Skip to content
CISOteria

Category: Governance

Executive Decision Rights: Who Decides in a Cyber Crisis?

Posted on by CISOteria

Why Cyber Crisis Decisions Stall 

Executive decision rights define who has final authority to approve consequential business actions during a cyber crisis, including accepting risk, suspending operations, and authorizing external disclosure.

Yet executive decision rights rarely seem urgent while everything is working. There is time to consult another executive, ask Legal for an opinion, move an uncomfortable question into the next committee meeting, or let an ambiguous responsibility survive because nobody is paying a visible price for it.

Then the incident begins.

Security believes an attacker may still have access to a critical environment and recommends isolating several systems. Operations warns that doing so could interrupt a major service. Legal cannot yet confirm whether the incident crosses a disclosure threshold. Communications wants to know what can be said publicly, and leadership is waiting for more certainty before approving anything irreversible.

The organization has people responsible for every part of the problem, yet the decision itself seems to belong to no one.

Recent research on cyber crisis readiness identifies this kind of responsibility ambiguity as a real weakness. Björck and colleagues found that undefined responsibilities can increase inefficiency during cyber crises, while stronger readiness depends on clear roles, cross-functional coordination, leadership involvement, and the ability to internalize responsibilities before pressure arrives.

That still leaves a harder question than who participates in the crisis.

Who actually decides?

When Cybersecurity Decisions Become Business Decisions 

Many technical actions already have clear owners. Security teams can isolate endpoints, block malicious activity, revoke credentials, or activate incident-response procedures within established authority.

The difficult decisions appear when the security action creates consequences somewhere else in the business.

A shutdown may contain an attacker while stopping revenue. A delayed shutdown may preserve availability while expanding compromise. Early disclosure may protect trust while exposing incomplete information. Waiting may avoid unnecessary alarm while giving someone outside the company control over when the incident becomes public.

Harel and Carmeli’s 2025 cybersecurity oversight framework describes this separation between operational management and strategic decision control. Their research argues that boards should focus on matters such as organizational criticality, risk tolerance, strategic consequences, resource allocation, and accountability, while operational execution remains with management and technical teams.

That distinction becomes particularly important during a crisis because several legitimate authorities suddenly meet around the same decision.

The CISO understands the security risk, the COO understands operational consequences, Legal sees regulatory exposure, Communications sees stakeholder reaction, and senior management sees the broader business.

All of them should influence the decision.

They do not all need to own it.

Three Cyber Crisis Decisions That Need Clear Authority 

Risk Acceptance: Who Gets to Say, “We’ll Live With It”? 

The CISO can determine that a system is unsafe, explain the uncertainty, estimate potential exposure, and recommend containment, but that does not automatically mean the CISO should accept the resulting business risk on behalf of the organization.

Risk acceptance becomes a business decision precisely because its consequences reach beyond cybersecurity.

Harel and Carmeli argue that organizations should establish their tolerance for functional disruption and define the relative importance of critical assets before a breach occurs. Those discussions belong in routine governance because they create the boundaries within which crisis decisions can later be made quickly.

If the CISO is recommending continued operation despite known exposure, the organization should already know who has authority to accept that exposure.

Operational Shutdowns: Who Gets to Pull the Plug? 

Shutdown decisions create the opposite problem. Security may believe isolation is necessary while Operations sees the shutdown itself as the larger immediate threat.

Harel and Carmeli use Colonial Pipeline as an example of this trade-off. The company shut down its pipeline network as a precaution even though the operational technology itself had not been infected, accepting major operational consequences to reduce further uncertainty and potential harm. Their framework explicitly treats shutdowns and service prioritization as strategic questions during an attack.

The point is not that shutdown is always the right decision. The point is that deciding who can authorize one should not begin after the recommendation has already been made.

Incident Disclosure: Who Approves What Goes Public? 

Disclosure creates another collision of expertise. Security understands the evidence, Legal interprets regulatory obligations, Communications considers public impact, executives understand commercial consequences, and the board may need visibility where the incident becomes strategically significant.

Harel and Carmeli specifically identify questions around whether to disclose proactively, what information should be shared with customers, investors, and regulators, and how quickly that communication should happen.

Those perspectives need to meet, but collaboration cannot leave the final authority undefined.

A crisis committee where everyone can advise and nobody can close the decision is still a slow crisis committee.

When a RACI Leaves Decision Authority Unclear 

Organizations often respond to governance ambiguity by documenting more roles.

That helps, but it is not enough.

Björck and colleagues distinguish between preparedness and readiness. Preparedness includes plans, procedures, simulations, and escalation protocols, while readiness includes the leadership, behavior, trust, communication, and adaptive capacity required when a situation no longer fits the script. Their findings show that an organization can be well documented without being genuinely ready to act.

A RACI can tell everyone why they are in the room and still fail to answer who has the final authority when those people disagree. A more useful approach starts with the decisions themselves.

Who can accept residual risk above normal tolerance? Who can suspend a business-critical service? Who can authorize emergency expenditure? Who approves external disclosure? Which decisions reach the CEO, and which require board involvement?

