Three regulators have now put it in writing: the people at the top of a company are expected to understand cyber risk well enough to oversee it. Not to be told about it. To understand it. The EU wrote it into NIS2 and DORA. New York wrote it into its cybersecurity regulation for financial services. The SEC made public companies describe, in their annual report, how their board oversees it.
Almost nobody is teaching them. What most boards get instead is a quarterly update and, if someone is being thorough, the same phishing module the interns took in onboarding. Neither one is education, and neither one would hold up well if an examiner asked how the board came to understand the risks it signed off on.
Read those three numbers together. Two out of three boards are getting regular updates. Barely half of the people answering feel they understand the risks, and fewer than half think the board can tell whether the money is working. The updates are happening. The understanding is not following.
What the rules actually say
The wording differs by regime, but the direction is the same: oversight now comes with an expectation of knowledge, and in two cases an explicit expectation of training.
Two things are worth noticing. First, the SEC dropped its proposal to make companies disclose whether a director has cyber expertise, but it kept the requirement to describe the oversight process. That description now gets compared across peers every year. Second, none of these rules is satisfied by a slide deck. NIS2 and DORA use the word training. NYDFS uses the word understanding. An examiner asking how the board meets either will want something more than an agenda item.
You may still be inside the blast radius. NIS2 entities are expected to manage supply-chain risk, so their questionnaires to vendors are starting to ask how the vendor’s own leadership is kept informed. Financial-services customers under DORA do the same. If you sell to either, this lands in your security review whether or not the rule names you.
The liability is personal now
Older governance rules asked whether the company had a security program. The new ones ask whether the people at the top understood it, and they attach that question to individuals. NIS2 says members of a company’s management body can be held liable when the company breaks its cybersecurity obligations. For the largest category of covered companies, it lets regulators go further, as a last resort, and ask for a manager to be temporarily barred from exercising managerial functions until the problems are fixed.
The member states are now turning that into national law, and the training duty is getting specific. Germany’s implementation, for example, puts the training obligation on management personally. Legal commentary reads it as one the executives cannot hand to the CISO, and the federal cyber agency, the BSI, has published guidance on what that training should cover. The direction everywhere is the same: training stops being something the company offers and becomes something each director can be asked to prove they did.
That changes the question a director should be asking. It is no longer “does our company train people?” It is “if a regulator asked me what I understood about our cyber risk, and how I came to understand it, what would I show them?” For most directors today, the honest answer is a calendar invite for a quarterly update.
The US version runs through Delaware
American directors don’t face a NIS2-style ban. Their exposure runs through Delaware corporate law, and the cases there show exactly what a court looks for when cyber oversight is challenged.
The rule comes from Caremark (1996): directors must make a good-faith effort to put a system in place that tells them about the company’s central risks. For two decades that claim almost never survived. Then, in Marchand v. Barnhill (2019), the Delaware Supreme Court let one proceed against the board of Blue Bell Creameries after a listeria outbreak killed three people. Food safety was the company’s mission-critical risk, and the board’s own minutes showed no regular reporting on it. Two years later the Court of Chancery applied the same logic to Boeing and airplane safety. That case settled for $237.5 million.
Cybersecurity got its test in the SolarWinds derivative suit. The Court of Chancery dismissed it in September 2022, and the Delaware Supreme Court affirmed on May 17, 2023. The court didn’t say the board’s cyber oversight was good. It called the reporting subpar, but found no bad faith, and it noted that no Delaware court had yet imposed oversight liability over a business risk where no law had been broken.
That last condition is the one the new rules change. For a company regulated by NYDFS, board understanding of cyber risk is now a written legal requirement. For an EU entity under NIS2, director training is. Our read: the next cyber oversight complaint against a regulated company will cite one of these rules, and the “no law was broken” defense that helped the SolarWinds board will be harder to use.
Both lines of cases also share a practical detail. Before shareholders sue, they can demand the board’s books and records, and the complaint gets built from what those records say. In Marchand, it was the minutes. So the person asking how the board came to understand cyber risk may be a regulator, an auditor, or a plaintiff’s lawyer holding your minutes. Each of them reads the same file.
Why an update is not understanding
A quarterly update tells the board what happened. It is written by the people being overseen, it is optimized to be short, and it mostly reports activity: patches applied, phishing click rates, audits passed. A director can sit through four of them a year and still not be able to answer the question that matters when something goes wrong: did we understand this risk, and did we accept it on purpose?
Generic awareness training does not close the gap either. It was built for employees, and it teaches employee behavior: spot the suspicious link, report the strange email. Directors need something different. They need to understand what a ransomware event would actually do to this company, how long the business can be down before it stops being a bad week and starts being a bad year, and which of management’s choices make that number bigger or smaller.
Ask a director to explain, in their own words, the one cyber scenario that would hurt the company most and what the company has done about it. If the honest answer is “I’d have to check the deck,” the board has been updated, not educated.
What board education should look like
Good board education has five properties, and each one exists because of how directors actually learn and what an examiner will later ask to see.
- Built from the company’s own risks. Start from the risk register, the business impact analysis and the controls that actually exist. A generic ransomware lesson teaches ransomware. A lesson built from your register teaches the board your ransomware exposure.
- Shown in the company’s own numbers. If the company’s recovery-time target for its core system is 8 hours and the last test came in at 30, that gap is the lesson. Directors remember their own numbers. They forget industry averages by the next meeting.
- Tied to what is happening now. A vendor breach in the news, a new regulatory deadline, an attack pattern hitting peers. Current events give the board a reason to care this quarter and a natural way to ask “could this happen to us?”
- Short, and checked. Directors will give you minutes, not hours. Short segments with a few questions at the end beat a two-hour workshop, because the questions show whether anything landed.
- Recorded. Who completed what, when, what it covered, and whether they passed the check. That record is the evidence NIS2, DORA and NYDFS examiners and SOC 2 auditors will ask for, and it is what lets the company describe its oversight process honestly in an annual report.
What the file should show
Those five properties are how the education works. The file is how you prove it happened. Whether the question comes from an examiner, an auditor or a books-and-records demand, it will be some version of “show me how leadership came to understand these risks.” Here is what two answers to that question look like for the same company.
The company is a publicly listed lender regulated by NYDFS, with a seven-person board. Its risk register puts ransomware on its core loan platform at $1.2 million of expected loss a year. The recovery target is 8 hours, and the last restore test took 30. The question is how the board came to understand that risk.
The left column isn’t negligent. It’s what most boards have today, and every item in it really happened. It just can’t show that anyone understood anything, so the answer ends up depending on someone’s memory of a meeting.
Look at the incomplete director on the right. A file that shows one gap and a date to close it reads as a board that is paying attention. A perfect file with no gaps reads as one nobody checked. And the minutes entry matters most, because it’s the only one that shows the board using what it learned. That is the oversight the rules and the courts are asking about.
None of this requires turning the board into security engineers. It requires treating director understanding as something you produce and can prove, the same way you treat a financial control. The hard part isn’t the record. It’s the first row. A class built from your own register has to be rebuilt every time the register changes, and in most companies nobody has the time to do that.
Where vCISO Lite fits
That first row is the problem Briefing Room in vCISO Lite was built for. It turns the company’s own risk data (the risk register, business impact analysis and controls already in the platform) into short, narrated classes for directors and executives, so the ransomware class shows a board its own recovery-time target next to its own test results instead of an industry statistic. Each class ends with a knowledge check, and completion is signed into the audit trail as evidence. If your next board cycle is going to be asked how it understands cyber risk, book a 20-minute board briefing demo.