# A cyber budget is not cyber oversight: what boards of directors should ask > A cyber budget says little about business risks. Five questions for boards of directors, with the reasons and what a usable answer contains. - Source: https://www.sidd.swiss/en/insights/cyber-budget-is-not-cyber-oversight/ - Language: en - Published: 2026-10-20 - Last updated: 2026-10-20 - Author: Philipp Staiger - Publisher: SIDD Institute for Data Protection and Data Security, a brand of Priverion GmbH, Zugerstrasse 32, 6340 Baar (ZG), Switzerland ## Short answer: a budget does not replace a decision about risks **Short answer:** Approving a budget does not replace a traceable decision about business risks. A board of directors can approve a cyber budget and still leave open which processes are at risk, how long they may be down and which risks remain. This has less to do with commitment than with format: if the report and the agenda item are built around the budget, there is little room for risks. This article explains why the budget question alone is not enough and suggests five questions for your next meeting. ## The study in brief The occasion is an interview study on how boards decide about cyber risks. The key facts: **Source box** - **Source:** Opdenbusch, Hielscher and Sasse: [“Where Are We On Cyber?”](https://dx.doi.org/10.14722/ndss.2025.240595), NDSS Symposium 2025. - **Sample:** 18 qualitative interviews with six executives, four non-executive board members, five CISOs and three consultants. A CISO (Chief Information Security Officer) heads information security. All worked for large UK organisations with 5,000 to 260,000 employees. - **Data collection:** first half of 2021. - **Findings:** Board decisions on cyber risks mostly came down to the budget. The boards relied heavily on those reporting to them. Questions were sometimes not asked out of uncertainty. Cyber risks were rarely linked to existing risk models. - **Limitations:** qualitative and not representative, large UK companies only. A UK board is structured differently from a Swiss board of directors (Verwaltungsrat). The study says nothing about Swiss SMEs. The authors themselves state that their results cannot be generalised. The findings are therefore indications, not benchmarks. They describe a pattern that can occur on Swiss boards too, but need not. ## Why “Do we have enough budget?” is not enough on its own The budget question is legitimate. But it measures effort, not effect. A “yes” means that funds are available. It does not mean that the most important processes are protected or would be running again in time after an attack. One CISO interviewed reported being asked countless times whether pace and budget were right. These questions rarely challenged them. Other CISOs described their budget as sometimes too tight, sometimes too generous. A budget with no link to concrete risks is hard to size correctly. The authors recommend not steering cyber risks through budgets alone. As an example of a strategic decision, they cite the question of what outage caused by an attack would be tolerable at most. The following questions build on this. ## Five better questions for your next meeting The five questions are a practical derivation by SIDD from the study’s indications. They are not an instrument that the study developed or tested. They require no technical expertise, but ask for answers in business language. ### 1. Which business processes are particularly at risk? **Why it matters:** Cyber risks hit a company through its processes, not through individual servers. Only once the critical processes are named can budget and measures be measured against them. **A usable answer contains:** - two to five processes, such as order processing, payroll or the customer portal, - for each process, the systems and service providers it depends on, - a concrete scenario, for example encryption by malware or the failure of a cloud service. ### 2. How long can they be down? **Why it matters:** The tolerable downtime is a business decision, not an IT metric. It determines how much protection and what kind of recovery is needed. **A usable answer contains:** - for each process, the longest acceptable downtime and the largest acceptable data loss, - who proposed these values and who confirmed them, - whether today’s recovery capability meets these values and, if not, how large the gap is. ## Evidence and remaining risks ### 3. What evidence shows that protection and recovery work? **Why it matters:** Statements such as “We have backups” describe measures, not their effect. Evidence makes an assessment verifiable, even without technical expertise. This reduces dependence on the report. **A usable answer contains:** - date, scope and result of the last restore test, i.e. the test of whether systems can actually be recovered from backup, - results of penetration tests, i.e. commissioned and controlled attacks on your own systems, or of audits, each with the open points, - who produced the evidence: your own team, the IT partner or an independent body. ### 4. Which risks remain despite the measures? **Why it matters:** No budget eliminates every risk. A report without remaining risks leaves the board of directors nothing to decide. Only residual risks that are named openly can be consciously accepted or further reduced. **A usable answer contains:** - the main open points and their effect on the processes from question 1, - how certain the assessment is and what information is still missing, - whether the remaining risk lies within the downtimes from question 2. ## From report to resolution ### 5. What decision is needed from us now? **Why it matters:** Oversight becomes concrete when the board of directors resolves something: a downtime, a priority, a consciously accepted risk. The budget then follows from these decisions and does not replace them. **A usable answer contains:** - a clearly worded proposal with two to three options, - effort and consequences of each option, including the option of changing nothing, - a responsible person and a date for the follow-up. Not every question can be answered fully the first time. An open answer is then a result in itself: it shows where information is missing. ## Clear roles: overseeing, steering, informing The board of directors has “overall supervision of the persons entrusted with managing the company” ([Art. 716a para. 1 no. 5 CO](https://www.fedlex.admin.ch/eli/cc/27/317_321_377/en#art_716_a)). It may delegate the management itself to executive management ([Art. 716b para. 1 CO](https://www.fedlex.admin.ch/eli/cc/27/317_321_377/en#art_716_b)). For cyber risks, this results in a simple division of roles: - **The board of directors oversees.** It asks the five questions, confirms tolerable downtimes, requires evidence and decides on proposals. It does not run security projects itself. - **Executive management steers.** It sets priorities, provides resources, proposes downtimes and is responsible for implementation. - **Those responsible for security provide reliable information.** Whether CISO, head of IT or external partner: they describe scenarios, present evidence and openly name uncertainties. Most of the study’s interviewees did not see the board’s role in a crisis as operational intervention. It should be kept informed and give executive management the time and space to deal with the situation. ## Next step: use the questions at your next meeting Put the five questions on the agenda of your next meeting. Ask executive management to answer them in writing beforehand for two or three critical processes. That leaves time in the meeting for decisions rather than introductions. Our article “[Cyber risks and the board: what a good report must show](https://www.sidd.swiss/en/insights/board-cyber-risk-report/)” shows what a report that answers these questions can look like. It contains a one-page template and a completed, fictitious example. If you would like to work out the answers together with specialists, the [cyber risk workshop for boards and executives](https://www.sidd.swiss/en/services/cyber-risk-workshop-board) can be a starting point. It is a leadership-focused variant of our [IT security workshop](https://www.sidd.swiss/en/services/it-security-workshop-sme). ### Sources All sources accessed on 20 October 2026. - [Opdenbusch, J. C., Hielscher, J., Sasse, M. A.: “Where Are We On Cyber?” A Qualitative Study On Boards’ Cybersecurity Risk Decision Making](https://dx.doi.org/10.14722/ndss.2025.240595), NDSS Symposium 2025, DOI 10.14722/ndss.2025.240595 - [Swiss Code of Obligations (CO, SR 220), Art. 716a and 716b](https://www.fedlex.admin.ch/eli/cc/27/317_321_377/en#art_716_a), Fedlex, unofficial English translation, as of 1 January 2026 *This article is general information and not legal advice. The five questions are a SIDD working aid and not a result of the cited study.* --- This document is the Markdown rendition of the page linked above. Please cite the HTML URL.