Once those decisions are named, the organization can attach authority to them instead of hoping authority will emerge naturally from job titles.

CISO Authority: Where Delegation Starts and Stops 

Giving the CISO stronger authority is often part of the answer.

A security leader who needs executive approval for every containment action does not have a workable incident-response mandate. The CISO and security function need enough delegated authority to investigate, contain, escalate, activate specialist support, and enforce approved emergency controls without waiting for permission at every step.

The danger appears when that authority quietly turns into ownership of every business consequence associated with cybersecurity.

If shutting down a system will stop production, interrupt a critical service, create major financial losses, or affect customers at scale, the CISO’s recommendation remains essential, but the final business-risk decision may belong elsewhere.

This is where Executive Decision Rights create a healthier boundary. The CISO can act decisively within predefined limits while knowing exactly when authority moves to another executive because the consequence has crossed an operational, financial, legal, or strategic threshold.

The organization avoids two equally weak models: one where security cannot move without executive permission, and another where the CISO becomes the default owner of risks the business itself has chosen to take.

Five Rules for Executive Decision Rights Under Pressure 

Drawing on the two studies, the following five rules translate their governance and readiness insights into practical recommendations for defining decision authority.

1. Tie authority to consequences

Incident severity alone is often too technical to determine who should decide. Escalation thresholds should also consider operational downtime, customer impact, financial exposure, sensitive-data compromise, regulatory consequences, safety, and critical dependencies.

Harel and Carmeli place this preparation in the pre-incident phase, where leadership should already understand critical assets, risk tolerance, and acceptable levels of disruption.

2. Separate advice from decision authority

Security can recommend shutdown without owning the commercial consequences. Legal can identify regulatory exposure without becoming the owner of every communication decision. Operations can explain continuity impact without deciding how much cyber risk the enterprise should accept.

The stronger the expertise in the room, the easier it becomes to confuse influence with authority.

A mature structure protects both.

3. Keep strategic and operational decisions separate

Boards should not become incident commanders, just as CEOs should not approve every forensic action.

Harel and Carmeli note that boards should receive information and consider strategic implications during an attack while avoiding continuous operational decision-making. Their role becomes more relevant when the issue reaches major shutdowns, ransom, stakeholder communication, legal exposure, or broader strategic prioritization.

Clear boundaries allow operational teams to move while leadership focuses on the decisions that actually require executive judgment.

4. Design decision rights for uncertainty

Cyber crises rarely wait until the facts are complete.

Björck and colleagues describe cyber crises as opaque, fast-moving, and difficult to manage through predefined procedures alone. Their research emphasizes situational sensemaking, where teams must interpret incomplete signals and make judgments under pressure when existing scripts no longer provide a complete answer.

Decision rights therefore need to work before certainty exists.

Someone must know who can approve precautionary action, when uncertainty itself justifies escalation, and when an earlier decision must be revisited because the evidence has changed.

5. Test authority in tabletop exercises

Most tabletop exercises test whether the organization knows what to do.

They should also test whether the organization knows who can authorize it.

Björck and colleagues found scenario-based exercises valuable because they expose managerial as well as technical gaps and help teams internalize their roles under stress. Their study also describes one organization using separate strategic and operational crisis structures, allowing one group to make decisions while another executed them.

A useful tabletop should therefore create disagreement deliberately.

Security recommends taking a critical service offline, Operations objects, Legal has incomplete information, and leadership wants another hour.

Who decides?

The attacker claims data exfiltration, the investigation remains uncertain, rumors are already circulating, and disclosure may become unavoidable.

Who decides now?

The exercise is not only testing whether the organization chooses correctly. It is testing whether the organization can choose at all.

Consensus Should Improve the Decision, Not Delay It

Cyber crisis management has to be collaborative because no single function sees the full picture.

The problem begins when collaboration quietly turns into a requirement for consensus.

Björck and colleagues found that cyber crisis leadership requires a balance between directive and collaborative approaches, particularly because cross-functional coordination becomes more important as uncertainty grows. Their research also shows how siloed leadership can weaken response when organizational boundaries remain stronger than the shared crisis structure.

Clear decision rights make disagreement safer.

The CISO can argue for containment, Operations can explain the cost, Legal can identify uncertainty, Communications can challenge the timing, and Finance can quantify the exposure without everyone needing to reach the same conclusion.

The decision owner hears the arguments and closes the decision.

That is not weaker collaboration. It is collaboration with an endpoint.

Conclusion: Define Decision Rights Before the Crisis 

During routine operations, unclear authority is cheap. Another meeting can be scheduled, another executive can be consulted, and an ambiguous responsibility can survive for months without becoming visible.

A cyber crisis converts that ambiguity into delay.

Björck and colleagues argue that cyber crisis readiness depends on much more than documented procedures; organizations need internalized roles, adaptive behavior, leadership, and coordination that can survive pressure. Harel and Carmeli reach the same point through governance, arguing that organizations should establish tolerance levels, priorities, accountability, and crisis decision capacity before the attack begins.

Executive Decision Rights cannot guarantee that leaders will always make the perfect choice, because cyber crises rarely offer perfect choices.

