Prioritise key assets for protection, define acceptable cyber risk levels, and ensure your technology and security teams understand business priorities.

You should ask:

• What are our most important business services and underlying business processes?

• What are the supporting data assets for these business processes?

• What types of cyber-attacks present the most severe risks to the business?

Drive simplicity by standardising processes and optimising third-party diversification, streamlining technology, and improving resilience through collaboration with IT.

You should ask:

• Are our evolving business demands introducing unnecessary complexity?

• How can we rationalise and standardise our business activities and supporting environment?

• How can we help IT to ensure a high degree of standardisation and automation is achieved at a technological level?

Strive for modular architecture and automation for swift threat detection, containment, and recovery, enhancing security and driving digital transformation.

You should ask:

• To what extent do we have an end-to-end overview of our business services and their supporting components so that we can understand their degree of resilience?

• What modernisation efforts have we undertaken in recent years and what investments are still needed to reach our resilience goals?

• Are we pushing the scenarios for stress testing far enough to give us confidence in our ability to withstand major cyber attacks?

Work together with technologists to create safe environments which balance security and business performance to prevent human errors and investigate process improvements before adding controls.

You should ask:

• What do we need to change to create a safe environment in which employee mistakes do not have catastrophic consequences?

• How are we balancing security measures with operational performance to ensure that security runs smoothly in the background without hindering productivity?

• Are we sufficiently looking into how we could change the way of working before we decide to introduce further security controls?

Sponsor comprehensive, recurring testing and push the boundaries of stress testing to improve confidence in your recovery capabilities.

You should ask:

• What formal planning do we have in place to cope with a major cyber-attack and are wesufficiently staffed to respond effectively?
• Have we identified the relevant cyber crisis scenarios that need support fromexecutives in preparation?
• Are we clear about the decision-making process in the event of a cyber crisis and do wehave sufficient detailed protocols in place to accelerate both the response and the recovery?