Cybersecurity in the boardroom: 5 questions every director should ask

In brief

• Article 23 of Italian Legislative Decree 138/2024, which transposes NIS2, gives management bodies four explicit duties: approve how risk management measures are implemented, supervise that implementation, answer for breaches, and train themselves and their staff.
• Entities added to the Italian National Cybersecurity Agency (ACN) register during 2025 must adopt baseline measures by October 2026, under Article 3 of ACN Determination 379907/2025. The clock runs from each entity’s own notification, so the exact date differs.
• Fines reach 10 million euro or 2% of worldwide turnover for essential entities. Where an entity ignores a formal notice from ACN, the individual concerned can be temporarily banned from management functions (Article 38(6)).
• The most common blind spot is the document that has already been shared. Authentication and encryption in transit cover the first access; after that the file gets forwarded, copied or uploaded to an external AI system.
• FileGrant, the file-centric platform from CyberGrant, addresses the blind spot behind the second question: it encrypts the document at creation, keeps the protection in force after sharing through revocation and expiry dates, and records every open, edit and download.
• A board does not prove compliance with policies. It proves compliance with evidence the system produces on its own, available without a special collection effort.

Cyber risk governance and management body accountability

Boards are not short of reports. Dashboards, patching percentages and risk indices arrive every month. What is missing is the set of questions that turn those reports into decisions.

Article 23 of Legislative Decree 138/2024 sets out what management bodies owe: approving how cyber risk management measures are implemented, supervising that implementation, answering for breaches of the obligation, and completing cybersecurity training while extending it across the workforce. Those four duties define the perimeter of director accountability under NIS2.

A director does not need to read a SIEM report. A director needs to tell whether the answer coming back describes a real control or a well-packaged reassurance.

Five questions the board should put to the CISO

These are the five questions for the CISO, and for the CEO, risk manager, legal counsel and internal audit, that separate one from the other.

Question 1. Which data could we lose tomorrow morning, and who holds it today?

Why it matters. You cannot protect what you have not mapped. Many organizations have a mature technology inventory and no map of their information assets: personal data, contracts, project files, credentials, backups, material shared with third parties. Meanwhile the data spreads across cloud services, SaaS tools, consultants and AI platforms.

A solid answer includes:

• An approved taxonomy for classifying information (public, internal, confidential, critical).
• A data inventory tied to business processes, with business owners rather than only technical ones.
• The location of every dataset: cloud, SaaS, endpoints, backups, third parties.
• Periodic review of access privileges.
• An assessment of what has been uploaded to AI tools, including unsanctioned ones.

An effective answer is a synthesis. For example: “These ten datasets support 70% of revenue. Here are the owners, the risks and the actions under way.”

Warning sign. “The data is on our systems”, “we back everything up”, “access is handled through Active Directory”. Answers like these confuse infrastructure with information. The shadow AI picture is usually missing too: IBM’s Cost of a Data Breach Report 2025 found that shadow AI was involved in 20% of breaches, and that only 37% of breached organizations had an AI governance policy at all. Among those that did, just 34% ran regular audits for unsanctioned AI.

Question 2. What happens to our documents after we share them with a supplier or a client?

Why it matters. Most security programs protect initial access: authentication, endpoint controls, encryption in transit. Once the file has been sent, downloaded or forwarded, the organization loses visibility and control. The document can be copied, uploaded to an external AI system, or kept past the end of the contract.

NIS2 supply chain security makes this a board-level subject. ACN Determination 127437/2026, adopted in April 2026, introduced the listing of relevant suppliers, which turns third-party management into a resilience control rather than a contractual formality.

A solid answer describes file-centric protection across the whole life of the document:

• Rules on what gets shared, with whom and through which channels.
• Named access with multi-factor authentication, and download and forwarding restrictions on sensitive documents.
• Traceability of who opens, edits, downloads or forwards a critical file.
• Access revocation after sharing, including automatic expiry at the end of a contract.
• Clauses covering incident notification, subcontractors, and return or deletion of data.
• A list of relevant suppliers mapped to the services, data and processes that matter.

Warning sign. “We had them sign an NDA” does not cover it: contractual confidentiality is no substitute for a technical control and an audit trail. Other critical signals are email attachments used for sensitive documents, folders with no owner, blanket access granted to entire supplier organizations, and the inability to say which third parties can reach critical data or systems right now.

Question 3. How long would an operational outage last, and what would it cost us?

Why it matters. A mature security program does not only count attacks blocked. It measures the ability to keep operating. Ransomware, or the compromise of a supplier, can stop production, logistics, invoicing and regulated services.

IBM’s Cost of a Data Breach Report 2026 puts the global average cost of a breach at 4.99 million dollars, 12% above the 4.44 million reported for 2025. That figure covers investigation, recovery, service interruption, notifications, litigation and reputational damage.