They can ensure that when Security wants to shut something down, Operations wants to keep it running, Legal wants more evidence, and the clock is still moving, the organization does not have to solve one additional mystery.

Who decides?

For Further Reading

This blog post is based on insights and analysis from:

  • Björck, Albena, et al. “Advancing cyber crisis readiness: context, microfoundations and the role of leadership.” Journal of Communication Management 30.3 (2026): 322-341. 

https://doi.org/10.1108/JCOM-01-2025-0006 

  • Harel, Yaniv, and Abraham Carmeli. “A strategic cybersecurity oversight framework: a board’s imperative.” Journal of Cybersecurity 11.1 (2025): tyaf021. 

https://doi.org/10.1093/cybsec/tyaf021 

Decision-Making Under Uncertainty: How Security Leaders Decide Without the Full Picture

Posted on by CISOteria

Fog Is Part of the Forecast 

Decision-making under uncertainty is not an unusual condition in cybersecurity; it is the environment in which most consequential security decisions are made. A CISO deciding whether to accelerate an investment cannot know exactly which threat will materialize next, a board reviewing ransomware exposure cannot know how well every control will perform under real pressure, and an executive evaluating a critical supplier rarely has complete visibility into everything that could go wrong.

The difficulty is not simply that information is missing. Some of the information that leaders want cannot be measured with the precision they would prefer, while other assumptions may become outdated before the decision has had time to prove itself. Recent research suggests that the more useful goal is therefore not to eliminate uncertainty, but to understand where it sits inside the decision and make sure it is not hidden behind dashboards, risk scores, or numbers that appear more certain than the evidence behind them.

Rule 1: Stop Waiting for the Full Picture 

A 2026 study examined cybersecurity decision-making across strategic, tactical, and operational roles, drawing on interviews with 36 professionals across six organizations, including senior executives, board members, governance specialists, and operational security teams. The researchers describe cybersecurity decisions as being shaped by uncertainty, time pressure, information asymmetry, technical constraints, organizational priorities, and human judgment, all at the same time.

What makes this especially important is that the study identified 23 different factors influencing effective decision-making, ranging from resources, regulation, and organizational structure to risk profile, experience, confidence, teamwork, bias, and cybersecurity posture. More than half of those factors operated across several organizational levels rather than belonging neatly to one team or one decision-maker.

This means a security decision is rarely just a technical response to a technical problem. The same threat can lead to very different choices depending on the organization’s appetite for risk, the maturity of its security program, the experience of the people involved, the resources available, and the consequences the business is prepared to accept. The real question is therefore not simply whether the organization has enough data, but whether leaders understand what is shaping the judgment they are about to make.

More Information Does Not Remove Judgment

It is tempting to imagine that better telemetry, more dashboards, or a more sophisticated risk model will eventually turn cybersecurity into a clean optimization problem, where the organization identifies the threat, calculates the likelihood, measures the impact, and selects the best control. In practice, every one of those steps still depends on interpretation, and interpretation is where uncertainty enters.

The same 2026 study found that professionals rely not only on formal information, but also on experience, awareness, confidence, team dynamics, and their understanding of the wider threat landscape. In other words, data matters enormously, but it does not arrive pre-labeled with the correct decision attached to it.

Rule 2: Do Not Mistake Precision for Certainty 

A 2025 study examined cyber risk management in five multi-billion-dollar organizations through 27 in-depth interviews with cybersecurity professionals, executives, board members, risk managers, and internal auditors. The researchers expected to find mature quantitative risk management in at least some of the organizations they studied, but instead found that many supposedly quantitative approaches still depended heavily on qualitative judgment. 

The authors describe this as a “quantitative veneer”, where numbers create the appearance of rigorous measurement even though the assumptions underneath them remain subjective. Organizations may present risk scores, probability scales, technical metrics, or financial estimates, but the route from raw information to the final number is often far less precise than the result suggests. 

That tension becomes especially visible when organizations attempt to estimate likelihood and consequence. Historical cybersecurity data is limited, attack techniques change quickly, and even when comparable incidents exist, their relevance may fade as architectures, controls, and business dependencies evolve. The study also shows that the consequences of a cyber incident can include downtime, customer loss, reputational damage, legal exposure, regulatory costs, contractual penalties, and other effects that interact rather than add up neatly. 

A Precise Number Can Still Be an Estimate

The danger is not the number itself. Quantification can help leadership compare risks, prioritize investments, and communicate more clearly, but it becomes misleading when precision in presentation is mistaken for certainty in knowledge.

A loss estimate of several million dollars may be useful, yet it still depends on assumptions about the duration of disruption, the effectiveness of current controls, the systems affected, customer behavior, recovery time, and regulatory consequences. A risk score can organize discussion, but it should not end it.

For security leaders, the better question is not simply, “What is the number?” but, “How was this number built, what assumptions support it, and how much would the conclusion change if one of those assumptions moved?”

Rule 3: Data Needs a Human in the Room  

The same study introduces a useful concept for understanding what organizations are actually doing: qualculation – a combination of quantitative analysis and qualitative judgment. Rather than treating numbers and professional judgment as competing approaches, the researchers argue that cyber risk management often requires both because perfect quantification is rarely available.

