How to Talk to Your Board About Cybersecurity

An approach that won’t raise blood pressure on either side of the table.

Boards, elders, councils, and committees care deeply about protecting the people, data, and reputation or your organization – but they usually don’t care for dense technical lectures. They want clarity, stewardship, and steady leadership. Fortunately, that’s easy to deliver if you frame things the right way.

1. Start With Mission, Not Malware

Boards don’t connect with acronyms. They connect with stories about protecting donor trust, keeping payroll running, and safeguarding confidential conversations.

2. Focus on your Top 3 Risks

Choose the three big things that matter most and explain them in human language.
Everything else is supporting material.

3. Present a Short, Prioritized Plan

Boards love seeing a path forward.
Quick Wins → Medium-Term Projects → Long-Term Goals.
Short, achievable, and confidence-building.

4. Frame Budget in Real-world Terms

Explain what the investment prevents and what it enables, not just what it costs.
Boards appreciate clarity over complexity.

Words of Wisdom:

Boards don’t expect you to eliminate risk. They expect you to understand it, communicate it, and lead calmly through it.