Cabo Advisory

← Insights··Updated

The chairman's view of cybersecurity: five questions to ask before the CISO presents

In 2025 cyber became a profit-and-loss line for European boards: a £300 million hit at Marks & Spencer, £80 million in a half-year at the Co-op, an estimated £1.9 billion across the economy from the Jaguar Land Rover shutdown, hub airports checking passengers in on paper because a supplier was hit. None of those was primarily a data breach. Each was a business-interruption event whose cost was decided in the first hours and whose defensibility was decided years earlier. The CISO's deck is usually a prevention story. The board's liability is a resilience story. Five questions, asked before the presentation, convert one into the other.

The deck arrives

The chair's difficulty with cybersecurity is rarely the content of the presentation. It is the frame. A competent CISO will arrive with maturity scores, patching percentages, phishing-simulation click rates and a heat map, and the board will spend forty minutes being reassured about matters it cannot evaluate. Then the incident arrives and the questions that matter — what do we lose first, how fast can we come back, whose failure is this, what is our reporting clock, and what can we prove we did — turn out never to have been asked.

The 2025 incidents make the point. Marks & Spencer told shareholders in May 2025 to expect a "cyber incident impact of c.£300m on 2025/26 operating profit, before cost mitigation, insurance and trading actions" after pausing online shopping.1 The Co-op, which "acted quickly and decisively to temporarily shut down a number of systems to contain the threat", reported a £206 million revenue impact and an £80 million operating-profit impact in the first half, with a further £40 million expected in the second.2 The Cyber Monitoring Centre estimated the Jaguar Land Rover attack — which halted production for weeks from the end of August 2025 — at around £1.9 billion across the UK economy, affecting more than 5,000 organisations, "the single most economically damaging cyber event to ever hit the UK".3 Weeks later ENISA confirmed that the check-in outages at Berlin, Brussels and Heathrow were "caused by third-party ransomware incident" at a supplier of shared airport systems.4

Why the questions come before the presentation

Two structural facts make the pre-meeting frame more important than the meeting. The first is that chief executives and security chiefs worry about different things. The World Economic Forum's Global Cybersecurity Outlook 2026 finds CEOs ranking cyber-enabled fraud and phishing first and AI vulnerabilities second, while CISOs rank ransomware first and supply-chain disruption second; 78% of CEOs of highly resilient organisations name supply-chain and third-party dependencies as their most significant challenge.5 Proofpoint's 2026 survey of more than 1,600 CISOs reports that 85% now "see eye-to-eye with their boards on cybersecurity", up from 64% a year earlier — and that 56% still say their organisation is unprepared for a targeted attack, while 77% say excessive expectations are placed on them.6 Alignment, in other words, is not readiness.

The second is that the law now names the board. Under Article 20 of the NIS2 Directive, member states must ensure that "the management bodies of essential and important entities approve the cybersecurity risk-management measures taken by those entities in order to comply with Article 21, oversee its implementation and can be held liable for infringements", and that members "are required to follow training" sufficient to "identify risks and assess cybersecurity risk-management practices".7 Under DORA, the management body of a financial entity "shall define, approve, oversee and be responsible for the implementation of all arrangements related to the ICT risk management framework" and bears "the ultimate responsibility for managing the financial entity's ICT risk".8 The CISO presents; the board is accountable. Where the CISO sits matters too: Heidrick & Struggles' latest survey reports that 42% of CISOs now report directly to the CEO, three times the prior year's proportion, with the share reporting to a CIO or CTO down to 30% — which changes whether the board is hearing assurance or advocacy.9

Question 1: What would we lose first — and what does a day of losing it cost?

The first question forces the risk into the chief financial officer's units. The UK's Cyber Governance Code of Practice, published in April 2025 for medium and large organisations, opens with the board's duty to "gain assurance that the technology processes, information and services critical to the organisation's objectives have been identified, prioritised and agreed".10 DORA requires the management body to "approve, oversee and periodically review the implementation of the financial entity's ICT business continuity policy".8 NIS2 defines a significant incident — the one that starts the reporting clock — as one that "has caused or is capable of causing severe operational disruption of the services or financial loss".11 A board that does not already know what "severe" means for its own company cannot make a risk-appetite decision, and cannot later show that it exercised the oversight the law requires.

