Board cyber-risk briefing for directors

Why cyber risk belongs on the board agenda

Cyber incidents are now business incidents. A single fake invoice, a ransomware attack or a leak of customer data can stop operations, cost money directly, trigger data protection investigations and damage the trust of customers, regulators and investors.

Most attacks on organisations start with a person, not a system: an employee who clicks a convincing link, approves a fraudulent payment or reuses a password. That makes cyber risk a people and leadership issue as much as a technology one, and it is why boards and directors need to understand it.

The risks directors should understand

• Phishing and business email compromise: fake emails and messages that steal logins or trick staff into paying criminals.
• Payment and invoice fraud: requests to change a supplier's bank details or make an urgent transfer, often appearing to come from a senior person.
• Ransomware: attackers lock systems and data and demand payment.
• Impersonation and deepfakes: AI-cloned voices and videos of executives used to authorise payments or share information.
• Data breaches: personal or confidential data exposed, with obligations under data protection law.
• Supplier and third-party risk: an attack on a supplier or software provider that reaches your organisation.
• Shadow AI: staff using unapproved AI tools and putting confidential information into them.

Ten questions directors should ask management

• Who is accountable for cybersecurity at executive level, and how often do they report to the board?
• What are our most valuable systems and data, and what would happen if we lost access to them for a week?
• Have all staff had cybersecurity awareness training in the last 12 months, and how do we know it worked?
• What is our rule for verifying payment requests and changes to bank details, and is it always followed?
• Is multi-factor authentication switched on for email and all key systems?
• How quickly are suspicious emails reported, and how many staff report them?
• Do we have an incident response plan, and when did we last test it?
• Which suppliers have access to our systems or data, and how do we check their security?
• Do we have a written AI use policy, and do staff know which AI tools are approved?
• Are we meeting our obligations under data protection law in each country where we operate?

Measures that show whether your people are ready

Ask for a short, regular report that tracks a few meaningful measures rather than technical detail:

• Share of staff who completed awareness training this year
• Share of staff who report simulated or real phishing messages
• Multi-factor authentication coverage for email and key systems
• Payment requests verified by call-back, and any exceptions
• Time taken to detect, report and contain incidents
• Share of staff who have read and accepted the AI use policy

What the board itself should do

• Set the organisation's appetite for cyber risk and make sure it is reflected in budgets and priorities.
• Name a senior owner for cybersecurity and for safe AI use.
• Make sure every employee, including the leadership team, receives practical awareness training.
• Approve and test the incident response plan, including how the board will be informed and who speaks for the organisation.
• Review the measures above at least twice a year.

Data protection obligations

Organisations that handle personal data have legal duties to protect it and, in many cases, to report breaches. In our markets these include the Nigeria Data Protection Act 2023 (NDPA), the Protection of Personal Information Act (POPIA), Kenya's Data Protection Act, 2019, Ghana's Data Protection Act, 2012 (Act 843). This briefing is general guidance, not legal advice: take advice on your organisation's specific obligations.