Banking security / Board governance / Cyber resilience
A larger board, a technology committee, and more cybersecurity reporting can all support oversight. None, on its own, establishes that directors understand the institution’s exposure or can challenge management’s decisions. Banking research and current supervisory guidance point to a more useful question: what decisions does the board make with the evidence it receives?
For directors, risk committees, CISOs, CROs, technology-risk teams, and internal audit.
Short answer
Effective board cybersecurity oversight is demonstrated through risk-informed decisions and evidence of follow-through, not simply through board size, committee formation, or reporting volume. Research on bank disclosures finds associations between certain governance characteristics and financial or disclosure outcomes. It does not prove that any board structure prevents breaches. NIST CSF 2.0, meanwhile, emphasizes reviewing performance and adjusting cybersecurity risk strategy.[1][3]
Boards do not need to operate security tools. They need enough clarity to understand which services are exposed, what management has tested, which material risks remain unresolved, and whether the organization’s response is proportionate to its obligations and risk tolerance.
The empirical evidence
What the banking studies actually found
Studies in the MENA region, Bangladesh, and Europe help distinguish cybersecurity disclosure from board effectiveness. Their measured outcomes and geographic scope are narrower than the claim that boards are universally failing.
86 listed banks
A study of institutions in 12 Middle East and North Africa countries, using 2019–2021 reporting data.
256 bank-year observations
The MENA researchers examined disclosures, return on assets, board size, IT committee presence, and the CRO role.
17% to 19.6%
The study’s mean cybersecurity disclosure score rose between 2019 and 2021. These are historical index scores, not current breach rates.
Elsayed, Ismail, and Ahmed (2024) used a disclosure score constructed from 21 cybersecurity-related keywords in annual reporting. Higher disclosure scores were positively associated with return on assets in their models. The main association was reported at a 10% significance threshold, which warrants caution when describing its strength.[1]
The authors also found a positive interaction involving the presence of a chief risk officer (CRO). Board size and IT committee presence were not significant predictors in the relevant model. Notably, the authors did not estimate their interaction terms as moderators in the final model after finding the direct coefficients insignificant. It is therefore inaccurate to claim the study experimentally established that IT committees are ineffective.
A separate study by Mazumder and Hossain (2023) examined voluntary cybersecurity disclosure by listed banks in Bangladesh from 2014 through 2020. Greater board independence and female board representation were associated with more disclosure; board size did not show a consistently significant relationship. That study also measured disclosure, not the ability to prevent or withstand an incident.[2]
More recent European evidence adds useful perspective. A 2026 study covering 889 banks in 21 European countries and 8,890 bank-year observations from 2014–2023 found a positive association between cybersecurity disclosure and profitability. It reported that the depth of disclosure had stronger explanatory power than disclosure presence alone, and that national digital maturity conditioned the relationship. These findings reinforce the importance of substantive reporting, but do not establish that disclosure itself prevents incidents or causes higher profits.[8]
For a current governance perspective, the National Association of Corporate Directors’ 2026 cyber-risk handbook reports that 43% of public-company directors surveyed rated improvement in management’s cyber-risk reporting as very or extremely important. Another 34% gave the same priority to improving board cybersecurity expertise. These are survey responses, not measurements of security outcomes or a representative banking-sector failure rate.[9]
Reading research responsibly
Three conclusions the data do not support
Cybersecurity disclosure, financial results, and actual operational resilience are different outcomes. A credible governance assessment keeps them separate.
More disclosure means stronger security
Disclosure may be informative, but a report can describe policies without demonstrating that the controls operated effectively.
Board committees do not work
Committee existence alone says little about expertise, authority, information quality, challenge, or escalation.
A CRO causes better financial results
An observational association cannot isolate the CRO’s contribution from other organizational characteristics or establish causation.
A useful reading of both banking studies is that the composition and reporting arrangements of governance merit closer examination. Whether they produce better security outcomes requires different evidence, including control testing and incident or resilience measures.