Ask for a ranked list of business services, each with an estimated loss per day of outage and the dependency chain behind it: the systems, the people and the suppliers without which it stops. IBM's 2024 study found that 70% of breached organisations reported significant or very significant disruption;12 M&S and JLR are what "significant" looks like in a set of accounts. If the CISO cannot express the risk in those terms, the deck is measuring the wrong thing.

Question 2: How fast could we come back — and when did we last prove it?

The second question separates prevention metrics from resilience metrics. Prevention metrics — patch coverage, phishing rates, maturity levels — describe the probability of an event. Resilience metrics — tested restore time for the five most critical services, backup immutability, time to detect — describe its cost. Boards are shown the first and pay for the second.

The evidence on recovery is not comfortable. Sophos's 2025 ransomware survey found that "only 54% of companies used backups to restore their data – the lowest percentage in six years", that nearly half of victims paid a ransom, with a median payment of $1 million, that the average cost of recovery had fallen to $1.53 million, and that 40% of victims said the attackers "took advantage of a security gap that they were not aware of".13 The UK National Cyber Security Centre warns that ransomware actors "often target backups and infrastructure, deleting or destroying the data", and that a resistant backup design "will only be effective in practice if system owners regularly test and monitor the health of the backup data".14 IBM's 2025 study puts the mean time to identify and contain a breach at 241 days, and finds that organisations that detected the breach themselves saved around $900,000.15 JLR's full restoration was not expected until early 2026.3

Ask, specifically, for the date and outcome of the last full restore test of the top-five services — not whether backups exist — and for the date of the last exercise in which a director took part. The UK Code expects "at least annual exercising of the plan"; the NCSC's board toolkit asks whether "every board member understand[s] what's required during an incident".1016

Question 3: Whose failure becomes ours?

The third question maps dependency. Verizon's 2025 Data Breach Investigations Report found that the share of breaches involving third parties doubled to 30%.17 ENISA's Threat Landscape 2026, published in September 2026, reports that 60% of incidents with an identifiable intrusion vector leveraged a vulnerability, that ransomware was deployed in 40% of analysed cybercrime events, and that attackers continue "targeting of cyber dependencies, including supply-chain attacks and third-party attacks".18 The airport outage was a supplier's ransomware. Change Healthcare's 2024 breach cost its parent about $3.1 billion in 2024.19 And the CrowdStrike outage of July 2024 — a defective update from a security vendor, not an attack — disabled more than 8.5 million Windows devices and cost the Fortune 500 an estimated $5.4 billion in direct losses, of which cyber insurance was expected to cover only 10% to 20%.20 The vendor bought to protect the company was the single point of failure; resilience is a broader property than security.

Ask for a concentration map: which single suppliers, cloud regions, identity providers or managed-service providers would take out more than one critical service at once, and what the contract with each says about notification, audit, exit and recovery. NIS2 requires supply-chain security "including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers";21 DORA requires a board-approved third-party policy and reporting channels that keep the board "duly informed".8 Part 6 of this series sets out the contractual terms that actually move that risk — and the board of a technology company should remember that, to its own customers, it is the third party whose terms are about to be rewritten.

Question 4: What is our clock, and who holds the stopwatch?

The fourth question is about time, and about judgement. The reporting regimes that now apply to most European companies of any size run from a decision, not from an event. NIS2 requires an early warning "without undue delay and in any event within 24 hours of becoming aware of the significant incident", an incident notification within 72 hours, and a final report not later than one month after that.11 For financial entities, DORA's technical standards require an initial notification "within four hours from the classification of the ICT-related incident as a major ICT-related incident and no later than 24 hours from the moment the financial entity has become aware", an intermediate report within 72 hours of the initial notification and a final report within a month — with no weekend extension for credit institutions, central counterparties, trading venues or NIS2 essential and important entities.22 For US-listed companies, an Item 1.05 Form 8-K is "generally due four business days after a registrant determines that a cybersecurity incident is material".23

"Aware", "classified" and "material" are management judgements. The board should decide in advance who makes them, on what evidence, and how the decision is minuted — and should pre-decide the hard calls that arrive at three in the morning: whether the company would ever pay, who can authorise shutting down trading, who speaks to regulators and the press. The numbers show how contingent those calls are: Verizon reports that 64% of ransomware victims did not pay, while Sophos found nearly half did.1713 The answer depends on who is in the room.

