Reading cyber risk as a decision-maker¶
What you'll be able to do in this chapter
- Set and use cyber risk appetite at board level.
- Read a risk register at board altitude (top risks and decisions, not line items).
- Tell a key risk indicator from a key performance indicator, and know which the board needs.
- Apply the 'so what to the business?' test, and avoid being misled by a heat map.
- Ask which inherent/residual risk model the organisation uses, and whether a 'residual' rating is today's state or a plan.
When positive indicators hide significant risk¶
The CISO's first board pack arrives. On the cyber page sits a tidy grid of coloured squares (a "heat map") with most cells reassuringly green and two amber. The accompanying note says risks are "well-managed and trending positively." Around the table, relief. The item is about to be approved without challenge.
The problem is not necessarily the chart itself. The board needs to establish whether the assessment behind it is sound. This Lesson builds the specific skill a director needs: reading cyber risk well enough to challenge it. Not to redo the analysis (that is the CISO's job) but to know which questions expose a weak one.
First, decide what you are willing to lose: risk appetite¶
You cannot judge whether a risk is "acceptable" without first deciding what acceptable means for your organisation. That decision is risk appetite, and setting it is one of the board's defining contributions (it is the yardstick against which every risk is measured).
Risk appetite is not simply a numerical threshold; it is a set of statements about what the organisation is and is not willing to tolerate in pursuit of its goals. For Scaldimet, a usable appetite might say: we will not tolerate any foreseeable risk of a multi-day stoppage of a production line; we have limited tolerance for short, contained IT outages at the headquarters; we will not accept risks that could breach our delivery commitments to our largest customer. Notice these are stated in terms of the business (production, customers, commitments) not in terms of technology. That is deliberate, and it is the board's natural language.
Once appetite exists, the board's question about any risk becomes answerable: is this risk inside or outside what we said we would tolerate? Without a stated appetite, every risk lacks a clear standard against which to judge it, and "is this acceptable?" has no anchor. Setting appetite is therefore the board's first move, not an afterthought.
Read at the right altitude¶
A risk register (the organisation's catalogue of identified risks) can run to dozens or hundreds of line items. (The CISO builds and maintains it; the course's Risk Module covers how.) A board that tries to read every line is reading at the wrong level, and will become lost in detail while missing the overall picture.
The board reads the register at the right level: the handful of risks that could genuinely threaten the organisation's objectives, and the decisions attached to them. A useful board-level view of a single risk has just a few elements:
- What it is, in one business sentence (not a technical one).
- How it compares to appetite: inside or outside tolerance.
- What is being done, and what decision (if any) the board is being asked to make.
- Where it is heading: getting better, worse, or stuck.
Everything finer-grained than that belongs to the CISO and the management layer. The board's job is to see the top risks clearly, test them against appetite, and make the few decisions that are genuinely theirs. Reading at this level is necessary for effective board oversight: the board needs the major risks and decisions rather than the underlying operational detail.
KRIs and KPIs are not the same, and the board needs KRIs¶
Boards are routinely shown performance numbers and told they describe risk. They usually don't. The distinction is worth getting right.
Technical explainer (read & discuss, don't build): KRI vs KPI
A KPI (key performance indicator) measures how well an activity is being done. "98% of staff completed security training." "Patches applied within five days on average." These describe effort and performance.
A KRI (key risk indicator) is a signal that risk is rising or falling. "Number of systems still running unsupported software." "Days since the French site's network was last segmented (still zero, it isn't)." These describe exposure and danger.
The trap: a page full of green KPIs can appear reassuring while a serious, untreated risk remains underneath. Scaldimet could show "100% antivirus coverage" (a fine KPI) while the French production network remains flat and unsegmented (a strong warning signal). Performance looks great; exposure is severe. Boards must insist on seeing risk indicators, not just performance indicators: the green KPIs can create a misleading impression that the organisation is safe.
When a report shows only KPIs, the right board response is a question: "These tell me how busy we have been. Which numbers tell me whether we are actually exposed?"
Ask which risk model the numbers use¶
A heat map shows "inherent" and "residual" risk in two neat columns. Before trusting either, a board should ask what those words actually mean in this organisation, because there are two common conventions and they are not interchangeable.