This is especially important at executive level, where the decision is rarely about a single technical metric. A CISO may have vulnerability counts, patching rates, control maturity scores, threat intelligence, historical incident data, and financial information, yet leadership still has to decide what those signals mean for the organization’s current priorities.

Professional judgment fills the space between evidence and action, but that judgment should not remain invisible. If a recommendation depends on experience, assumptions, or expert interpretation, leadership should be able to see that clearly rather than receive a conclusion that appears mechanically produced.

Make the Reasoning Behind the Number Visible

If a CISO presents a ransomware exposure estimate, the board should understand more than the headline figure. It should know what probability was assumed, which controls were considered effective, what recovery time was used, which business processes were treated as critical, and whether indirect effects such as reputational or regulatory damage were included.

That does not make the decision less rigorous. In many cases, it makes the rigor more visible, because it reveals where the analysis ends and judgment begins.

The strongest decisions are not those in which judgment disappears. They are those in which judgment is explicit enough to be challenged.

Rule 4: Kick the Assumptions and See What Breaks  

Another research from 2025 focuses directly on uncertainty in cybersecurity decision-support models. Their starting point is that cybersecurity metrics, particularly estimates of security-control effectiveness, are inherently imprecise. 

Even a seemingly simple question such as whether a control is effective can be difficult to answer with confidence. A firewall that has never been breached may be highly effective, but it may also have avoided a sophisticated enough attack, while the absence of incidents does not automatically prove that the control will perform equally well against a different threat in the future. 

Instead of assuming one precise value for control effectiveness, the researchers model several possible scenarios and ask how different security decisions perform across them. One of the approaches they examine is minmax regret, which looks for a choice that minimizes how badly the organization could regret that decision if reality turns out differently from what was expected. They also develop a min-product approach designed to reduce risk more consistently across a range of scenarios.

The mathematics is not the most important lesson for executives. The more useful principle is that a security decision should not only be tested under the assumptions that make it look correct.

Ask What Happens When the Assumption Moves

A security investment may appear attractive when the expected control effectiveness is high, the estimated recovery time is short, and the supplier dependency is believed to be manageable. The decision becomes much more revealing when leaders ask what happens if one of those assumptions changes.

Would the investment still make sense if the control delivered only half the expected protection? Would the organization make the same prioritization if recovery took twice as long? Would a supplier still be considered acceptable if the business later discovered that several critical processes depended on it?

The point is not to invent endless worst-case scenarios until no decision feels safe. It is to understand whether the decision remains defensible across several plausible versions of reality rather than only under the one forecast that was used to justify it.

Rule 5: Give Executives Context, Not More Noise

The 2025 cyber risk management study also found a recurring gap between technical teams and senior leadership. Security and IT professionals often hold much deeper technical knowledge, while executives and boards depend on those teams to translate the meaning of that information into something that can support business decisions.

The problem is that more reporting does not automatically close that gap. The organizations in the study often provided leaders with information from different functions, using different metrics, methodologies, and levels of detail, which could make cyber risk reporting more complicated rather than more useful. Executives and boards were often more interested in forward-looking questions: what is changing in the threat landscape, what is happening to peers, and how prepared the organization would be if a similar event occurred.

The board does not need every vulnerability, every control metric, or every technical exception; it needs enough context to understand what those signals mean for the business, where the uncertainty lies, and what decision is actually being requested.

How CISOteria Makes the Mess Make Sense 

CISOteria does not try to eliminate uncertainty from cybersecurity decisions, because that would create exactly the kind of false confidence this post warns against. Instead, it helps make the information behind those decisions more connected, current, and easier to interpret. 

Instead of forcing CISOs to piece together risk, vulnerabilities, compliance, third-party exposure, remediation progress, incidents, and workplans from separate systems and spreadsheets, CISOteria brings them into one operational view. That makes it easier to see how technical findings connect to business impact, who owns the next action, what has changed, and where residual exposure remains. 

The platform also helps bridge the gap between technical evidence and executive decision-making. Current risk, compliance, third-party, and incident data can be translated into board-ready reporting, while risks and vulnerabilities can be connected to business context, priorities, treatment plans, ownership, and remediation progress. 

That does not make the underlying uncertainty disappear. It gives leaders a stronger basis for working with it: a more current picture of the cyber program, clearer connections between evidence and business impact, and less dependence on fragmented reporting that may already be outdated by the time a decision reaches the boardroom. 

Conclusion: The Goal Is Not Certainty 

Decision-making under uncertainty is not a sign that the organization lacks maturity; in cybersecurity, it is often the reality of making consequential choices before the evidence is complete. What matters is whether leaders can separate what is known from what is estimated, recognize where judgment is filling the gaps, and understand how much the decision depends on assumptions that may later prove wrong.

The three studies point in the same direction from different angles. Cybersecurity decisions are shaped by organizational context and human judgment, quantitative risk analysis can create an illusion of certainty when assumptions remain subjective, and stronger decisions are those that remain reasonable across several plausible scenarios rather than only one expected future.