Two enforcement stories frame the stakes. In March 2025 the Ninth Circuit affirmed the conviction of Uber's former chief security officer for concealing a 2016 breach by paying the attackers $100,000 through a bug-bounty programme in exchange for a non-disclosure agreement, holding that the hackers' "illegal conduct could not be laundered through an NDA".24 The SEC's case against SolarWinds and its CISO ended differently — the court dismissed most of it in July 2024 and the SEC withdrew the remainder in November 2025 — but the surviving lesson from practitioners is to "ensure incident materiality determinations are well documented, cross channel communications are consistent, and governance processes tie public statements to verified technical facts".25 Cross-border groups should also note that the clocks do not start together: Sweden's NIS2 implementing law has applied since January 2026, while Spain had still not completed transposition as of July 2026 and was referred by the Commission to the Court of Justice on 8 July 2026 — a Spanish group with Nordic, German or UK operations is already on the clock there.26

Question 5: What are we personally accountable for — and what is the evidence we did our job?

The fifth question is the board's own. NIS2 Article 20 makes the management body's approval and oversight a legal duty, requires training, and — for essential entities — allows authorities to ask the competent bodies or courts to "prohibit temporarily any natural person who is responsible for discharging managerial responsibilities at chief executive officer or legal representative level" from exercising those functions.727 DORA Article 5 requires members of the management body to "actively keep up to date with sufficient knowledge and skills to understand and assess ICT risk".8 For US registrants, Regulation S-K Item 106 requires a description of "the board of directors' oversight of risks from cybersecurity threats".23 The UK Code expects formal reporting "on at least a quarterly basis" and a governance structure "embedded within the wider governance structure".10

The evidence is a paper trail: a board-approved statement of risk appetite and the measures adopted; minutes that show challenge rather than receipt; a training log for directors; exercise records; an assurance line — internal audit, an external assessment, the DORA-mandated ICT audit plan — that is independent of the CISO's self-report; and a public security statement that the general counsel has checked against reality, since it is pre-incident statements that now attract securities and consumer-protection liability. The audit or risk committee should periodically hear from the CISO without the executive present, and from internal audit about the CISO.

The UK's official statistics show how far most boards are from this. In the 2025/26 Cyber Security Breaches Survey, 43% of businesses had identified a breach or attack in the past year, yet "board-level responsibility for cyber security sat at 31% of businesses" and formal incident-response plans existed at 25% of businesses — 76% of large ones.28 Insurance does not close the gap: Howden estimates that more than 70% of businesses in France, Germany, Italy and Spain are uninsured against cyber risk, and although Marsh reports that global cyber insurance rates fell 5% in the first quarter of 2026 after a 7% decline in the previous quarter, carriers now underwrite against a dozen hygiene controls, including tested backups.29 A soft market is a buying window, but only for companies that can evidence the controls.

Turning five answers into a standing agenda

The five questions produce five standing items. A quarterly report in the board's units — services, loss per day, restore times, third-party concentration — rather than the CISO's. An annual exercise with directors in the room, minuted. A training log. An assurance line independent of the function being assured. And a one-page cyber charter recording who decides awareness, classification and materiality, who can stop trading, and who speaks.

None of this requires a director to read a packet capture. It requires the chair to insist that the presentation answer the board's questions rather than the CISO's — and to recognise that the legal clock, the commercial contract, the technical restore test and the financial loss-per-day are four views of the same risk, which is why the answers have to be assembled by people who can read all four.

Related reading in this series

Disclaimer

This article is general commentary for professional readers. It is not legal, regulatory, insurance or technical advice, does not address the circumstances of any particular organisation, and does not create an advisor–client relationship with Cabo Advisory SL. Reporting deadlines, transposition status and enforcement positions are stated as at the date of writing and vary by jurisdiction and sector; verify the current position and take advice before acting.

Notes and sources

Footnotes

  1. Marks and Spencer Group plc, "Full Year Results for the 52 Weeks Ended 29 March 2025" (press release), 21 May 2025. https://corporate.marksandspencer.com/media/press-releases/full-year-results-52-weeks-ended-29-march-2025 ↩

  2. Co-operative Group Limited, "Results for six months ended 05 July 2025" (interim results), 25 September 2025. https://assets.ctfassets.net/5ywmq66472jr/inQbpqZKZA34xlGz3t2Pu/51ff10a1def9367c28ee0fc1a9bf979a/Co-op_Interim_Results_2025.pdf ↩

