During the Incident, the Board Is Not the Incident Team

Midway through a live incident, a director texts the CEO: should we be doing something? The CEO, who is in hour nine of the response, now has one more stakeholder to manage. The question is natural. It is also the wrong one to ask in the moment, because it was never answered in advance.

The board's role in a cyber incident is real, but it is not operational. Directors do not join the bridge, approve the containment steps, or draft the customer notice. The moment a board slides into the response, two things happen: the response slows, and the oversight that only the board can provide stops.

The boards that handle incidents well decided the boundary in advance. They know what management will tell them and when, what decisions genuinely require a director, and what they are trusted not to touch.

TLDR

• The board oversees the incident; management runs it. Confusing the two slows both.

• Agree before a crisis which decisions escalate to the board and which never do.

• Set the notification standard in writing: what triggers a call, what triggers an email, what can wait for the next meeting.

• Directors prepare by knowing the response plan's shape, not by standing ready to join it.

• After the incident, the board's job is the review: what the plan assumed, what held, and what changes.

The line that keeps the response fast

Management owns the response: containment, forensics, restoration, customer communication, and the hundred judgment calls that cannot wait for a quorum. The board owns the questions around the response: whether the plan is being followed, whether the company has the resources it needs, and whether the decisions that belong above management are reaching the board in time.

The distinction matters most in the decisions that feel operational but are actually governance: a ransom decision, a disclosure judgment, a shutdown that halts revenue. Those belong to executives, with the board informed on the pre-agreed triggers. A director who wants to approve each technical step is not adding safety. They are adding latency.

NIST's incident response guidance assigns coordination and communication roles explicitly. The board's name does not appear in the responder roles, and that absence is the point.

Decide the escalation triggers while it is calm

The time to define what reaches the board is before anything is on fire. A short, written trigger list removes the 2 a.m. judgment call about whether to wake a director.

This fictional example shows one company's escalation list. It is an illustration, not a prescription.

Event	Who hears	How fast
Confirmed ransomware on a production system	Board chair and audit chair	Within 4 hours
Customer data confirmed accessed	Full board	Same day
Vendor incident with no confirmed exposure	Next scheduled report	Routine
Media inquiry about a possible breach	Board chair and CEO	Within 2 hours

Whatever the rows say, the value is that everyone agreed to them in advance. The CEO should never have to guess whether calling a director at midnight will be read as diligence or panic.

What directors should actually prepare

Directors prepare for incidents the way they prepare for audits: by knowing the shape of the process, not the details of every control. Read the response plan once a year. Know who the incident commander is, which outside firms are on retainer, and what the first 24 hours look like on paper.

Then practice the hardest part: staying in role. In a tabletop that includes directors, the useful discipline is watching management work and asking oversight questions at the checkpoints, not jumping into the operational discussion.

The related discussion of board incident response oversight covers the questions that prevent the post-incident 'we assumed' conversation.

Afterward is where the board earns its seat

When the response ends, the board's real work begins. The post-incident review belongs to management, but the board should see it, question it, and track what changes: the plan, the budget, the people, the triggers.

The questions that matter are structural. What did the plan assume that turned out to be wrong? What decision took longer than it should have, and who was waiting on whom? What did the first 48 hours reveal about preparation? Directors who ask those questions make the next incident shorter.

The related discussion of board incident response oversight is worth your time alongside this one. The related discussion of first 48 hours is worth your time alongside this one.

Frequently asked questions

Should the board ever be on the incident bridge?

Rarely, and by design. A standing invitation creates noise and implied authority. If the company wants a director available for a defined decision, name that decision and that director in the escalation list.

Who decides about ransom payment?

That is an executive decision with board awareness under pre-agreed triggers, made with counsel and insurers. It should never be improvised at the board level during the incident.

How often should the board review the response plan?

Once a year at minimum, and after every live incident or material change in the business. The review is a governance agenda item, not a technical walkthrough.

A Defensible Next Step

At the next meeting, ask one question: if we had a serious incident tonight, who calls the board, about what, and how fast? If the answer depends on who is CEO that day, write the trigger list. Book a Decision-Clarity Call if you want a working session on it.