The goal is not to predict the future perfectly, because cybersecurity rarely offers that luxury. It is to make a decision that can be explained, challenged, and revisited when the evidence changes, while remaining clear about why that decision was defensible with the information available at the time.

For Further Reading

This blog post is based on insights and analysis from:

  • Dawson, Niamh, et al. “Informed cybersecurity decisions: A synthesis of expert perspectives.” Computers & Security (2026): 104927. 

https://doi.org/10.1016/j.cose.2026.104927 

  • Zhang, Yunxiao, and Pasquale Malacaria. “Dealing with uncertainty in cybersecurity decision support.” Computers & Security 148 (2025): 104153. 

https://doi.org/10.1016/j.cose.2024.104153 

  • Slapničar, Sergeja, Micheal Axelsen, and Marc Eulerich. “Cyber risk management: an illusion of a risk-based approach.” Journal of Management Control (2025): 1-36. 

https://doi.org/10.1007/s00187-025-00401-z 

Cybersecurity Risk Ownership: Why Security Shouldn’t Own Every Risk

Posted on by CISOteria

 The Problem with “Security Owns Security”

Security ownership is often concentrated in the security team, even when the decisions creating cyber risk are made elsewhere in the business.

In many organizations, the security function defines the controls, identifies the risks, monitors threats, responds to incidents, pushes remediation, and explains what went wrong when something fails. On paper, the business may be expected to support security. In practice, accountability often stays concentrated with the CISO and the security team.

The problem is that this concentration of accountability does not reflect how cyber risk is actually created across the organization. The security team can own the security program, but it cannot own every business decision that creates cyber risk. 

Panteli, Nthubu, and Mersinas describe cybersecurity as a collective responsibility that spans multiple stakeholders rather than a technical problem that should remain in the hands of cybersecurity professionals. Their research emphasizes shared responsibility, leadership involvement, and organizational collaboration.

The gap appears when organizations agree with that principle in theory, but continue to behave as if security is responsible for every outcome.

The Alarm Bell Doesn’t Own the Fire

The security team has a clear role: it defines standards, provides expertise, assesses exposure, monitors controls, challenges decisions, and helps the organization understand the consequences of risk.

But many of the decisions that create cyber risk happen elsewhere.

A procurement team selects a supplier. A product team postpones remediation to meet a release date. An operations team continues using a legacy system because replacement is too expensive. A business unit requests an exception because a control creates friction.

These are business decisions with security consequences.

If the security team identifies the risk but the business decides to proceed, the risk should not automatically become “owned” by security.

The distinction matters because responsibility in cybersecurity includes involvement, agency, and ownership across the organization, not only within the security function.

Everyone’s Favorite Place to Dump Risk 

The problem often starts with unclear accountability.

A vulnerability exists, so security owns it. A supplier has weak controls, so security owns it. A project cannot meet a requirement, so security owns the exception. A business unit accepts exposure, but security is still expected to explain the outcome later.

Over time, the CISO becomes the default owner for risks that originate in business decisions.

That may simplify escalation, but it weakens governance.

The security team should make the risk visible, explain the impact, recommend controls, and challenge weak decisions. It should not automatically absorb accountability for decisions made by other functions.

Business Leaders Still Own the Decision

Chatterjee and Leslie argue for a whole-of-enterprise approach to cybersecurity preparedness, built on the idea that cybersecurity readiness is everybody’s business. One of the core characteristics they identify is getting ownership, responsibility, and accountability right.

That does not mean everyone owns everything.

It means ownership needs to be assigned at the right level.

Security Owns the Security Capability

The security team should own the mechanisms that help the organization manage cyber risk.

That includes frameworks, policies, standards, monitoring, assurance, threat expertise, and security guidance.

The Business Owns Business Risk Decisions

Business leaders should own decisions about priorities, budgets, operational trade-offs, supplier choices, product deadlines, and risk acceptance.

When those decisions increase cyber exposure, accountability should remain with the decision-maker.

Leadership Owns the Governance Model

Senior management and the board need to ensure that risk ownership is explicit, escalation paths are clear, and accepted risks are visible.

Chatterjee and Leslie note that cybersecurity was historically treated as a technical issue for technical people, but that boards and executives are increasingly expected to play a direct role in driving security outcomes.

They also emphasize the role of senior management in building a shared understanding of cyber risk and empowering security experts with the mandate and resources required to respond.

Accountability on Paper Is Still Just Paper 

Organizations can assign accountability on paper and still fail to create it in practice.

A policy may state that business owners are responsible for cyber risk. A RACI matrix (Responsible, Accountable, Consulted, and Informed) may assign ownership. A committee may review risk decisions.

But if every difficult decision is still pushed back to security, the governance model has not really changed.

Gao and Calderon found that effective board oversight and cybersecurity expertise are associated with stronger cybersecurity risk disclosures, while the effect weakens when oversight becomes symbolic.

They also highlight the risk of superficial, check-the-box oversight when governance lacks sufficient expertise or meaningful involvement.

The same principle applies below board level. Accountability has to exist in actual decision-making, not only in governance documents.

