Most leaders don't need to know how a firewall works. They do need to know whether the business could survive a serious cyberattack — and who is accountable if it couldn't. These five questions cut through the jargon and show you where you really stand.
1. What are we protecting, and where does it live?
Start with the business, not the technology. Which systems would stop you operating if they went down for a week? Where do you keep customer, employee and financial information? A good answer is a short, current list — not “IT has it covered.”
If your team can't produce an inventory of critical systems and data, that's your first gap. You can't protect what you don't know you have.
2. If ransomware hit us tomorrow, how long until we're running again?
This single question tests your backups, your recovery plan and your people. Ask for an answer in hours or days, and ask when recovery was last tested. Backups that have never been restored are a hope, not a plan.
3. Who can get into our systems, and how do we know it's really them?
Stolen passwords are one of the most common ways attackers get in. Multi-factor authentication — a second check such as an app prompt or a hardware key — stops most of these attacks. Ask whether it's switched on for email, remote access and every administrator account, and whether former employees and contractors have been removed.
4. Would we know if someone was already inside?
Attackers often spend days or weeks inside a network before they strike. Ask who watches for suspicious activity — outside business hours as well as during them — and what happens when an alert fires at 2 a.m. on a Saturday.
5. When were we last tested by someone independent?
Your IT team or provider may be excellent, but no one should mark their own homework. An independent assessment or penetration test shows how an attacker would actually see your organization and gives you a prioritized list of what to fix.
What good answers look like
- Specific, current and written down — not “I think so.”
- Tested recently, with results you can see.
- Owned by a named person, with a date for the next review.
If several answers are vague, that's normal — and fixable. The point isn't to catch anyone out. It's to turn security from a technical mystery into a business risk you can manage.