For chief information security officers
You are asked to certify a recovery capability you have never been allowed to fully test.
The security seat carries a specific kind of exposure: you sign statements about resilience, third-party risk and incident readiness that rest on evidence somebody else controls. Peers who face the same signature are the only useful audience.
01Decisions
What CISOs bring to a table
Three that come up repeatedly. Yours does not have to be on this list — it has to be undecided.
- Proving recovery rather than claiming it, when the board wants an RTO number
- Splitting incident accountability with the CIO before an incident, not during one
- Third-party concentration risk you can see but cannot unwind
02The room
Who you sit with
Format
Cross-functional Table
CISOs and CIOs together, deliberately — because most of these decisions fail at the seam between the two roles.
Cap
Eight seats
Never nine. No direct competitors, and never two people from the same company.
Bring the decision you are carrying.
One paragraph. A person reads it within two business days.