Cyber Incident Readiness: Executive Briefing for Boards

When a serious cyber incident lands, the decisions that decide the outcome are made by executives and directors in the first hours, often out of hours, with partial information and no time to work out who is allowed to decide. This briefing is for board members, chief executives and the executives who would sit on a crisis team. It covers what the board's role in a cyber crisis actually is, which decision rights must be agreed in advance, how boards should take part in exercises, the disclosure clocks that start running, and the questions and red flags that tell directors whether management is ready. It deliberately stays at board level; the operating detail of command structures and communications is in the Crisis Management Guide and the technical process in the Incident Response Guide.

The risk in one paragraph

Every organisation will face a cyber incident that stops part of the business; the board cannot prevent that, but it can decide in advance how well the organisation absorbs it. The difference between a bad week and a lost year is rarely the attacker's skill. It is whether the organisation knew which systems it could switch off, who could authorise it, how it would run without them, who it had to tell and by when, and whether any of that had been rehearsed by the people who would actually be in the room. The UK NCSC's board toolkit is clear that responsibility for incidents sits with the organisation and that the board, as governing body, is accountable. Readiness is therefore a governance obligation, not an IT project.

Why this is a board-level issue now

Containment decisions now stop the business: in 2025, Jaguar Land Rover shut down its own systems to contain an attack and production stayed down for more than five weeks. The UK Cyber Monitoring Centre estimated the UK cost at £1.9 billion and said more than 5,000 UK organisations were affected. See the Jaguar Land Rover cyberattack.
Directors are being asked to evidence oversight: US-listed companies must describe the board's oversight of cybersecurity risk in their annual report under Regulation S-K Item 106. EU NIS2 makes management bodies approve and oversee cyber risk measures and allows them to be held liable. The UK Cyber Governance Code of Practice, launched by the government on 8 April 2025, sets out the actions directors are expected to take.
Disclosure clocks are short and overlapping: a single incident can trigger a four-business-day SEC filing after a materiality determination, NIS2 early warning within 24 hours, a GDPR personal data breach notification within 72 hours and sector rules on top. These clocks do not wait for the investigation to finish.
The hardest decisions are not technical: whether to take customer-facing systems offline, whether to engage with an extortion demand, what to tell customers and markets, and when to restart. The NCSC advises that roles and delegated authority for exactly these calls are settled before an incident.
Incidents arrive through suppliers and identities: both of the incidents described below began with a compromised login. Readiness has to include third parties and the access they hold.

The board's role in a crisis

Boards add value in a crisis by setting direction and holding risk decisions, not by running the response. A workable division looks like this:

Body	Role during an incident	What it should not do
Board	Sets risk tolerance for the response, takes or ratifies decisions reserved to it, oversees disclosure, supports the executive team, protects long-term interests of the organisation	Direct technical work, demand constant updates that pull responders away
Executive crisis team (gold)	Strategic decisions: business shutdowns, extortion response, external messaging, customer and regulator engagement, resourcing	Second-guess investigators on technical findings
Incident management (silver)	Coordinates response workstreams, turns strategy into actions, prepares decision papers	Make reserved business decisions without escalation
Technical response (bronze)	Investigation, containment, eradication and recovery	Communicate externally

The board should agree, in writing and before an incident, how it will convene at short notice (including if corporate email and collaboration tools are compromised), what quorum and delegation apply, and which director leads board engagement during the crisis. NIST SP 800-61 Rev. 3 (April 2025) places incident response within overall cybersecurity risk management as a NIST CSF 2.0 Community Profile, which is the framing boards should expect management to use.

