The Boardroom’s Role in Cyber Risk: What Every Board Member Should Know

According to the World Economic Forum’s Global Risks Report 2024, cyber attacks ranks among the top 10 most severe global risks for the next decade – ahead of interstate conflict and natural resource shortages.

And the costs are soaring:

• A typical data breach in 2024 costs $4.88 million on average
• Ransomware now features in 44% of all breaches, according to Verizon’s 2025 DBIR
• Increasingly, cyber risk isn’t just internal. Third-party breaches — involving vendors and suppliers — now account for nearly 30% of incidents, doubling year over year (Verizon DBIR 2025). For boards, this highlights the need to ensure vendor risk management and supply chain security are part of broader governance discussions.

For boards, the takeaway is clear: cyber risk is business risk — and that means governance and resilience must be strategic priorities.

Boards in Canada are also facing increased pressure to take cyber risk seriously — not just from stakeholders, but from the federal government.

In 2024, the Canadian government tabled Bill C-8 (An Act respecting cyber security, amending the Telecommunications Act), which, once passed into law, will:

• Require designated operators of critical systems to report cybersecurity incidents within 72 hours to the Communications Security Establishment (CSE)
• Require operators to also notify their regulatory body and share the incident report with them
• Introduce monetary penalties of up to $10 million for a first violation, and $15 million for any subsequent violations

This legislation makes clear that cybersecurity is not optional — and that boards have a role to play in ensuring that reporting obligations, incident preparedness, and governance frameworks are in place and followed.

Cyber resilience isn’t just about firewalls or detection tools. It’s about being ready to withstand, respond to, and recover from cyber events – while still being able to deliver your critical services.

That requires:

• Clear incident response plans that define roles and responsibilities
• Tabletop simulations to test readiness and identify blind spots
• Business Impact Assessments to prioritize critical functions
• Business Continuity and Disaster Recovery plans with realistic recovery time objectives (RTOs) and recovery point objectives (RPOs)

According to PwC’s 2024 Digital Trust Insights, only 36% of executives say their organizations have tested response plans in the last year. That’s a dangerous gap.

The first 24-48 hours after a breach are pivotal. What the board does (or doesn’t do) during that time can shape:

• Regulatory investigations
• Media coverage
• Customer and shareholder trust

Boards must ensure the company has:

• A crisis communications plan
• Legal and PR advisors prepared
• Clear, timely, and consistent messaging protocols

Failure to manage the narrative can turn a technical issue into a full-blown business crisis.

At Iron Spear, we partner with executive and board teams to move beyond passive oversight and build active cyber governance. Our services include:

• Incident response readiness reviews
• Cyber risk workshops for board members
• Business impact and operational resilience assessments
• Executive tabletop exercises and simulations
• Strategic guidance aligned with regulatory frameworks

Because real resilience starts at the top.

Cyber risk is inevitable. Being unprepared doesn’t have to be.
Speak to Iron Spear about strengthening your board’s cyber oversight: www.ironspear.ca