Why might a company make cybersecurity a standing item on the board's agenda, and what could go wrong if the board receives no regular cybersecurity updates?

### What a good answer covers - Explain that a standing agenda item gives cybersecurity recurring leadership attention. - Connect board oversight to enterprise risk, business priorities, and accountability. - Describe possible consequences of poor reporting, such as delayed decisions or risks remaining unnoticed. - Distinguish oversight from the day-to-day technical work performed by staff. ### The concept A board provides oversight and asks whether important risks are understood, assigned, and managed. Regular reporting gives directors a basis for questions and decisions; without it, security may be treated as an isolated technical issue. The profiles support the need for better board awareness and clear risk communication. Oversight does not require directors to configure systems or lead incident response. ### Terms - **Board oversight**: Leadership review of whether the organization is directing and managing significant risks. - **Enterprise risk**: A risk that could affect the organization’s objectives or operations. ### Remember The board oversees cybersecurity risk; operational teams carry out security work.