Current standards and requirements
What governance frameworks now expect boards to understand
NIST Cybersecurity Framework 2.0 added a dedicated Govern function. Its Oversight category (GV.OV) addresses using cybersecurity results and performance to review and improve strategy; its supply-chain category (GV.SC) addresses material third-party relationships and their risks. NIST provides a voluntary framework, not a universal financial-sector legal mandate.[3]
Bank for International Settlements research describes newer bank cyber regulations as more closely aligned with operational resilience and an assumption that breaches may occur. It emphasizes testing capabilities and managing third-party cyber risk, not merely documenting preventive controls.[4]
ECB banking supervision’s 2025 annual report, published in 2026, identifies significant IT and cybersecurity management findings, including weaknesses in outsourcing and third-party risk, risk assessment, and management-body oversight. This is supervisory evidence from examined banks—not proof that every institution or board has the same problems.[10]
U.S. SEC reporting rules require covered public companies to describe board oversight of cybersecurity risks and management’s risk processes and roles in annual disclosures. For a material incident, Form 8-K Item 1.05 generally requires disclosure within four business days after a materiality determination, not four days after discovery; exceptions and issuer-specific requirements apply. Disclosure is not itself proof of effective governance.[5]
EU DORA became applicable on January 17, 2025, to financial entities within its scope. It establishes requirements for ICT risk management and ICT third-party risk. The European Banking Authority has correspondingly revised the scope of its earlier ICT and security-risk guidelines. Requirements must be assessed by entity and jurisdiction, rather than assumed to apply to every bank worldwide.[6]
Australia’s APRA CPS 234 explicitly assigns ultimate responsibility for an APRA-regulated entity’s information security to its board and calls for controls and systematic testing commensurate with information-asset criticality and sensitivity.[7]
Across these approaches, the common management question is whether leaders have the information and authority to evaluate cyber risk and require meaningful corrective action.
Board evidence
What a useful cyber-risk briefing should contain
Replace activity-only reporting with a small set of decision-ready records. The objective is not to eliminate operational metrics; it is to connect them to consequences, uncertainty, ownership, and action.
Critical-service exposure
Services, supporting systems, material external providers, concentration risks, and plausible failure modes.
Tested recovery capability
Scenario exercises, recovery results, unmet objectives, assumptions, and outstanding remediation.
Control and assurance gaps
Independent findings, overdue remediation, ineffective controls, evidence limitations, and reassessment dates.
Explicit risk decisions
Risk owner, accepted exposure, investment or restriction decision, escalation trigger, and follow-up status.
Change and dependency risk
New cloud, fintech, platform, and AI dependencies; changes that could invalidate previous security assumptions.
Incident materiality readiness
Escalation routes linking security, enterprise risk, legal, finance, and disclosure decision-makers.
These are proposed management artifacts based on the governance objectives above, not a mandatory standardized board-pack format. Their value depends on the institution’s risks and evidence quality.
Example of effective challenge
Move from dashboard status to a decision
Illustrative scenario. A bank reports that its critical payment system passed its most recent recovery test. Directors then learn that the test did not include the cloud identity provider on which payment authorization depends.
A weak oversight record says the exercise was completed. A more useful board or committee record captures the missing dependency, the potential effect on payment continuity, an accountable owner, the next integrated test, and any operating restrictions or interim mitigations.
The distinction is practical: directors cannot verify every technical control themselves, but they can challenge whether assurance results address the institution’s actual dependencies and whether unresolved gaps have received a conscious management response.
Transparency and its limits
Cybersecurity disclosure should reflect what governance can substantiate
The MENA research suggests a relationship between reporting and bank performance within its sample. It does not establish that publishing more detail improves security or that investors can reliably infer control effectiveness from disclosure volume.
| Information | What it helps establish | What needs separate verification |
|---|---|---|
| Board or committee charter | Assigned oversight responsibilities | Whether challenge and escalation occur in practice |
| Cybersecurity policy | Management’s intended control requirements | Implementation and operating effectiveness |
| Cyber-risk dashboard | Reported measures for a stated period | Completeness, data quality, risk relevance, and excluded dependencies |
| Resilience exercise report | Observed outcomes within the tested scenario | Untested assumptions, critical dependencies, and remediation effectiveness |
| Annual governance disclosure | Public description of structures, processes, and roles | Whether disclosures accurately reflect underlying practice |
Public disclosure decisions should be coordinated with legal, regulatory, finance, investor-relations, and security functions. Material facts should not be withheld merely to improve the appearance of governance; sensitive operational details should not be published indiscriminately.
Board discussion guide
Questions that lead to reviewable decisions
These questions can be adapted for a risk committee, full board, or executive risk forum. Each calls for evidence rather than a simple verbal assurance.
| Question | Evidence to request |
|---|---|
| Which cyber scenarios could interrupt our most critical business services? | Prioritized scenario assessment with service, customer, and financial impact ranges and assumptions |
| Which critical dependencies would be affected at the same time? | Dependency map identifying vendors, infrastructure concentration, and tested alternatives |
| What have we learned from recent control or recovery tests? | Outcomes, limitations, failed assertions, corrective actions, and dates for retesting |
| Which material weaknesses remain unresolved? | Risk acceptance register, overdue items, ownership, and escalation evidence |
| Can we determine and report incident materiality promptly? | Escalation and disclosure playbooks, cross-functional exercise results, and decision responsibilities |
| What changed since the last board review? | Material threats, incidents, supplier changes, findings, decisions, and measurable progress |
For CISOs and risk leaders
Make the next board briefing easier to act on
Start with the three cyber scenarios management considers most consequential. For each, show the affected business service, the critical dependency, what has been tested, what remains uncertain, and the decision or support requested. Present operational metrics only where they explain the scenario or show whether treatment is working.
