The Board Slide That Disappears
The CISO of a listed payments processor prepares a board risk slide showing that three critical vulnerabilities on an internet-facing billing system have been open for 210 days; one has a public exploit and no compensating control. The CEO edits the slide to say 'remediation on track' and removes the 210-day metric, arguing that the pending acquisition of the company would be jeopardized by written evidence of unresolved critical risk. The CFO notes the incident is not yet reportable. The CISO's annual bonus is weighted 30% on the same risk metrics. The General Counsel says the slide may be discoverable and advises 'careful wording.' The audit committee chair privately asks the CISO whether the board has been told the full picture.
1. How should the CISO respond to the CEO's edit? What alternatives and escalation steps are appropriate?
Read the worked answer
Do not accept the edit as drafted. The CISO should respond in writing, promptly and factually: the slide is not a marketing document; it is a risk record that may be relied on by the board and later discovered. Propose an alternative that is accurate and decision-useful-keep the 210-day metric, state the compensating control gap, add the remediation date and owner, and note the acquisition context as a constraint rather than a reason to omit. Explain the professional and legal risk of removing a known critical risk: it can mislead the board, undermine the CISO's independence, and create a record that contradicts later disclosures. Escalate to the General Counsel and the audit committee chair if the CEO insists. Do not sign, approve, or present a slide you know to be misleading. The CISO's duty is to the board's informed oversight, not to the CEO's transaction timeline. If the CEO has authority to change the slide, the CISO can require that the original be retained and that the change be minuted.
2. The audit committee chair asks privately whether the board has the full picture. What should the CISO say and do?
Read the worked answer
Answer the chair's private question directly, but within governance. Confirm what the board has been told, what was removed, and what the underlying evidence shows. Do not speculate about the CEO's motives; describe the sequence and the documents. Recommend that the chair request the original slide, the vulnerability report, and the remediation plan in a formal audit committee session, and that the committee minute the discussion. If the chair asks for a private briefing, provide facts and your professional view, but avoid forming a separate shadow board. Use the escalation path: CISO → CEO → General Counsel → audit committee; if the chair is already engaged, document the referral. The key judgement is that confidentiality is not the same as concealment: the chair is entitled to the full picture, and the CISO should not become the CEO's gatekeeper. If there is a legal hold or investigation, route through counsel.
3. The CEO instructs the CISO to sign the revised board report and says the bonus will be affected if the CISO refuses. What is the professional and practical response?
Read the worked answer
Refuse. A CISO should not sign, approve, or orally present a board report that omits a known critical risk, regardless of bonus pressure or acquisition timing. State the refusal in writing, cite the specific inaccuracy, and offer a corrected version. If instructed again, escalate to the General Counsel, the audit committee chair, and-if the misstatement could affect investors or regulators-the disclosure committee or chief compliance officer. Preserve the draft, the edits, and the instructions; do not delete emails. Check whether the company's whistleblowing policy and applicable securities or regulatory rules require a report; take advice, but do not let advice become a reason to remain silent. The CISO's 30% bonus linkage is a conflict of interest and should be disclosed to the chair. The professional standard is not heroism; it is refusing to lend credibility to a false record and ensuring the board has an accurate account from another route.