Setting Next Year's Cyber Expectations for Management

Ask a management team what the board expects of the security program next year and most will give a thoughtful guess. That is not a criticism of management. It is a gap in governance: the board has expectations, it has simply never said them out loud.

A page of written expectations, agreed before the year starts, changes the relationship. Management stops guessing, the board stops being surprised, and the quarterly reviews finally have something to measure against.

Key takeaways

• Boards get the program they ask for; most have never asked in writing.

• Expectations should name outcomes and evidence, not activities and effort.

• A page beats a binder: five to seven expectations, each checkable.

• The expectations are the rubric for every quarterly review next year.

• The conversation to draft them is as valuable as the document.

Step 1: Start from what this year taught

The expectations grow out of the year's record: where the program strained, which board questions came late, what the incidents and near-misses exposed. The review of the year is the raw material; the expectations are what it was for.

Two or three of next year's expectations should trace directly to something the board wishes it had known sooner this year.

Step 2: Write outcomes, not activities

"Hold two tabletop exercises" is an activity, and it can be satisfied by two useless exercises. "The executive team can run the response plan without the playbook open" is an outcome, and the exercise is just how you get there.

This fictional example shows the shape. It is an illustration, not a prescription.

The evidence column is the whole point: it tells management exactly what to bring.

Step 3: Agree the expectations with management, not at them

The drafting conversation is where the value hides. Management knows what is feasible and what the expectations will crowd out; the board knows what it needs to be able to say it oversaw. An hour of that negotiation produces a page both sides will defend in September.

Step 4: Use the page in every quarterly review

The expectations retire the standing question "so how are we doing?" Each quarterly review measures against the page: met, moving, stuck, and what the board is being asked to do about the stuck ones.

The four-meeting cyber cadence is where these check-ins live, and the architecture diagram the board sees annually belongs in one of them.

Frequently asked questions

Isn't this management's job, not the board's?

Setting the program is management's job. Stating what the board needs to see to discharge its oversight is the board's. The expectations are the contract between those two roles.

How many expectations is right?

Five to seven. More than that is a program plan, which is management's document. The board's page should fit in the pack and survive the year unchanged.

What if management misses an expectation?

That is the quarterly conversation the page enables: why, what changed, and what the board can do, including reprioritizing. A missed expectation with a reason is oversight working.

Should the expectations be public?

Inside the company, yes; management teams steer better when the expectations are known. External publication is a separate disclosure judgment for counsel and leadership.

A Defensible Next Step

Before the first meeting of the new year, draft the page: five to seven expectations, each with its evidence and check-in. Book a Decision-Clarity Call if you want a facilitated session to write it.