A solid answer provides:

• Priority processes identified, with an up-to-date business impact analysis.
• Defined objectives: recovery time objective, recovery point objective, minimum service level.
• Backups that are isolated, shielded from administrative credentials and genuinely tested.
• Periodic tabletop exercises involving the CEO, legal, communications and the board.
• Real timings from tests or incidents, not statements of policy.

For example: “Order management has to restart within eight hours. The last test took six hours and twenty minutes; we found an undocumented dependency on a SaaS supplier, and the recovery plan will be updated this quarter.”

Warning sign. “We have a disaster recovery plan”, “backups run every night”, “we have never had a serious outage”. None of these answers a question about time and cost. The signals to watch are a recovery objective that exists on paper but has never been measured, a restore test that was a document review rather than an actual restore, a dependency map that stops at the company’s own systems, and a continuity exercise that has never involved anyone outside IT.

Question 4. Who answers personally if we are not compliant, and with what consequences?

Why it matters. This is the uncomfortable question, and it makes NIS2 accountability concrete. The decree asks directors to steer, approve and oversee, and leaves firewalls and incident response to the people who run them. The CISO proposes controls and supplies evidence; accepting material risk stays a governance responsibility.

The board also needs the sanctions picture: up to 10 million euro or 2% of worldwide annual turnover for essential entities, up to 7 million or 1.4% for important ones. Where an entity fails to comply with a formal notice from ACN, additional measures can reach the legal representative and the members of the management body. A cyber insurance policy removes none of the regulatory obligations and can carry significant exclusions for known weaknesses or insufficient diligence.

A solid answer is a board presentation setting out:

• Cyber risk, with defined reporting frequency and indicators.
• Risks formally accepted, by whom and for how long.
• Board decisions recorded in the minutes: programs, budgets, remediation plans, exercises.
• Cybersecurity training for the board, periodic and kept current, extended to directors and to the whole organization.
• Insurance coverage, with limits and exclusions known to the directors.

Warning sign. “That sits with compliance”, “IT handles it”, “we have cyber insurance, so we are covered”, “the board is informed only in case of a serious incident”, “the training can wait”. Absent information, absent decisions and absent action, director training in particular, are a direct exposure, because the obligation is written into the decree.

Question 5. How would we demonstrate compliance to an inspector or auditor, with no preparation?

Why it matters. Compliance has become a resilience lever. Policies, procedures and certifications count for little if the organization cannot produce evidence quickly that the controls actually work. The gap between “we have a policy” and “we can show it works” is where non-compliance risk lives.

ACN Determination 127437/2026 moves in that direction: it updated how the ACN digital platform is accessed and used, and introduced the categorization of activities and services alongside the listing of relevant suppliers. NIS2 compliance therefore has to rest on structured, current information that reconciles with how the business actually runs. For entities registered in 2025, Article 3 of ACN Determination 379907/2025 sets the deadline for baseline measures at eighteen months from their notification, which falls in October 2026.

A solid answer is management producing, with no extraordinary effort, information covering:

• The applicable scope of risk management and the critical processes.
• Board decisions and evidence of director training.
• A risk register with owners, deadlines and accepted residual risks.
• An inventory of data, critical assets and relevant suppliers, with their assessments.
• Results of vulnerability assessments, penetration tests, audits and restore tests.
• A register of incidents and exercises, with the status of corrective actions.

Warning sign. “We would have to ask the various functions”, “the documentation is spread around”, “the latest tests were never formalized”. Answers of this kind describe a compliance posture that wakes up when an audit approaches. Cyber resilience works as a continuous process.

From reassurance to proof: resilience as a governance responsibility

No answer guarantees absolute security. A board that understands its own accountability for cyber risk stops looking for reassurance and starts demanding clarity: on critical assets and processes, on external dependencies, on recovery times, on the risks it has formally accepted, and on the evidence that the measures in place actually work.

NIS2 makes one principle explicit: cybersecurity is business continuity and corporate governance. A director is not expected to have the technical skill of a SOC analyst. A director is expected to tell a metric from a piece of evidence, a declared measure from a verified one, and a reassurance from an informed decision. Demonstrable resilience is measured on that ability.

Evidence is not collected. It either exists or it does not

The gap between “we have a policy” and “we can show it works” is decided at the moment a document is shared. If that step happens over email or in a folder with no owner, the evidence has to be rebuilt afterwards by asking each function, which is precisely the behaviour an auditor reads as fragile compliance.

FileGrant reverses the order: the record exists because the document was born inside a perimeter that tracks it. Who opened it, when, from where, what they downloaded, who they forwarded it to. Final files can carry a legal timestamp certificate, which leaves them downloadable and no longer editable.

For a board, that is the difference between a reassurance and a proof. Explore FileGrant

How does FileGrant answer the board’s five questions?

Of the five questions, the second and the fifth are the ones an organization answers with a technical control or does not answer at all. The other three rest on something else: a business impact analysis, a set of board minutes, a remediation plan. For the document already in a supplier’s hands, the standard answer is still the NDA, which is a contractual commitment and produces neither control nor traceability.

