity, not a governance “nice to have.”
What I’m describing isn’t more reporting. It’s a shared ability to answer three board-level questions, consistently:
What’s the risk, in business terms?
What are we doing about it (and what will it cost)?
What do we need to do next, before the threat changes again?
What CISOs can do to build a Board-ready relationship
Start by understanding the business—then make security understandable in business terms.
Here are the behaviours that consistently improve the quality of the CISO–Board relationship:
Focus on business issues
Boards care about financial and operational performance, brand value, and investor confidence. A strong CISO ties cyber safety to strategy execution and the organisation’s risk appetite.
Ensure integration with strategy
Align cyber initiatives, plans, and budgets to the company strategy. CISOs who do this are more likely to receive funding and support.
Link security to costs and ROI
Boards respond to return-on-investment logic. Show estimated savings when attacks are thwarted, the ROI of faster containment, and the potential losses if investment is delayed.
Look ahead (not backwards)
Most board information is historical. Bring forward-looking insights: what’s coming, what’s changing, and what opportunities exist to reduce risk. Predictive analytics and trend extrapolation help boards plan.
Educate over time
Most board members aren’t cyber specialists. Don’t try to teach everything at once—use each interaction to build understanding of what matters and why.
Use dashboards
Visuals help boards grasp risk, priorities, and progress quickly—especially when the dashboard is forward-looking and ties to risk, strategy, and ROI.
Break down silos
Cyber is a team sport. Poor cross-functional cooperation creates unnecessary risk; the CISO has to ensure functions understand their roles in safe practice and breach response.
End every board update with one question
Ask: “How can I better support you?” It routinely produces insights you won’t get from slides.
What Boards can do to be better partners
Cyber security is enterprise risk—Boards should treat it that way, and help the CEO drive an enterprise approach.
Boards sometimes default to “tell us you’re on it.” That stance is understandable, but it’s not enough. Here’s what materially helps:
Do your homework
If only a few board members feel confident engaging on cyber, oversight becomes shallow. Every member should gain basic literacy using accessible resources (books and online learning were explicitly recommended in the paper).
Demand an enterprise approach
Cyber isn’t one function’s job. The Board should ensure the CEO supports functional heads working with the CISO, so employees have skills and understanding of safe practices and breach response.
Ask for culture and engagement oversight
A majority of breaches have a human fingerprint, which is why Boards are increasingly asked about culture. Request information on how culture and employee engagement impact cyber risk.
Ask the mirror question
Just as the CISO should ask how they can support the business, the Board should ask: “How can the Board better support you?” This often shifts the conversation from reporting to action.
A practical 30–60–90 day reset for the partnership
Treat this as a working relationship to strengthen, not a reporting cycle to optimise.
First 30 days: agree the “translation layer”
Define risk appetite for key cyber scenarios (what level of exposure is acceptable, where isn’t it).
Agree the board dashboard: 6–10 metrics that link risk, control maturity, and business impact.
Agree the narrative format: “risk → business impact → options → ROI → decision.”
Next 60 days: make it enterprise-wide
CEO and functional heads align responsibilities so cyber becomes operational reality, not IT policy.
Identify top cross-functional failure points (handoffs, approvals, access, third parties) and fix the ones driving most risk.
By 90 days: shift from lagging to leading
Add forward-looking risk signals: emerging threats, exposure trends, preparedness tests.
Build a steady cadence of education for the Board—small, useful learning over time.
Frequently asked questions
The best governance conversations are the ones that lead to clear decisions.
Should the CISO report to the Board?
Reporting lines vary, but what matters is direct access and an effective working relationship—especially on enterprise risk, funding decisions, and forward-looking threat oversight.
What should the Board ask for in a CISO update?
Business impact, risk appetite alignment, ROI of key initiatives, forward-looking threat signals, and where cross-functional cooperation is creating avoidable exposure.
How do we avoid “security theatre” in Board reporting?
Keep it decision-led: what’s changing, what it means, what options exist, what you recommend, and what decision you need from the Board.