Three questions about cyber every director should ask. No tech knowledge needed.

Directors tell me they can’t oversee cyber security because they aren’t technical. I don’t accept that, and I say so as kindly as I can. You don’t need to understand accounting standards to ask whether the business can pay its bills next month. You don’t need to be a solicitor to ask whether a contract exposes you. Cyber is the same. There are cyber security questions for directors that need no technical knowledge at all, and three of them will tell you most of what you need to know.

Why this lands on your desk

A serious cyber incident is a business problem. It stops you trading, costs money, damages your name with customers and can bring a regulator to the door. Those are board matters by any definition, and directors already have a legal duty to exercise reasonable care, skill and diligence in running the company.

The government has been getting more direct about this. In April 2025 it published the Cyber Governance Code of Practice, written for boards and directors and deliberately free of technical language. Its message is that cyber risk should be governed like any other serious business risk: understood, owned and checked. The National Cyber Security Centre’s Board Toolkit says much the same.

Yesterday the NCSC published its Annual Review, and the chief executive, Richard Horne, was blunter still. For years, he said, we’ve “got away with tech on the cheap”: old systems kept running for one more year, access handed out because it was convenient. I’ve written up the full review. Every item on his list is a decision about money and priorities. Those decisions are made by directors, whether they realise it or not.

Question one: what couldn’t we run without?

Ask it exactly like that. If we lost it tomorrow morning, what would stop us working?

For most businesses the list is short. Email. The system that takes orders or bookings. The accounts package. The shared files. Perhaps a piece of specialist software, or the machine on the shop floor. Then the information: customer records, designs, the things you’d be embarrassed or fined to lose.

Then ask the follow-up. For each one, what happens on day one without it? Day three? Day ten? How long before customers notice, before you can’t pay staff, before cash runs short?

A good answer is a short list that people around the table agree on, with a rough idea of how long you could manage without each item.

A worrying answer is “everything’s in the cloud, so it’s fine”, or a different list from each person you ask. If nobody has decided what matters most, nobody can be protecting it in the right order.

Question two: who is looking after it, and how do we know?

Take that short list and ask, for each item, who is responsible for keeping it safe. A name, please. “IT” won’t do, and neither will a company. Then ask the half of the question that’s nearly always skipped: how do we know it’s being done?

This is the difference between reassurance and evidence. “The backups are fine” is reassurance. “We restored a folder from last Tuesday’s backup on the 12th and it took forty minutes” is evidence. “Everyone has multi-factor authentication” is reassurance. A report showing every account and whether it’s switched on is evidence.

You’d never accept “sales are fine” without seeing the figures. Apply the same habit here. Ask for a one-page report a few times a year covering a handful of facts: accounts protected by multi-factor authentication, devices that are behind on updates, the date of the last restore test, the number of people with admin access, and anything out of support.

A good answer has names and dates in it, and includes a few things that aren’t yet right. That’s a sign someone is really looking.

A worrying answer is “it’s all taken care of”. If you outsource your IT, ask your provider the same question and see whether the contract backs up what they tell you.

You don’t have to understand how the backup works. You do have to know when somebody last proved it did.

Ashley Adkins, fromIT

Question three: when did we last practise a bad day?

Every business has a fire drill. Hardly any have practised the thing that’s now more likely than a fire.

Ask what would happen if you arrived tomorrow to find every screen locked. Who would you ring first, and is that number written anywhere other than on a computer? Who has the authority to switch systems off? Who talks to customers, and what do they say? Who decides whether to tell the Information Commissioner’s Office, given that the deadline can be 72 hours? Does your insurer need to be called before anyone touches anything?

Practising needn’t be elaborate. An hour around a table, once a year, talking through one scenario. I can promise it will turn up something. The plan is saved on the server that would be locked. Two people each think the other is in charge. The only person who knows the admin password is on holiday.

A good answer is a date, a one-page plan that exists on paper, and a list of what you changed after the last run-through.

A worrying answer is “we’d call the IT company”. Perhaps you would. Have you asked them what they’d do, how quickly, and what it would cost?

What to do with the answers

You’ll have noticed that none of the three needs you to know what a firewall does. They’re the questions you already ask about everything else: what matters, who owns it, and has it been tested.

1. Put them on an agenda. The next board or management meeting, with twenty minutes set aside. Send them round beforehand so people can prepare.
2. Write down what you hear. Including “we don’t know”. Those are the most useful answers you’ll get.
3. Pick the three biggest gaps. Give each one a name and a date. Three is enough for one quarter.
4. Ask again in six months. The second round is where you find out whether anything changed.
5. Get an outside view if you need one. If the answers are vague and you can’t tell whether that matters, an independent check is worth having. A recognised standard helps here: Cyber Essentials for the basics, ISO 27001 if customers expect you to manage security as a system.

If you only take one thing from this, make it the habit of asking for evidence. Most gaps I find in businesses were known to somebody. They just never reached the people who could decide to fix them, because nobody at that level asked.

You’re allowed to ask simple questions about complicated things. In my experience they’re the ones that get the most revealing answers. Ask these three and listen carefully to what comes back, and to how long it takes.