Decision rights to agree in advance

Decision	Typical owner	Board involvement	Pre-agreed input
Declare a major incident and stand up the crisis team	CISO or incident manager	Chair informed promptly	Severity criteria
Take public-facing or operationally critical systems offline	CEO or COO	Informed; ratifies extended shutdowns	Pre-approved isolation actions and the business impact of each
Engage with or pay an extortion demand	CEO with legal advice	Board decision or explicit delegation	Policy position, sanctions screening process, insurer consent
Materiality and market disclosure	Disclosure committee, general counsel	Audit committee or board oversight	Materiality framework covering qualitative factors
Regulator notifications	General counsel, DPO	Informed	Map of regulators, thresholds and clocks
Customer and public statements	Communications director	Sight of major statements	Holding statements drafted and approved
Restart and return to normal operations	COO with CISO assurance	Informed; ratifies where risk accepted	Recovery priorities from business impact analysis

The extortion decision deserves particular attention. At Change Healthcare, its parent company paid a $22 million ransom and its chief executive told a congressional committee the decision was his. Directors should know before any incident whether that decision sits with them. See the Change Healthcare breach and the Ransomware Executive Briefing.

Exercises: how boards should take part

Exercise against your own risk scenarios: the NCSC asks whether the plan is exercised against the cyber scenarios in the organisation's risk register, not against a generic script.
Put directors in the room: board members should take part as players or observers, so that decision rights and out-of-hours convening are tested, not assumed.
Vary the format: combine discussion-based tabletop exercises with deeper simulations and technical recovery tests. CISA's Tabletop Exercise Packages and the NCSC's Exercise in a Box provide free scenarios, facilitator guidance and after action report templates.
Include suppliers: rehearse the compromise of a key supplier and the loss of a managed service, not only an attack on your own estate.
Track the actions: the board should receive the after action report and a tracked list of improvements, and ask at the next meeting which are closed.

See the Tabletop Exercise Guide and the Tabletop Exercise Scenario Pack for formats and ready scenarios.

Disclosure and notification clocks

Regime	Trigger	Clock
US SEC Form 8-K Item 1.05 (listed companies)	Determination that a cybersecurity incident is material	Generally four business days after the determination; delay only where the US Attorney General finds a substantial risk to national security or public safety
EU NIS2 (essential and important entities)	Significant incident	Early warning within 24 hours of becoming aware, incident notification within 72 hours, final report within one month
UK and EU GDPR	Personal data breach likely to result in risk to individuals	Supervisory authority within 72 hours of becoming aware, where feasible
EU DORA (financial entities)	Major ICT-related incident	Initial, intermediate and final reports on fixed timelines: see the DORA Executive Briefing

Boards should ask for a single notification map listing every regulator, contract and insurer the organisation would have to notify, with thresholds and clocks, owned by the general counsel and tested in exercises. Detail is in the SEC Cybersecurity Disclosure Rules Guide and the NIS2 Directive Guide.

Five questions for the board to ask

Who decides, and how do we reach them at 2am? Show us the decision rights for shutting down systems, extortion, disclosure and restart, and how the crisis team and board convene if email and collaboration tools are down.
When did we last rehearse, and what changed? Which of our top risk scenarios were exercised in the last 12 months, did directors take part, and which actions from the after action report are still open?
What can we switch off, and what does it cost? For our critical services, which systems would we isolate first, how long can the business operate without them, and how do we restart safely?
Who must we tell, by when? Show us the notification map, the materiality process and the pre-approved holding statements.
Who helps us on day one? Which incident response, legal and communications firms are on retainer, what does our cyber insurance require of us, and have we tested calling them?

Red flags in management answers

"The plan is with IT": the plan has no business decision rights, no executive owner and no link to business continuity.
Exercises without executives: only technical staff have rehearsed, or the last exercise was more than a year ago.
No out-of-band channel: the crisis team would coordinate on the same email and chat systems an attacker may control.
"We'd never pay": a stated position without a decision process, sanctions checks or the board's agreement is not a policy.
Recovery times nobody has tested: restore times quoted from vendor specifications rather than a full-scale test.
Insurance assumed: management cannot say what the policy covers, what consent it needs before engaging firms or paying, or whether it exists at all.

What good looks like

An incident response plan the board has seen, linked to business continuity and disaster recovery, with severity criteria and delegated authority.
Decision rights agreed and documented for the seven decisions above, with named deputies.
At least one exercise a year with executive and board participation, using scenarios from the risk register, with tracked actions.
A notification map and materiality process tested in an exercise.
Out-of-band communications and printed or offline contact lists for the crisis team. See the Incident Response Contact and Call Tree Template.
Retainers for incident response, legal and crisis communications, with insurer approval where required.
Tested recovery of the identity systems everything else depends on, including privileged, service and machine accounts.

