Boards themselves need to boost their effectiveness. in the past they have been focused on matters in the business and communicating with the CEO etc.
Now security must be included but they don't know how to approach the subject.
Audit findings leave them wondering how to measure any kind of change.
Boards need to engage with security professionals and hear what is said about the subject.
They need to ask tough questions and expect replies in a short timeframe.
When the answers come they need to listen and understand the key issues.
Board members need to engage between meetings. It’s about being able to stay current. Impromptu discussions strengthen a board’s understanding of the company’s pulse. Keeping board members informed also minimises the background time that slows up board meetings. Board members need to elevate issues that they’re seeing on security that they should all be thinking about.