Make the roles visible. The CISO should explain security conditions and technical evidence; the CRO or risk function should connect exposure to risk appetite and enterprise priorities; business owners should own impacts and operating decisions; and internal audit should provide independent assurance within its mandate. No single job title replaces board oversight.
Finally, return to previous decisions. A board can learn more from a clearly tracked remediation failure or corrected assumption than from a large new slide deck with no comparison to prior commitments.
Common questions
Cybersecurity board oversight: FAQ
Does creating a board IT or cyber committee improve security?
It can help clarify responsibility and deepen scrutiny, but committee formation alone does not prove stronger controls or fewer incidents. Evaluate its remit, expertise, evidence access, meeting quality, escalation, and demonstrated decisions.
What did the 2024 MENA banking research prove?
It found associations among cybersecurity disclosure, return on assets, and selected governance characteristics in 86 listed banks during 2019–2021. It did not establish causation or directly test incident prevention or board effectiveness.
Should the board receive technical vulnerability counts?
Sometimes. Technical metrics are useful when connected to material services, exposure, treatment priorities, and changes in risk. A vulnerability count without context is insufficient for a governance decision.
What is the difference between cybersecurity disclosure and assurance?
Disclosure communicates information about policies, roles, and risks. Assurance evaluates the evidence for whether specified controls, practices, or outcomes are operating as claimed. One does not automatically establish the other.
Is NIST CSF 2.0 mandatory for bank boards?
Not universally. CSF 2.0 is a voluntary framework that organizations can use to structure cyber-risk governance. Binding duties arise from the laws, regulations, contracts, and supervisory requirements that apply to a particular institution.
Who should own cyber risk at a bank?
Accountability is distributed across the board’s oversight role, management, business owners, security, risk, and assurance functions. Exact governance arrangements depend on the institution’s legal structure and regulatory obligations. A CRO or CISO supports governance; neither substitutes for board-level challenge.
Executive conclusion
Assess the quality of oversight, not its appearance
The strongest conclusion from the banking research is narrower and more useful than a claim that all boards are failing: formal governance arrangements and cybersecurity disclosures are imperfect measures of effective cyber oversight. They can inform scrutiny, but they cannot replace tested evidence, responsible decisions, and follow-through.
A board that knows which risks it is accepting, which assumptions have been tested, and which decisions remain open is better positioned to govern cybersecurity as a business risk.
Research and guidance
Sources
-
Elsayed, D. H., Ismail, T. H., and Ahmed, E. A. (2024). The impact of cybersecurity disclosure on banks’ performance: The moderating role of corporate governance in the MENA region. Future Business Journal, 10, article 115. Journal article.
-
Mazumder, M., and Hossain, D. M. (2023). Voluntary cybersecurity disclosure in the banking industry of Bangladesh: Does board composition matter? Journal of Accounting in Emerging Economies, 13(2), 217–239. Journal article.
-
NIST (2024). The NIST Cybersecurity Framework (CSF) 2.0, CSWP 29. Govern function, including GV.OV and GV.SC. NIST publication.
-
Crisanto, J. C., Pelegrini, J. U., and Prenio, J. (2023). Banks’ cyber security — A second generation of regulatory approaches, FSI Insights 50. Bank for International Settlements. BIS publication.
-
U.S. Securities and Exchange Commission (2023). Cybersecurity risk management, strategy, governance, and incident disclosure. Regulation S-K Item 106 and Form 8-K Item 1.05. SEC compliance guide.
-
European Banking Authority (2025). The EBA amends its Guidelines on ICT and security risk management measures in the context of DORA application; see also DORA application and register-of-information guidance. EBA guidance.
-
Australian Prudential Regulation Authority. Prudential Standard CPS 234: Information Security. APRA standard.
-
Cybersecurity disclosure and digital maturity as strategic drivers of banking performance: Evidence from Europe (2026). International Journal of Information Management Data Insights, 6(1), 100403. Journal article.
-
National Association of Corporate Directors and Internet Security Alliance (2026). Director’s Handbook on Cyber-Risk Oversight, fifth edition; 2025 board-practices survey results. NACD handbook.
-
European Central Bank Banking Supervision (2026). ECB Annual Report on Supervisory Activities 2025, on-site inspection findings. ECB report.