Risk Acceptance Needs a Real Owner

One of the clearest places to see the ownership gap is risk acceptance.

Security may identify that a control is missing or that exposure exceeds the preferred level. But if remediation requires budget, delays a launch, affects a supplier relationship, or changes a business process, the final decision belongs to the relevant business owner.

Security can recommend, challenge, or escalate. But if the business chooses to accept the risk, that acceptance should be explicit and traceable.

Otherwise, organizations create a situation where the business receives the benefit of the decision while the security team retains the accountability.

Shared Responsibility Needs Clear Boundaries

“Security is everyone’s responsibility” is useful as a cultural message, but it is too vague as a governance model.

Shared responsibility works only when the boundaries are clear. Employees need to understand what is expected from them. Business owners need to know which risks they own. Security needs authority to challenge and escalate. Executives need visibility into material risk acceptance.

The goal is not to spread accountability so widely that nobody clearly owns anything.

It is to place accountability where the relevant decisions are actually made.

Conclusion: Security Should Not Own Every Risk

The security team should own the security program, the expertise behind it, and the mechanisms used to identify and manage cyber risk.

That does not mean it should own every cyber risk across the organization.

Research increasingly supports a broader model in which cybersecurity depends on participation across business functions, leadership, and governance structures rather than remaining solely with cybersecurity specialists.
The CISO should make risk visible and help the organization manage it.

The business should remain accountable for the decisions that create or accept it.

For Further Reading

This blog post is based on insights and analysis from:

  • Chatterjee, Dave, and Anne Leslie. “Ignorance is not bliss: A human-centered whole-of-enterprise approach to cybersecurity preparedness.” Business Horizons (2024). 

https://doi.org/10.1016/j.bushor.2024.10.009 

  • Gao, Lei, and Thomas G. Calderon. “Cybersecurity risk governance and companies’ cybersecurity risk disclosures in their 10-K filings.” Journal of Accounting and Public Policy 54 (2025): 107376. 

https://doi.org/10.1016/j.jaccpubpol.2025.107376 

  • Panteli, Niki, Boineelo R. Nthubu, and Konstantinos Mersinas. “Being responsible in cybersecurity: A multi-layered perspective.” Information Systems Frontiers 28.1 (2026): 209-227. 

https://doi.org/10.1007/s10796-025-10588-0 

The Board Is Asking Cybersecurity Questions. But Can It Judge the Answers?

Posted on by CISOteria

The Board Has the Answers. Does It Understand Them?

A board can review every cybersecurity report, ask every recommended question, approve more investment, and still fail to govern cyber risk properly.

Cybersecurity has quietly changed the job description of the board, not because directors are expected to understand malware, analyse attack techniques, or debate the merits of competing security technologies, but because cyber incidents increasingly determine whether an organisation can continue operating, comply with regulatory obligations, preserve stakeholder trust, and execute its strategy. 

The discussion has therefore moved from technology to governance. This raises an uncomfortable question that many boards still need to answer: what does real accountability for cybersecurity look like?

For years, the answer seemed simple. Cybersecurity became a regular board topic, the CISO gave quarterly updates, dashboards became more detailed, and directors approved more spending or asked for independent reviews. From the outside, this looked like strong governance.

Recent academic research suggests that the reality is more complicated.

When Oversight Becomes Theatre 

A Full Agenda Is Not Proof of Governance 

One of the most important findings from recent research is not simply that boards struggle with cybersecurity. It is that many directors believe they are providing effective oversight, while cybersecurity specialists looking at the same process disagree.

The researchers interviewed directors, cybersecurity executives, and senior consultants, while also reviewing 1,000 firms from the Russell 3000. Only 14.7% reported having at least one director with cybersecurity or closely related expertise. More than half of the non-expert directors interviewed believed that specific cybersecurity expertise was not necessary for effective oversight, while none of the expert directors agreed.

The difference was not about effort. Non-expert directors attended meetings, reviewed reports, completed training, and asked questions just as expert directors did. The problem was that these activities could still remain symbolic if directors did not have enough knowledge to understand which information was truly reassuring and which information should change the board’s view of risk.

Governance is not measured by how many meetings are held or how many reports are reviewed. It is measured by whether directors can challenge assumptions, influence important decisions, and recognise when positive metrics hide serious weaknesses.

The researchers describe this as the difference between symbolic and substantive oversight. Symbolic oversight looks like governance. Substantive oversight improves the decisions that follow.

More Dashboards, Same Blind Spot 

Reports Still Need Context

The natural response to weak oversight is often to give directors more information: more dashboards, more indicators, more reports, and more external reviews.

But the problem is often not a lack of information. It is a lack of context, interpretation, and challenge.

A lower number of critical vulnerabilities may mean security has improved, but it may also mean the organisation changed how it measures them or reduced the scope of its scanning. High compliance scores may show that processes are being followed, but they may say very little about whether the organisation can continue operating during an attack. A positive assurance report may confirm that a review took place without showing whether it covered the systems, suppliers, and dependencies that matter most.

Without context, information can create confidence instead of understanding.

