Cyber Resilience Planning: Top 10 Actions

What Every Board Should Ensure Is in Place BEFORE a Cyber Incident

CyberCQR Top 10 | January 2026 | 5 minutes reading time

Why This Matters

Organisations with cyber incident preparation reduce breach impact by 60-80% and recover 3x faster than unprepared peers. This Top 10 list provides board-actionable items that can be implemented in 90 days.

1. Establish Clear Board-Level Cyber Governance

What to do:

• Assign cyber risk oversight to a specific board committee (Audit, Risk, or dedicated Cyber Committee)
• Appoint a board-level cyber "champion" with accountability for driving oversight
• Establish minimum quarterly cyber risk reporting to full board
• Document board's cyber risk appetite in writing

2. Mandate and Review Incident Response Plan

What to do:

• Require management to maintain board-approved incident response plan
• Review plan annually—don't just accept attestation that it exists
• Ensure plan addresses: decision authority, communication protocols, external resources, legal/regulatory obligations
• Verify plan has been tested with actual simulation (not just tabletop discussion)

3. Verify Adequate Cyber Insurance Coverage

What to do:

• Review cyber insurance policy terms—understand what IS and ISN'T covered
• Verify coverage limits are appropriate for organisation's size and risk profile
• Confirm policy includes: ransomware payments, business interruption, third-party liability, regulatory defence
• Understand policy requirements (e.g., MFA, backups) that must be maintained
• Pre-approve incident response firms so they're ready when needed

4. Pre-Identify External Expertise and Legal Counsel

What to do:

• Retain specialised cyber incident response firm (on retainer or pre-approved)
• Identify law firm with cyber breach experience (for privilege protection and regulatory guidance)
• Pre-approve forensics firm for evidence collection
• Establish relationships with crisis communications firm
• Document contact information for immediate 24/7 activation

5. Understand Your "Crown Jewels" and Critical Systems

What to do:

• Require management to identify most critical assets: data, systems, processes
• Understand which systems, if compromised, would cause material business impact
• Know your data: what sensitive information exists, where it's stored, who has access
• Understand dependencies: critical vendors, cloud services, third-party providers

6. Establish Decision Authority for Incident Response

What to do:

• Pre-authorise CEO (or incident commander) to make rapid decisions within defined parameters
• Establish financial thresholds requiring board approval (e.g., ransom payments over $X)
• Define when full board convenes vs. committee chair authority
• Document decision-making process to demonstrate governance

7. Prepare Communication Protocols and Templates

What to do:

• Develop pre-approved message templates for: customers, regulators, media, employees, partners
• Establish board notification protocols (how/when board is informed)
• Designate official spokesperson(s) and backup
• Prepare "dark website" or communication channel if primary systems compromised

8. Understand Regulatory Obligations and Timelines

What to do:

• Document applicable regulations: GDPR (72 hours), SEC (4 days), sector-specific requirements
• Understand what triggers reporting obligation vs. what can be managed internally
• Know notification requirements for affected individuals (customers, employees)
• Establish process for determining materiality for SEC disclosure

9. Participate in Tabletop Exercise Annually

What to do:

• Board members participate in at least one cyber incident simulation annually
• Exercise should test: decision-making, communication, external coordination, regulatory compliance
• Use realistic scenarios: ransomware, data breach, system outage, AI hijacking
• Document lessons learned and update response plan accordingly

10. Review and Approve "Ransom Payment" Decision Framework

What to do:

• Establish pre-approved decision criteria: Under what circumstances would organisation consider paying ransom?
• Understand legal constraints: OFAC sanctions, law enforcement guidance
• Document factors for consideration: business impact, data sensitivity, recovery alternatives, legal/ethical implications
• Clarify board vs. management authority for this decision

These 10 actions can be completed in 90 days.

Organisations that implement all 10 reduce breach impact by 60-80% and demonstrate proper governance to regulators, insurers, and shareholders.

About CyberCQR

CyberCQR provides strategic cybersecurity advisory services to boards and C-suite executives. We help organisations implement these Top 10 actions through board briefings, tabletop exercises, and governance framework development.

Document ID: BOARD-TOP10-001 | Version: 1.0 | Date: 05 January 2026 | Series: Top 10 for Boards