FileGrant, the file-centric platform from CyberGrant, works exactly there. The document is encrypted at creation and stays encrypted once it leaves: downloads use Lock&Go with CRYSTALS-Kyber quantum-safe cryptography (NIST FIPS 203). Access is named, revocable in real time and expirable at the end of a contract, including on files already downloaded locally. Screenshots and screen sharing on Zoom, Meet and Teams are blocked while a document is open, and a dynamic watermark carries user name, date and time across every page on screen. Protected files are not readable by artificial intelligence systems, which closes the channel that Question 1 flags as unguarded in most organizations.

When third-party sharing is structured, as in a due diligence exercise or an inspection, FileGrant runs it as a virtual data room: a dedicated space, permissions per user or per group, tags for classifying documents, online editing integrated with Microsoft 365, and a legal timestamp certificate on final files, which stay downloadable and become uneditable.

On the fifth question the contribution is different, and it is the one a board cares about most. The FileGrant Activity area keeps who opened, edited, downloaded or forwarded a document, with the action and the timestamp, and supports notifications on operations involving shared files. On Behalf mode lets super administrators run security checks for a user during an audit or an incident response. The evidence exists because the document was born inside a perimeter that records it, rather than because somebody assembled it ahead of the audit.

Where documents already live in SharePoint and OneDrive, the same encryption arrives through Connector from CyberGrant, with no migration and without replacing Microsoft 365. Automatic content classification comes from the AIGrant extension, which applies FileGrant permissions while retrieving documents.

On how long an outage would last and on who answers personally to the regulator, FileGrant is not the answer: the first is operational continuity, the second is governance. It does reduce the value of what gets taken out, because an exfiltrated file stays encrypted. See the FileGrant features page or the DLP solutions page.

FAQ

What are a board’s cybersecurity responsibilities under NIS2?

Under Article 23 of Italian Legislative Decree 138/2024, which transposes NIS2, management bodies approve how cyber risk management measures are implemented, supervise that implementation and answer for breaches of the obligation. They must also complete cybersecurity training and extend it to staff. The role is not operational: the board directs, approves and oversees.

Can board members be sanctioned under NIS2?

Yes, with graduated consequences. Fines apply first to the essential or important entity. The individual responsible for the failure, or the legal representative, can be held liable when the represented entity breaches the decree (Article 38(5)). If the entity fails to comply with a formal notice from the Italian National Cybersecurity Agency, a temporary ban from management functions can be imposed on the person concerned (Article 38(6)). That measure does not follow automatically from a fine.

What should a director ask the head of security?

Five things: which critical data we could lose and who holds it today; what happens to documents after we share them with third parties; how long an operational outage would last and what it would cost; who answers personally for non-compliance; and what evidence we could show an inspector with no preparation. The test is whether the answer is verifiable or merely reassuring.

What happens to company documents after they are shared with a supplier?

Once an attachment or a sharing link leaves the organization, visibility ends: the document can be copied, forwarded, uploaded to an external AI system or kept past the end of the contract. File-centric protection answers that blind spot by encrypting the document at creation, so controls stay attached to it outside the corporate perimeter. FileGrant, the file-centric platform from CyberGrant, applies persistent encryption, named access with expiry dates, revocation after sending and a full audit trail of every open and download.

How can confidential documents be shared with suppliers, advisors and auditors while keeping control?

Four controls are needed that an email attachment does not provide: named access instead of an open link, encryption that stays on the file after download, an expiry date tied to the length of the relationship, and a record of who did what. FileGrant applies all four in one space and, for structured exchanges such as a due diligence, runs as a virtual data room with permissions per user or per group, classification tags and online editing integrated with Microsoft 365. For documents that stay in SharePoint and OneDrive, the same encryption arrives through Connector from CyberGrant, with no migration.

How do you prove to an auditor who opened a confidential document?

You need an activity log produced by the system that holds the document, not a reconstruction assembled afterwards by asking each business function. The FileGrant Activity area keeps every access, edit, download and forward with user, action and timestamp, and allows notifications on operations involving shared files. Documents on screen carry a dynamic watermark showing user name, date and time, and final files can receive a legal timestamp certificate, which makes them downloadable and no longer editable.

Can access to an already shared document be revoked?

With an email attachment, no: once delivered, the file is beyond control. With file-centric protection, yes, because the authorization to decrypt stays on the server and is checked at every open. FileGrant allows access to be revoked in real time and expiry dates to be set, for example at the end of a supplier contract, including on files already downloaded locally.

Does FileGrant replace SharePoint, OneDrive or Microsoft Purview?

No, it sits alongside them. FileGrant adds the protection those environments lack: persistent encryption that follows the file outside the tenant, revocation after sharing, blocking of screenshots and screen sharing, and blocking of AI systems reading the content. Where files must stay where they are, Connector from CyberGrant brings the same quantum-safe encryption inside SharePoint and OneDrive, with no migration and with users keeping their Microsoft login.