Ask for the evidence.
Choose the next step.

THE LEADERSHIP RECORD

Begin with what the business must be able to do.

The NCSC’s board toolkit provides a governance reference. The questions below are CyberSolace prompts for a proportionate review; they do not replace the assessment of a particular environment.

Keep the review connected to business change. A new service, supplier, acquisition, remote-working arrangement, or data use can alter the assumptions on which last year’s answers depended.

INFORMATION & ACCESS

Who can reach what matters?

• Which information is sensitive, how is it classified, and what protection does that classification require in practice?
• Who can access important services and data, and how are permissions approved?
• When are privileged and ordinary access rights reviewed, including supplier and leaver access?
• Where is multi-factor or stronger sign-in in use, and which fallback or recovery routes remain?

Ask to see a recent access change or review, with exceptions and ownership visible. A policy that says permissions are reviewed is different from evidence that an obsolete supplier account was removed.

For information, follow one record through storage, sharing, and retention. The useful question is not simply whether encryption exists, but whether the people handling the information understand the intended protection and can use it reliably.

TECHNOLOGY & DETECTION

What is installed, supported, and observable?

• Is the technology-asset record accurate enough to find the systems supporting an important service?
• Which hardware or software is unsupported, exposed, or awaiting an important security update?
• How is the network separated so that one compromised area cannot unnecessarily reach everything else?
• What suspicious behaviour can be detected, who examines it, and what happens outside normal working hours?

No organisation can prove that its products are free from every vulnerability. A better answer describes supported versions, prioritisation, exceptions, and what has been checked. Ask how the owner knows an update actually reached the relevant estate.

For monitoring, use a recent example or an authorised exercise. Establish whether the team could distinguish an alert from an incident requiring a business decision, and whether it had the authority and contacts needed to respond.

PEOPLE, RESPONSE & RECOVERY

Can the business use its arrangements under pressure?

• Can staff recognise uncertainty and report a concern without fearing blame?
• Who leads an incident, and how do security, operations, communications, and senior decision-makers coordinate?
• Which data and configurations are backed up, and what evidence demonstrates restoration?
• What minimum service can continue during disruption, and how is a safe return to normal agreed?

The distinction between having a plan and demonstrating a recovery is central. Request a recent exercise or restoration record, its limitations, and the actions still outstanding. Include the supply-chain and staffing dependencies needed to make recovery work.

MAKE THE ANSWERS ACTIONABLE

Finish the meeting with an owned decision.

For each material uncertainty, record the service affected, evidence available, consequence of doing nothing, proposed next step, owner, and review date. Keep the unresolved items visible rather than allowing a positive overall status to hide them.

Revisit whether the security approach still fits the business. A small team may need external support, but accountability for priorities and accepted uncertainty remains a leadership decision. Use the questions to focus that conversation, not to turn board members into system administrators.