In the formal convention, inherent risk is the exposure with no controls at all, and residual is what remains after controls. In the operational convention that many cyber teams prefer, inherent risk is the exposure under the controls already in place today, and residual (or target) is the exposure after the controls the organisation still plans to add. Lesson 1.3 explains why both exist, and why rating everything as if no controls existed is often unhelpful.
The distinction is not academic; it changes what a green "residual" column is promising you. Under the operational convention, a reassuring residual rating may describe the risk after improvements that have not been built yet: a plan, not a present state. A board that nods it through can believe the organisation is safe today when it is only scheduled to be safe later.
So the board asks two short questions of any risk report:
- "When you say 'inherent' and 'residual', do you mean with no controls at all, or with the controls we already have in place?"
- "Is this 'residual' rating where we stand today, or where we will stand once planned work is finished, and if the latter, finished when?"
For Scaldimet this matters immediately. If Site Beta's risks are shown as amber "residual" on the strength of a network-segmentation project that is merely planned, the true position today is worse than the chart suggests. The board's task is not to pick the model; it is to know which one it is reading, and to refuse to mistake a plan for a protection.
The one test that matters: “so what, to the business?”¶
The most powerful tool a director has is not technical knowledge. It is the relentless application of a single question to anything the CISO presents: "So what, to the business?"
A risk described as "unpatched vulnerabilities on legacy OT" means little to a board. Applied to the so-what test, it becomes: "If this is exploited, the French production line could stop for several days, we would miss deliveries to our largest customer, incur contractual penalties of roughly €X, and put the contract renewal itself at risk." Now the board can act, because the risk is finally in its language (money, customers, commitments, survival).
This test serves three purposes. It forces the CISO to translate technology into business consequence (a discipline that improves their thinking). It lets the board compare a cyber risk against every other risk it weighs. And it can expose any risk the CISO does not truly understand (because a risk that cannot be connected to a business consequence may not yet be sufficiently understood).
Scaldimet's top risks, in the board's language
Translated through the so-what test, Scaldimet's headline cyber risks read like this:
- French production stoppage from an OT compromise: could halt the Site Beta line for days, breach delivery commitments, trigger OEM penalties, and threaten the contract renewal. Outside appetite.
- Loss of customer design confidentiality: leaked engineering drawings could damage the customer relationship and competitive position. Outside appetite.
- Failure to meet NIS2 obligations in time: regulatory exposure and the board's own liability (Chapter 6.1). Outside appetite.
None of these mentions a firewall, a patch, or a protocol. All three name a business consequence a director can weigh. That is what "reading cyber risk as a decision-maker" looks like.
Application: three questions for one line¶
Here is a single line from the CISO's first heat map, presented as the board would first see it:
"Third-party / supply-chain risk: rated AMBER, trending stable."
Your task as a director: write down three questions that would tell you whether this amber rating is trustworthy. Do it before reading the debrief. Your task is to test whether the assessment is sound rather than to reproduce it yourself.
A strong set of questions:
- So what, to the business? "If a supplier or contractor were compromised, what could actually happen to us (could it reach our production systems, and what would that cost in deliveries and penalties)?" (Forces the business consequence into view, and Scaldimet's unmonitored French maintenance contractor makes this very concrete.)
- Against appetite? "Is 'amber' inside or outside the tolerance we set? Who decided amber was acceptable here, and on what basis?" (Tests the rating against the board's own yardstick rather than treating the colour as evidence that the risk is acceptable.)
- Why 'stable', and is stable good enough? "Stable since when (and does 'stable' mean controlled, or merely unchanged and still untreated)?" (A risk can sit 'stable' at a dangerous level for years; stability is not the same as safety.)
Notice none of these requires technical expertise, and all three could show that an amber rating is less reassuring than it appears. The board's role is not to out-technical the CISO. It is to challenge whether the risk assessment is connected to business consequence and appetite.
Key takeaway
A board reads cyber risk by first setting appetite (what we will and won't tolerate, stated in business terms), then reading the register at altitude (top risks and decisions, not line items), and insisting on risk indicators (KRIs), not just flattering performance indicators (KPIs). A particularly useful question is: "so what, to the business?", which turns technology into money, customers and commitments: the board's own language. The job is not to redo the CISO's analysis, but to test it: a tidy green chart means nothing until someone has asked whether it has been measured against appetite and translated into consequence.
Next: Chapter 6.3 · Overseeing and challenging the programme →