  3. Computer Weekly, "Jaguar Land Rover attack to cost UK £1.9bn, say cyber monitors" (reporting the Cyber Monitoring Centre's assessment; the article dates the attack to 31 August 2025), 22 October 2025. https://www.computerweekly.com/news/366633395/Jaguar-Land-Rover-attack-to-cost-UK-19bn-say-cyber-monitors ↩ ↩2

  4. TechCrunch, "EU cyber agency confirms ransomware attack causing airport disruptions", 22 September 2025. https://techcrunch.com/2025/09/22/eu-cyber-agency-confirms-ransomware-attack-causing-airport-disruptions/ ↩

  5. World Economic Forum, Global Cybersecurity Outlook 2026, ch. 2 "The view from the top: CEOs' priorities in a shifting cyber landscape", 12 January 2026. https://www.weforum.org/publications/global-cybersecurity-outlook-2026/in-full/2-the-view-from-the-top-ceos-priorities-in-a-shifting-cyber-landscape/ ↩

  6. Proofpoint, "Proofpoint 2026 Voice of the CISO Report Finds Cyber Resilience Improving, While AI Expands the CISO Mandate" (press release; survey of 1,600+ CISOs in 16 countries, May 2026), 9 September 2026. https://www.globenewswire.com/news-release/2026/09/09/3358379/35374/en/proofpoint-2026-voice-of-the-ciso-report-finds-cyber-resilience-improving-while-ai-expands-the-ciso-mandate.html ↩

  7. Directive (EU) 2022/2555 (NIS2), art. 20(1)–(2). https://www.nis-2-directive.com/NIS_2_Directive_Article_20.html (official text: https://eur-lex.europa.eu/eli/dir/2022/2555/oj/eng) ↩ ↩2

  8. Regulation (EU) 2022/2554 (DORA), art. 5(1), 5(2)(a), (e), (h), (i) and 5(4). https://www.digital-operational-resilience-act.com/Article_5.html ↩ ↩2 ↩3 ↩4

  9. Heidrick & Struggles, 2025 Global Chief Information Security Officer Compensation Survey, February 2026. https://www.heidrick.com/en/insights/cybersecurity/2025-global-chief-information-security-officer-compensation-survey ↩

  10. UK Department for Science, Innovation and Technology and National Cyber Security Centre, Cyber Governance Code of Practice, 8 April 2025 (Principles A–E). https://www.gov.uk/government/publications/cyber-governance-code-of-practice/cyber-governance-code-of-practice ↩ ↩2 ↩3

  11. Directive (EU) 2022/2555 (NIS2), art. 23(3)–(4). https://www.nis-2-directive.com/NIS_2_Directive_Article_23.html ↩ ↩2

  12. IBM, "IBM Report: Escalating Data Breach Disruption Pushes Costs to New Highs" (Cost of a Data Breach Report 2024), 30 July 2024. https://www.prnewswire.com/news-releases/ibm-report-escalating-data-breach-disruption-pushes-costs-to-new-highs-302209290.html ↩

  13. Sophos, "Nearly Half of Companies Opt to Pay the Ransom, Sophos Report Finds" (State of Ransomware 2025), June 2025. https://www.sophos.com/en-us/press/press-releases/2025/06/nearly-half-companies-opt-pay-ransom-sophos-report-finds ↩ ↩2

  14. National Cyber Security Centre, "Ransomware-resistant backups" (v1.0), 22 November 2024. https://ncsc.gov.uk/collection/ransomware-resistant-backups ↩

  15. IBM, "IBM Report: 13% Of Organizations Reported Breaches Of AI Models Or Applications, 97% Of Which Reported Lacking Proper AI Access Controls" (Cost of a Data Breach Report 2025), 30 July 2025. https://newsroom.ibm.com/2025-07-30-ibm-report-13-of-organizations-reported-breaches-of-ai-models-or-applications,-97-of-which-reported-lacking-proper-ai-access-controls ↩

  16. National Cyber Security Centre, Cyber Security Toolkit for Boards v3.0, Principle D "Planning your response to cyber incidents", reviewed 8 April 2025. https://www.ncsc.gov.uk/collection/board-toolkit/principle-d-incident-planning-response-recovery/planning-your-response-to-cyber-incidents ↩

  17. Verizon, "Verizon's 2025 Data Breach Investigations Report: Alarming surge in cyberattacks through third-parties" (news release), 23 April 2025. https://www.verizon.com/about/news/2025-data-breach-investigations-report ↩ ↩2

