PRACTICE 04 — NED & BOARD ADVISORY

Cyber your board can actually follow.

Independent counsel for boards, audit committees and executives — plain answers to the questions regulators now expect your board to be asking.

THE PROBLEM

Boards are now accountable for cyber. Most aren't yet equipped for it.

DORA puts digital resilience obligations directly on the management body. NIS2 makes managers personally liable. The FCA expects senior managers to own operational resilience by name. "We relied on our IT department" is no longer a defence.

The regulator won't ask your CISO. They'll ask you.

SEVEN QUESTIONS YOUR BOARD SHOULD BE ABLE TO ANSWER

Which three business services would hurt most if they stopped tomorrow — and for how long could you tolerate it?DORA calls these your critical functions. Most boards haven't ranked them.
Who, by name, owns cyber risk at executive level — and would the regulator agree?
What did the last resilience test actually break — and what changed because of it?If the answer is "nothing", the test was theatre.
Which third party could take you down, and when did anyone last check their posture rather than their certificate?
What would you say publicly in the first four hours of a breach — and who decided that?
What did the board decline to fund last year, and did anyone write down the risk it accepted by doing so?
If the CISO left on Friday, what does Monday look like?

ANSWERED ALL SEVEN? YOU'RE IN GOOD SHAPE. HESITATED ON A FEW — THAT'S WHERE WE HELP.

HOW WE SIT WITH YOU

The board seat

NED or advisory appointment — a standing, cyber-literate voice in the room when decisions are made, not briefed after them.

The committee rhythm

Quarterly prep and attendance with your audit or risk committee, armed with the questions that actually test the answers.

The rehearsal

Realistic crisis exercises for the executives who'll face the regulator and the press — before they have to do it for real.

The second opinion

Independent review before you sign off the big spend, the big programme or the big outsourcing decision.

WHERE WE'RE USUALLY CALLED IN

The audit committee wants a dry run before the regulator's visit.
A new NED needs to get up to speed on cyber — quickly.
A major spend or outsourcing decision needs an independent second opinion.
The board wants its first proper cyber session — not another dashboard.

Start a conversation