The information gap may also be larger than boards realise. In a supporting survey, CISOs estimated that the median share of peers who filtered reports to make themselves or their managers look better was 40%. The study does not prove that 40% of board reports are false, but it does show that experienced security leaders see selective reporting as a real governance risk.

A board without enough expertise may not notice when information has been softened, simplified, or framed to highlight progress. More importantly, it may not realise that there is anything to notice.

Monitoring Does Not Mean Governing 

Another study offers a useful way to think about this issue. Instead of treating oversight as a regular reporting task, the authors argue that boards should approach cybersecurity as an ongoing process of strategic sensemaking.

They describe three activities: scanning, interpretation, and action. These should continue before an incident, during an attack, and throughout recovery.

The board’s role is not to manage cybersecurity operations. It is to make sure the organisation keeps identifying important risks, understands what they mean for the business, and makes decisions that improve long-term resilience.

Accountability Starts Before the Incident

Governance failures often begin long before a cyber incident reaches the boardroom.

They begin when ownership of important risks is unclear, when business leaders assume cybersecurity belongs only to the security team, when supplier risk is reviewed separately from business continuity, or when management’s confidence is not supported by evidence the board can examine.

By the time an incident happens, many of the decisions that shape its impact have already been made. The organisation has already decided which systems are most important, which risks it will accept, which remediation deadlines can move, and which recovery capabilities deserve funding.

Strategic oversight therefore starts with clear ownership, clear decision rights, reliable evidence, and a direct link between cyber risk and business priorities.

The Questions Have Changed

For many years, boards asked whether the organisation had the right controls, whether regulatory duties had been met, or whether audits had found serious weaknesses. Those questions still matter, but they are no longer enough.

A stronger governance discussion asks whether the board understands which cyber risks could affect the organisation’s strategy, who owns those risks outside the security team, what evidence supports management’s confidence, and how directors would know if their current view of risk was no longer correct.

These questions are harder because they do not only ask for information. They ask for understanding.

Smart Directors Can Still Ask the Wrong Questions 

The study does not say that every board must appoint a former CISO. It does show that boards without real cybersecurity knowledge face a greater risk of confusing visible governance activity with effective oversight.

Directors with cybersecurity expertise are more likely to notice gaps, challenge assumptions, test reports, and separate technical detail from business impact. Their value is not mainly in explaining technology. It is in improving the board’s judgement.

One of the most important findings is that directors without cybersecurity expertise often do not realise that their oversight may lack depth. This creates a serious blind spot because boards cannot easily fix a weakness they do not recognise.

That does not mean one expert should carry the responsibility for the whole board. All directors still need to understand how cyber risk affects strategy, operations, finance, compliance, and trust. Expertise should improve the board’s work, not replace shared responsibility.

If Everyone Owns Cyber Risk, No One Does

Both studies point to the same basic issue: effective cybersecurity governance depends on visibility.

Directors need to know who owns important risks, how decisions are made, what evidence supports management’s confidence, which dependencies affect resilience, and how risk is changing across the organisation. Without that visibility, accountability is difficult to test or prove, even when everyone is acting in good faith.

Technology cannot create board accountability, but it can make accountability easier to see, challenge, and support with evidence.

This is where a governance platform can help. Its value is not in creating another separate dashboard, but in connecting risks, ownership, controls, evidence, compliance duties, and third-party relationships in one place.

Conclusion

The Board Will Be Judged by What It Can Prove 

Regulators, investors, customers, and executive teams increasingly expect boards to show not only that cybersecurity appears on the agenda, but that directors understand how cyber risk is governed, challenged, and connected to strategy.

That expectation cannot be met through reporting alone. It requires boards that are willing to question their own assumptions, organisations that can prove accountability instead of only describing it, and governance processes that turn cybersecurity from a technical issue into a business decision.

The boards that govern cyber risk well will not necessarily be those that receive the most information. They will be those that can challenge what they are told, recognise what is missing, and connect cyber risk to the decisions that shape the organisation’s future.

For Further Reading

This blog post is based on insights and analysis from:

  • Lowry, Michelle R., Anthony Vance, and Marshall D. Vance. “Inexpert supervision: Field evidence on boards’ oversight of cybersecurity.” Management Science 72.2 (2026): 783-804. https://doi.org/10.1287/mnsc.2023.0414

The Policy Says One Thing. The Organisation Does Another. Why?

Posted on by CISOteria

Approved on Paper. Ignored in Practice

Most organisations already have security policies.

They explain how employees should handle data, approve access, share files, use devices, and report incidents. On paper, the rules are clear. Responsibilities are assigned, controls are documented, and the organisation can point to a formal process.

Then the policy meets daily work.

An employee cannot complete a task quickly enough through the approved system, so they create a workaround. A manager uses a faster channel because the official process feels too slow. A team adopts an unauthorised tool because the approved one does not fit the work.

The problem is not always that employees do not know the rules. The policy describes how work is supposed to happen, while employees deal with how work actually happens.

On Paper, Everything Works

Knowing the Policy Is the Easy Part

Recent research on information security policy compliance shows that awareness alone is not enough. Employees may understand the rules and still behave differently when the approved process feels difficult, time-consuming, unclear, or disconnected from the pressures of their role. The research describes this as a “knowing-doing” gap: people may know what the organisation expects without consistently following it in practice.

