Cyber risk workshop for the board of directors and executive management
For boards of directors and executive management who have to assess cyber risks but receive no clear basis for decisions. The workshop structures business risks, open questions and the next decisions.
In an initial call we clarify whether the workshop suits your situation.
Variant of the existing IT security workshop
You know your cyber budget. But which risks remain?
In brief
The cyber risk workshop is a leadership-focused variant of our existing IT security workshop. It is aimed at the board of directors and executive management. It centres on business processes, information gaps and the decisions the governing body has to take.
A budget shows how much you invest in security. It does not show which processes are at risk, how long they may be down and which risks remain. These are exactly the questions the workshop structures.
The workshop is not proof of security. It guarantees neither compliance nor freedom from liability. It creates a structured basis on which you can decide.
Who the workshop is for
The workshop is a good fit if one or more of these points apply:
You sit on the board of directors or in executive management and have to assess cyber risks.
Your reports mainly show budget and activities, but hardly any business risks.
You want to know which questions to ask executive management or IT.
Responsibility and reporting lines for cyber risks are not yet clearly defined.
When the workshop is not the right fit
Another route is better if
you are dealing with a security incident right now. Handling it then takes priority, for example with your IT partner and the competent bodies.
you need technical evidence, for example for a customer. Suitable options are a penetration test or an audit.
you mainly want your IT infrastructure assessed. Our IT security workshop is designed for that.
How it differs from the IT security workshop
Both workshops start with a status assessment. But they are aimed at different people and deliver different results.
| Criterion | Cyber risk workshop | IT security workshop |
|---|---|---|
| Target group | Board of directors and executive management | IT managers and executive management |
| Perspective | Business processes, information gaps and decisions | IT infrastructure, risks and vulnerabilities |
| Result | Basis for decisions and action plan with responsibilities | Action plan with protective measures and priorities |
We clarify which variant suits you in an initial call.
Typical occasions
A board meeting is coming up
Cyber risks are on the agenda. You want to go into the meeting with clear questions and a shared view.
The security report is unclear
The report contains traffic lights, metrics and budgets. Which business risks lie behind them and what needs deciding remains open.
Customers set requirements
Customers or partners ask about your information security. Leadership wants to know what that means for priorities and responsibilities.
Responsibilities are missing
Nobody is clearly responsible for cyber risks, or the roles of the board of directors, executive management and IT overlap.
What the workshop aims for
The workshop is geared towards four results. We agree their form and depth with you in advance.
- Overview of priority cyber business risks: the processes whose failure would hit your company hardest, with a concrete scenario for each process.
- Documented information gaps: which information, evidence or responsibilities are missing today to assess these risks.
- Basis for decisions for leadership: the questions and options on which the board of directors and executive management should decide.
- Prioritised action plan with responsibilities: who clarifies or implements what, by when.
Process
The workshop has three steps. We agree duration and dates in the initial call.
Preparation
We review existing documents, such as the latest security report. In advance, we clarify the most important business processes and your open questions.
Joint workshop
The board of directors and executive management discuss the risks, the information gaps and the decisions needed with us.
Results meeting
We present the results and discuss the action plan and the open points with those responsible.
What the workshop is not
The workshop structures risks and decisions. It does not replace a review.
Not part of the workshop
No penetration test: A commissioned, controlled attack that uncovers technical vulnerabilities is a separate service, the penetration test.
No full audit: The workshop does not systematically check measures and evidence against a standard.
No certification: Only an accredited body confirms conformity, for example with ISO 27001.
No operational crisis intervention: During an ongoing incident, handling it takes priority.
No proof of security and no guarantee: The workshop confirms neither security nor compliance nor freedom from liability.
The workshop can show where such services would make sense. Whether, and from whom, you commission them is your decision.
Advice, steering and review
These three roles should stay separate. Only then does your basis for decisions remain credible.
Three roles
Advice: The workshop structures risks and decisions. It does not implement measures.
Ongoing security management: A named person maintains measures, evidence and reports throughout the year. This can be done internally or through an external CISO mandate.
Independent review: A body that does not do the steering itself checks whether the measures work. If SIDD takes on ongoing management, SIDD does not also review that work independently.
Optional follow-up
After the workshop, you decide whether and how to continue. A follow-up is not a prerequisite.
- Ongoing management: If nobody internally keeps measures and reports up to date, an external CISO can take on this role.
- ISO 27001 only where it is really needed: If customers, supervisors or your business model require a certificate, we support you in building an ISMS under ISO 27001. An ISMS is a management system for information security. It is not a prerequisite for sound decisions on the board.
Background: what a study on board decisions shows
Study
In the first half of 2021, Opdenbusch, Hielscher and Sasse interviewed 18 senior people from large UK organisations (NDSS 2025). Board decisions on cyber risks there mostly came down to the budget. Questions were sometimes not asked out of uncertainty.
The study is qualitative, not representative, and says nothing about Swiss companies or the effectiveness of this workshop. It describes a pattern that the workshop addresses.
More on this in our articles A cyber budget is not cyber oversight and What a good report must show.
Frequently asked questions
Who should take part?
Members of the board of directors and executive management. Depending on the topic, it makes sense to involve the person responsible for information security for questions. We clarify the composition in the initial call.
How do we prepare?
Existing documents help, such as the latest security report, an overview of key business processes and open questions from the board. We agree in advance what exactly we need. No technical expertise is required.
What do we receive as a result?
The aim is an overview of priority cyber business risks, documented information gaps, a basis for decisions for leadership and a prioritised action plan with responsibilities. We agree form and scope in advance.
Is the workshop evidence for customers, insurers or supervisors?
No. The workshop does not test measures and confirms neither security nor compliance nor freedom from liability. If you need evidence, we show you which review is suitable.
How does it differ from the IT security workshop?
The IT security workshop mainly assesses IT infrastructure. The cyber risk workshop is aimed at the board of directors and executive management and focuses on business risks and decisions.
What does the workshop cost, and how long does it take?
Scope, duration and cost depend on the participants, the documents and the number of processes covered. We set them after the initial call.
This page does not replace legal advice in individual cases.
Does the workshop fit your situation?
In an initial call we discuss your starting point and who is involved. Together we clarify whether the workshop is the right next step.