Risk governance
Executive cybersecurity
Executive cybersecurity is not an inventory of tools. It is an organisation’s capacity to decide, with time and with judgement, which risk it accepts, which risk it transfers and which risk it is not willing to sustain.
- For whom.
- Boards, risk committees and senior leadership that must decide with incomplete technical reports.
- Scope and deliverable.
- Risk prioritisation in board language, governance questions and decision criteria. It does not replace the CISO.
- Limit.
- It does not include day-to-day SOC operations or the implementation of tools.
Perspective
Executive cybersecurity begins when the risk fits in a sentence a chair can repeat. If only the technical team understands the report, it is not a governance report.
I do not work to replace the CISO. I work so that the CISO and the board speak the same language: impact, evidence, time and options.
Common risks
- Confusing a green dashboard with accepted residual risk.
- Tool budgets without an owner of the decision.
- CISOs who have no real access to the board.
- Plans that no one has rehearsed with senior leadership.
Questions for a board
- Which is the business process we cannot afford to lose?
- What residual risk did this board approve, in writing?
- Who can stop production, and on what criterion?
- When was the last drill with the board, not with the systems area?