Editor's note — September 12, 2026: Withdrew the unverified 72-minute benchmark and clarified board oversight versus operational ownership.
THE TAKE
Cyber resilience depends on how quickly an organization can detect, contain and recover from a damaging event. I would test that speed against realistic business scenarios rather than rely on a universal compromise-time benchmark.
The business consequences can include interrupted operations, supplier failures and lost access to critical services. The question is whether the organization can sustain or restore those services under the scenarios management has identified.
Will’s position is blunt: the board should ask which scenarios can actually break the company, how fast those scenarios can unfold, and whether the organization can detect, contain, and recover before the damage becomes strategic. That is a resilience conversation, not a tooling conversation.
THREE THINGS BOARDS SHOULD KNOW
Test the time available to respond. Compare detection and containment performance with the actual attack paths and operating dependencies in scope.
Third-party risk is now enterprise risk. Vendor compromise can halt operations, not just expose data.
Separate oversight from operations. Management runs incident response; the board challenges readiness, resources and material risk decisions.
THE QUESTION I'M HEARING
"What should a board actually demand from the CISO right now?"
A board should demand scenario-based answers, not security theater. The CISO should be able to say which three attack paths create existential risk, how quickly each could unfold, what the likely financial and operational impact would be, and what control gaps remain. That turns cyber from a dashboard into a decision.
Boards should also insist on third-party exposure reporting and incident response realism. If a vendor failure can disrupt production, customer service, or revenue recognition, that risk belongs in regular board review alongside capital and strategy discussions. The point is not to eliminate all risk; it is to know which risks are survivable and which are not.
The practical move is to fund continuous monitoring, table-top exercises that include executives and board members, and recovery plans measured in business hours, not technical comfort. If the company cannot show it can survive a fast-moving event, it is not as resilient as it thinks it is.
THE BOTTOM LINE
Cybersecurity is now a speed and survival problem, not a compliance checkbox. Boards that focus on resilience, third-party exposure, and recovery time will make better decisions than boards that ask for another confidence score.
Source and further reading: Primary reference. Framework guidance is not a statement that a particular law applies to every organization.