  18. ENISA, "Exploring the evolution of the cyber threat landscape: How dependencies weaken our digital resilience" (press release for the ENISA Threat Landscape 2026), 22 September 2026. https://www.enisa.europa.eu/news/exploring-the-evolution-of-the-cyber-threat-landscape-how-dependencies-weaken-our-digital-resilience ↩

  19. Healthcare Dive, "Change Healthcare cyberattack affects 190 million, UnitedHealth says" (reporting UnitedHealth's 2024 cost of about $3.1 billion), January 2025. https://www.healthcaredive.com/news/change-healthcare-cyberattack-affects-190-million-unitedhealth/738351/ ↩

  20. Cybersecurity Dive, "CrowdStrike disruption direct losses to reach $5.4B for Fortune 500, study finds" (reporting Parametrix's estimate), 25 July 2024. https://www.cybersecuritydive.com/news/crowdstrike-cost-fortune-500-losses-cyber-insurance/722396/ ↩

  21. Directive (EU) 2022/2555 (NIS2), art. 21(2)(d) and 21(3). https://www.nis-2-directive.com/NIS_2_Directive_Article_21.html ↩

  22. Commission Delegated Regulation (EU) 2025/301 (regulatory technical standards on ICT-related incident reporting under DORA), art. 5. https://www.springlex.eu/en/packages/dora/rts-ir-regulation/article-5/ (official text: https://eur-lex.europa.eu/eli/reg_del/2025/301/oj/eng) ↩

  23. U.S. Securities and Exchange Commission, "SEC Adopts Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies" (press release 2023-139), 26 July 2023. https://www.sec.gov/newsroom/press-releases/2023-139 ↩ ↩2

  24. United States v. Sullivan, No. 23-927 (9th Cir. 13 March 2025). https://law.justia.com/cases/federal/appellate-courts/ca9/23-927/23-927-2025-03-13.html ↩

  25. A&O Shearman, "SolarWinds Dismissed: What the SEC's U-turn Signals for Cyber Enforcement", Harvard Law School Forum on Corporate Governance, 7 December 2025, https://corpgov.law.harvard.edu/2025/12/07/solarwinds-dismissed-what-the-secs-u-turn-signals-for-cyber-enforcement/ ; Jones Day, "SEC Dismisses Remaining SolarWinds Claims", December 2025, https://www.jonesday.com/en/insights/2025/12/sec-dismisses-remaining-solarwinds-claims ↩

  26. Viktoria Compliance, "NIS2 transposition status in the EU (2026)", April 2026, https://viktoria-compliance.eu/en/blog/nis2-transposition-status-eu-2026 (Sweden: Cybersäkerhetslag, SFS 2025:1506, in force 15 January 2026); Ángel Ortega Castro, "NIS2 Law in Spain: Transposition Status and Deadlines", updated July 2026, https://angelortegacastro.com/en/ley-coordinacion-gobernanza-ciberseguridad-nis2-estado-boe/ ; Cuatrecasas, "Aprobado el anteproyecto de Ley que transpone la Directiva NIS2", https://www.cuatrecasas.com/es/spain/propiedad-intelectual/art/aprobado-anteproyecto-ley-transpone-la-directiva-nis2 ; on the Court of Justice referral, Compliance Hub, https://compliancehub.wiki/nis2-cjeu-referral-ireland-spain-france-netherlands-2026/ ↩

  27. Directive (EU) 2022/2555 (NIS2), art. 32(5)–(6). https://www.nis-2-directive.com/NIS_2_Directive_Article_32.html ↩

  28. UK Department for Science, Innovation and Technology and Home Office, Cyber security breaches survey 2025/2026 (official statistics), 30 April 2026. https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026 ↩

  29. Howden, "Rebooting growth: Howden's 2025 cyber insurance report", 24 September 2025, https://www.howdengroupholdings.com/reports/2025-cyber-report ; Marsh, "Global commercial insurance rates fall 5% in Q1 2026; marking seventh consecutive quarterly decline" (Global Insurance Market Index, cyber line), 22 April 2026, https://www.marsh.com/en/about/media/global-commercial-insurance-rates-fall-5-percent-in-q1-2026.html ; Marsh, "US cyber insurance market update: Rates decrease, threats evolve", 22 May 2025, https://www.marsh.com/en/services/cyber-risk/insights/cyber-insurance-market-update.html ↩