Fifteen Minutes Is Not Oversight: Giving Cyber Real Board Time

The agenda says "Cyber update, 15 minutes," sandwiched between the financials and the facilities report. Management reads slides. A director asks one question. The chair moves the meeting along. Nothing is decided, because nothing was asked.

That is reporting, and reporting has its place. But oversight is a different activity. It needs time for directors to ask awkward questions, weigh options and make decisions. If the calendar never makes room for that, the board is watching the program instead of overseeing it.

Key takeaways

• Fifteen minutes of slides is reporting. Oversight needs time for questions and decisions.

• Put cyber on the agenda as a decision item with a short pre-read, not as an update.

• Protect one or two deep-dive sessions a year for the topics a summary cannot carry.

• Use the executive session. Some questions directors will only ask without management in the room.

• Someone owns the time. Usually the chair, working from a simple annual allocation.

Step 1: Count the minutes before you defend them

Pull the last four sets of meeting minutes and add up what cyber actually received. Not what the agenda promised; what the minutes record. How long was the discussion, and what did it produce?

If the honest answer is fifteen minutes and no decisions, the board is not overseeing the program. It is being briefed on it. Those are different activities with different evidence.

Step 2: Make the slot a decision slot

Every cyber agenda item should arrive asking for something: approve the risk acceptance, direct the investment, note the incident review and the remediation owner. An update with no ask is an email pretending to be a meeting.

The pre-read carries the background, two pages at most. The meeting time goes to the question, not the recital. Directors who have read two good pages ask better questions than directors watching forty slides.

Step 3: Protect the deep dive

Some topics cannot survive a fifteen-minute slot: the annual program review, the response plan walkthrough, the risk register's hard cases. They need their own sessions, scheduled a year ahead so they are not traded away when the agenda gets crowded.

A simple annual allocation keeps the chair honest. This fictional example shows one workable pattern. It is an illustration, not a prescription.

The point is not the numbers. It is that someone decided them in advance.

Step 4: Use the time when directors talk alone

The executive session is where directors test their own understanding without performing for management. Are we asking the right questions? Do we believe what we are being shown? Who would tell us if things went quiet?

Those questions rarely appear in the main session. They are often the ones that change what the board asks for next.

Step 5: Assign the time an owner

The chair, usually with the corporate secretary, owns the allocation. That means saying no to agenda creep and yes to the deep dive even in a busy quarter. Without an owner, cyber time is whatever is left over, and leftovers are how fifteen minutes happens.

The related discussion of the audit committee's cyber year maps a four-meeting cadence onto this, and the executive session piece covers the directors-only time in more depth.

Frequently asked questions

How much board time is enough for cyber?

Enough to make the decisions the program needs. For most boards that is a short decision slot at regular meetings plus one or two deep dives a year. The test is the decision record, not the minutes count.

Should cyber be on every meeting agenda?

Not necessarily. A quarterly decision slot done well beats a monthly update nobody acts on. What matters is that the cadence is deliberate and the deep dives are protected.

What if management says there is nothing to report?

Quiet is information too. The board can ask what would break the silence, when the plan was last tested, and which exceptions are still open. Those questions do not need an incident to be worth asking.

Who should present to the board?

Whoever owns the program day to day, with the executive sponsor present. The board is overseeing management's work, so management should be answering, not delegating the answer to a slide deck.

A Defensible Next Step

Ask the corporate secretary for the last four agendas and minutes, and count what cyber actually received. If the answer is fifteen minutes and no decisions, put the annual allocation above in front of the chair. Book a Decision-Clarity Call if you want help designing the calendar.