Organisations often assess policy strength through formal evidence: an approved document, completed training records, and a successful audit review. Those signals show that the process exists, but they reveal far less about how employees behave under pressure.

Deadlines, slow systems, unclear instructions, and competing business demands often shape daily decisions more than the policy itself.

Green Checks Can Hide Grey Practices 

A policy may be formally approved, communicated across the organisation, included in training, and reviewed during an audit, yet still remain weakly connected to daily work. From a governance perspective, those visible signs can create a level of confidence that the organisation has not fully earned.

Leadership can see the document, the completion records, and the audit result. It has far less visibility into the small decisions employees make when the official process slows them down, creates extra work, or conflicts with an urgent business need. A team may use an unapproved tool, a manager may accept an informal exception, or an employee may skip a step that seems unnecessary in the moment. None of these actions may appear serious on their own, but together they can create a growing gap between the control environment described in policy and the one that actually exists.

The difficulty is that formal evidence usually records whether a process was designed, approved, or reviewed. It rarely shows how consistently that process is followed under pressure. As a result, an organisation may report strong compliance while the day-to-day reality depends on workarounds, local habits, and decisions that never reach the formal governance process.

Good Intentions Can Create Bad Security 

The Employee Followed Security – Just Not Yours 

A 2025 study examined what the researchers call shadow security practices – unofficial security-related workarounds created by employees who still believe they are protecting the organisation.

An employee may save important files on a personal device because the approved backup system is slow. The intention is protective, but the result is still outside the organisation’s control and may violate data-handling rules.

Shadow security is difficult to manage because the employee may still be trying to protect the organisation. They are balancing a business task with a security requirement, but doing so through a method the organisation cannot see or govern. 

Too Much Security Can Drive Work Underground 

The same study surveyed 433 office workers and found that information security overload increased employees’ intention to use unofficial security practices. When people felt that security duties added pressure, delayed their work, or made primary tasks harder, they were more likely to create their own solution.

This does not mean controls should disappear whenever they create friction. Some friction is necessary because the risk justifies it.

The problem begins when the organisation adds controls without understanding their combined effect. One approval, one authentication step, and one reporting requirement may each seem reasonable. Employees, however, experience the full process. When those requirements accumulate, the approved path may become harder to follow than the workaround.

Another Training Session Will Not Fix the Process 

Security Communication or Security Noise?

The shadow security study found that employees were less likely to create workarounds when they understood how security measures worked, why management required them, and what outcomes the measures were meant to achieve.

However, the study also found that excessive communication can increase overload. More emails, more warnings, and more training do not automatically create better behaviour. They can create confusion, fatigue, and pressure.

The goal should therefore not be maximum communication. It should be useful communication that explains the risk, the reason for the rule, and the practical way to follow it.

Culture Decides Which Rules Survive 

The 2025 systematic review found that policy compliance is influenced by employee attitudes, perceived effectiveness of security measures, management support, awareness, and organisational culture.

Employees notice whether leaders follow the same rules they promote. They notice whether managers reward speed while security demands caution, and whether reporting a problem leads to support or blame.

A policy may say that security is everyone’s responsibility, but the organisation teaches a different lesson when deadlines always win or exceptions are quietly ignored.

Training cannot fix that on its own. If the approved process is too slow, another awareness session will not make it faster. If employees are rewarded for speed and punished for delay, a reminder about compliance will not change the incentive.

Workarounds Are Also Evidence

A workaround should not be accepted simply because the employee had good intentions. Unapproved practices can still create serious risk.

But they should be studied.

A workaround shows where the official process and actual work have separated. It may reveal a missing tool, unclear ownership, a slow approval chain, or a policy that was written without enough operational input.

The organisation should examine both the employee’s decision and the conditions that made the approved process difficult to follow.

Approved, Published, Forgotten  

A policy becomes useful when the organisation can see how it is being applied.

That requires clear ownership, defined controls, evidence, exceptions, and regular review. It also requires visibility into where practice is moving away from policy.

For organisations using CISOteria, this means connecting policies to the controls, owners, evidence, risks, and compliance requirements they are meant to govern. The value is not simply in storing the policy. It is in showing whether the policy is active, who is responsible for it, what proves that it is being followed, and where gaps remain.

CISOteria does not enforce employee compliance. It gives the organisation visibility into whether policy and practice remain aligned.

Conclusion:

The Rules That Survive Pressure Are the Rules You Actually Have 

Every organisation has two versions of its security policy. One is written, approved, and presented during audits. The other is shaped by daily decisions, management behaviour, informal exceptions, and the pressure employees face when they try to get work done.

Good governance begins with recognising the gap between the two. The organisation needs to understand where practice has moved away from policy, why that happened, and whether the right response is stronger enforcement, clearer communication, a better process, or a revised policy.

Because the written policy shows what the organisation intends to do. Daily behaviour shows what it has actually made possible.

For Further Reading

This blog post is based on insights and analysis from: