The Board's Annual Self-Assessment Should Include Technology

Every year the board grades itself: composition, meetings, committees, succession. The forms come back thoughtful and complete. Nowhere in them is the subject that produced three of the last four years' hardest conversations, because the template predates the era when technology risk became a standing agenda item.

Board self-assessment shapes behavior. What gets graded gets attention, and what gets attention gets better. A board that never examines its technology oversight is telling management, and itself, that this part of the job is exempt from the standard it applies everywhere else.

Adding technology to the self-assessment is not a transformation. It is five questions, answered honestly, once a year.

Key takeaways

• Boards assess what they grade; technology oversight is usually missing from the form.

• Ask whether the board gets the information it needs, in language it can use.

• Ask whether the board could handle a major incident tomorrow, by name and trigger.

• Ask whether the board's own skills match the risks on the register.

• Turn the answers into one or two development commitments for the coming year.

Step 1: Ask whether the reporting actually informs

Question one: does the board receive technology and cyber reporting it can use to make decisions? Not whether reporting happens, but whether directors can tell, after reading it, what changed, what the top risks are, and what management needs from the board.

The honest answers are often uncomfortable: the dashboard is activity data, the risks read the same every quarter, the metrics have no trend. The discussion of oversight without board overreach is the right frame for fixing it without grabbing the steering wheel.

Step 2: Ask whether the board is incident-ready

Question two: if a serious incident happened tonight, does every director know what the board's role is, who calls whom, and which decisions escalate? This is not management's readiness; it is the board's own.

A board that cannot answer has discovered its first development item. The fix is a one-hour session walking the escalation triggers and the board's place in the response, not a new committee.

Question three follows naturally: when did the board last practice? A tabletop that includes directors once a year is the difference between a plan the board has read and a role it has rehearsed.

Step 3: Ask whether the skills match the register

Question four: looking at the top five technology risks on the register, does the board collectively have the background to oversee them? The answer does not need to be deep expertise in each; it needs to be an honest map of where the board is strong and where it leans entirely on management's fluency.

Where the map shows thin coverage, the responses are known: recruit for it, add an advisor, or schedule targeted education. What does not work is leaving the gap unnamed.

The question of how often the board reviews cyber posture becomes easier to answer once the skills map is honest.

Step 4: Close with commitments, not scores

Question five: what will the board do differently this year? The assessment earns its keep only if it ends in one or two specific commitments: the incident walkthrough in Q2, the technology session added to the offsite, the director development plan that names technology.

This fictional example shows the commitments section of one board's assessment. It is an illustration, not a prescription.

Finding	Commitment	Owner	When
Reporting is activity-heavy	Redesign the cyber report around decisions	Audit chair + CISO	Q1
Board has never rehearsed its incident role	Add directors to the annual tabletop	Board chair	Q3
No director with data background	Add to the recruitment matrix	Nominating chair	Next search

The related discussion of oversight without board overreach is worth your time alongside this one. The related discussion of how often should the board review is worth your time alongside this one.

Frequently asked questions

Who should add these questions to the assessment?

The governance or nominating committee owns the self-assessment and can add a technology section. The audit chair and the board's technology voice should draft the questions together.

Does every board need a technology expert director?

Not necessarily. Every board needs to know whether it has enough fluency for its risk profile, and to close the gap deliberately through recruitment, advisors, or education. The unexamined gap is the problem, not the gap itself.

How does this differ from the cyber updates we already get?

Updates are management reporting to the board. The self-assessment is the board grading its own oversight: the quality of what it asks for, receives, and does with it. Both are needed; neither substitutes for the other.

A Defensible Next Step

Pull out last year's board self-assessment and search it for the word technology. If it is absent, proposing the five questions is a ten-minute agenda item that changes what the board notices about itself. Book a Decision-Clarity Call if you want the questions tailored to your board.