In cybersecurity governance, executive oversight includes identifying critical organizational assets, reviewing past security incidents, and evaluating whether risk management controls are improving over time.

### Why this is right The material asks managers to identify important assets, assess compliance, review incidents and their causes, and determine whether cybersecurity and risk management are improving or worsening. ### The concept These questions turn cybersecurity into an ongoing management discipline. Asset knowledge helps set priorities; incident review can reveal weaknesses and needed changes; compliance review addresses regulatory obligations; and performance review checks whether risk management is getting better. Together, the questions support informed business decisions. ### Terms - **Asset**: Something valuable to the organization that needs protection. - **Compliance**: Meeting applicable standards, regulations, or other requirements. ### Remember Management should ask what matters, what has happened, and whether controls are improving.