Where to invest first

Decision rights and convening: cheap and high value. Agree and document them this quarter.
An executive exercise: a half-day tabletop against your most damaging scenario will expose more gaps than any audit.
Recovery capability for critical services: isolated, immutable backups and a tested rebuild of identity infrastructure. See the Recovering IAM and PAM After Ransomware or Domain Compromise guide.
Retainers and insurance: agree terms before you need them.
Reduce the most common entry points: phishing-resistant MFA on every remote access route and governance of third-party and machine credentials. Both incidents below began with a compromised login.

Metrics to track

Metric	What it tells the board
Months since last executive-level exercise; percentage of directors who took part	Whether readiness is rehearsed at the level that decides
Open after action items older than 90 days	Whether lessons are acted on
Critical services with a tested recovery within their tolerance	Whether recovery time claims are real
Time from detection to crisis team convened in the last exercise or incident	Speed of escalation
Notification decisions made within the regulatory clock in exercises	Disclosure readiness
Remote access routes and third-party accounts without phishing-resistant MFA	Exposure to the most common entry point

A 90-day plan

Days 1 to 30: board reviews the incident response plan and receives a briefing on the top three scenarios; management drafts decision rights, the notification map and out-of-band convening arrangements; confirm retainers and insurance terms.
Days 31 to 60: approve decision rights at board level; run an executive tabletop exercise with at least two directors taking part; test calling retainer firms and the insurer.
Days 61 to 90: board receives the after action report and an improvement plan with owners and dates; commission a recovery test of one critical service including identity systems; add readiness metrics to the regular board risk report. See the Board Cyber Risk Reporting Guide.

Common failure patterns

Containment without a restart plan: shutting systems down is the right first move, but without knowing dependencies and restart order, containment becomes weeks of outage. Jaguar Land Rover's phased restart began more than five weeks after production stopped.
Single points of entry left open: Change Healthcare's attackers logged in to a remote access portal that did not require MFA, and the resulting outage left pharmacies and providers unable to submit claims for weeks.
Decision by whoever is available: reserved decisions taken by whoever answers the phone, then challenged later by the board, regulators or shareholders.
Disclosure clocks discovered on day three: legal and communications teams learn of the obligations after the deadline has started.
Supply chain left out: the plan assumes the organisation is the victim, not that a supplier outage or compromise stops it, or that its own outage stops thousands of suppliers.

Lessons from incidents

Both cases point to the same board lessons. The Jaguar Land Rover incident shows the systemic reach of one company's outage: a £1.5 billion UK government loan guarantee was announced to support the company and its supply chain, and the company reported £196 million of incident costs in one quarter. The Change Healthcare incident shows how one missing control on one externally reachable login can become a national disruption affecting 192.7 million people, and how the extortion decision lands on the most senior executive. In both cases the critical questions were about decision rights, containment trade-offs and recovery, which are exactly the questions boards can rehearse.

Practitioner checklist

Give the board direct sight of the incident response plan and the last after action report.
Document decision rights for shutdown, extortion, disclosure, notification, statements and restart, with deputies.
Agree how the board and crisis team convene out of band and out of hours.
Run at least one exercise a year with executive and board participation against risk-register scenarios.
Maintain a notification map with every regulator, contract and insurer clock, owned by legal.
Pre-approve holding statements for customers, staff, media and markets.
Confirm retainers and insurance requirements and test calling them.
Test recovery of critical services and identity infrastructure, and report results to the board.

Standards and references

How NHI Mgmt Group can help

We provide independent identity and non-human identity risk assessments and board briefings, including how compromised workforce, privileged, service and machine accounts feature in incident scenarios and recovery plans. Our NHI Foundation Level Training Course helps security and IAM teams govern service accounts, API keys and secrets. Contact us to arrange a briefing.

Cyber Incident Readiness Executive Briefing: What Boards Need to Know and Ask