Cyber Resilience Planning: Top 10 Actions
What Every Board Should Ensure Is in Place BEFORE a Cyber Incident
CyberCQR Top 10 | January 2026 | 5 minutes reading time
Why This Matters
Prepared boards make better decisions under pressure, and prepared organisations recover faster. This Top 10 list provides board-actionable items that can be implemented in 90 days.
1. Establish Clear Board-Level Cyber Governance
What to do:
- Assign cyber risk oversight to a specific board committee (Audit, Risk, or dedicated Cyber Committee)
- Appoint a board-level cyber "champion" with accountability for driving oversight
- Establish minimum quarterly cyber risk reporting to full board
- Document board's cyber risk appetite in writing
✓ Success Indicator: Board agenda includes standing cyber risk item; meeting minutes reflect cyber discussions with documented decisions.
2. Mandate and Review Incident Response Plan
What to do:
- Require management to maintain board-approved incident response plan
- Review plan annually—don't just accept attestation that it exists
- Ensure plan addresses: decision authority, communication protocols, external resources, legal/regulatory obligations
- Verify plan has been tested with actual simulation (not just tabletop discussion)
✓ Success Indicator: Board has reviewed incident response plan summary within past 12 months; plan includes board communication protocols.
3. Verify Adequate Cyber Insurance Coverage
What to do:
- Review cyber insurance policy terms—understand what IS and ISN'T covered
- Verify coverage limits are appropriate for organisation's size and risk profile
- Confirm policy includes: ransomware payments, business interruption, third-party liability, regulatory defence
- Understand policy requirements (e.g., MFA, backups) that must be maintained
- Pre-approve incident response firms so they're ready when needed
✓ Success Indicator: Board understands coverage limits, exclusions, and deductibles; pre-approved response firms documented.
4. Pre-Identify External Expertise and Legal Counsel
What to do:
- Retain specialised cyber incident response firm (on retainer or pre-approved)
- Identify law firm with cyber breach experience (for privilege protection and regulatory guidance)
- Pre-approve forensics firm for evidence collection
- Establish relationships with crisis communications firm
- Document contact information for immediate 24/7 activation
✓ Success Indicator: Pre-approved vendors with documented 24/7 contact procedures; no need to "find" experts during incident.
5. Understand Your "Crown Jewels" and Critical Systems
What to do:
- Require management to identify most critical assets: data, systems, processes
- Understand which systems, if compromised, would cause material business impact
- Know your data: what sensitive information exists, where it's stored, who has access
- Understand dependencies: critical vendors, cloud services, third-party providers
✓ Success Indicator: Board can articulate (in non-technical terms) what assets are most critical and what losing them would mean.
6. Establish Decision Authority for Incident Response
What to do:
- Pre-authorise CEO (or incident commander) to make rapid decisions within defined parameters
- Establish financial thresholds requiring board approval (e.g., ransom payments over $X)
- Define when full board convenes vs. committee chair authority
- Document decision-making process to demonstrate governance
✓ Success Indicator: Written delegation of authority exists; management knows when to escalate to board vs. proceed independently.
7. Prepare Communication Protocols and Templates
What to do:
- Develop pre-approved message templates for: customers, regulators, media, employees, partners
- Establish board notification protocols (how/when board is informed)
- Designate official spokesperson(s) and backup
- Prepare "dark website" or communication channel if primary systems compromised
✓ Success Indicator: Communication templates exist and reviewed by legal counsel; board knows how it will be notified.
8. Understand Regulatory Obligations and Timelines
What to do:
- Document applicable regulations: GDPR (72 hours), SEC (4 days), sector-specific requirements
- Understand what triggers reporting obligation vs. what can be managed internally
- Know notification requirements for affected individuals (customers, employees)
- Establish process for determining materiality for SEC disclosure
✓ Success Indicator: Board understands reporting timelines; legal team has documented requirements and notification process.
9. Participate in Tabletop Exercise Annually
What to do:
- Board members participate in at least one cyber incident simulation annually
- Exercise should test: decision-making, communication, external coordination, regulatory compliance
- Use realistic scenarios: ransomware, data breach, system outage, AI hijacking
- Document lessons learned and update response plan accordingly
✓ Success Indicator: Board participated in tabletop within past 12 months; exercise identified and addressed gaps.
10. Review and Approve "Ransom Payment" Decision Framework
What to do:
- Establish pre-approved decision criteria: Under what circumstances would organisation consider paying ransom?
- Understand legal constraints: OFAC sanctions, law enforcement guidance
- Document factors for consideration: business impact, data sensitivity, recovery alternatives, legal/ethical implications
- Clarify board vs. management authority for this decision
✓ Success Indicator: Framework exists and reviewed by board; no need to debate philosophy during active incident.
90-Day Implementation Checklist
| Action | Timeline | Owner |
|---|---|---|
| 1. Board Cyber Governance | Week 1-2 | Board Chair |
| 2. Incident Response Plan | Week 2-4 | CISO/CIO |
| 3. Insurance Coverage Review | Week 3-5 | CFO/Risk Mgmt |
| 4. Pre-Approve External Experts | Week 4-6 | General Counsel |
| 5. Crown Jewels Assessment | Week 5-7 | CISO + Business Units |
| 6. Decision Authority Framework | Week 6-8 | General Counsel + CEO |
| 7. Communication Templates | Week 7-9 | Communications + Legal |
| 8. Regulatory Obligations Mapping | Week 8-10 | General Counsel |
| 9. Tabletop Exercise | Week 10-12 | CISO + Board |
| 10. Ransom Payment Framework | Week 11-12 | Board + Legal |
These 10 actions can be completed in 90 days.
Organisations that implement all 10 reduce the impact of an incident and demonstrate proper governance to regulators, insurers, and shareholders.
About CyberCQR
CyberCQR provides strategic cybersecurity advisory services to boards and C-suite executives. We help organisations implement these Top 10 actions through board briefings, tabletop exercises, and governance framework development.
Our Services Schedule ConsultationDocument ID: BOARD-TOP10-001 | Version: 1.0 | Date: 05 January 2026 | Series: Top 10 for Boards