The board’s role in overseeing cybersecurity

  • October 2025

In an era when cyber attacks dominate headlines and regulatory expectations are rising, boards cannot treat cybersecurity as a distant IT issue. Board cybersecurity oversight must become a core governance priority—one that involves ongoing dialogue, rigorous reporting, and strategic alignment. The threat landscape is accelerating with AI-driven attacks, quantum uncertainty, expanding remote infrastructures, and deepfake-enabled social engineering. Regulators now demand more transparency, and stakeholders expect swift, clear responses when breaches occur. A strong governance foundation helps protect financial value and reputational trust before, during, and after an incident.

Download the report

Four essential areas where boards can lead on cybersecurity governance:

  1. Embed cyber risk in strategy and culture — ensure cybersecurity is woven into every decision, from market expansion to vendor partnerships.
  2. Understand the cyber risk management program — evaluate how management identifies, quantifies, and mitigates the most critical risks, using frameworks like NIST CSF 2.0.
  3. Monitor cyber resilience — validate that incident response, disaster recovery, and crisis escalation plans are tested and aligned with disclosure requirements.
  4. Rethink oversight allocation — reassess whether oversight resides appropriately (full board, audit, technology committee) and ensure the necessary skills and cadence are in place.

Download the full report now to equip your board with practical, up-to-date tools and questions that support stronger cyber risk governance and resilience.

Contact us

Ray  Garcia

Ray Garcia

Partner & Leader, Governance Insights Center, PwC US

Barbara Berlin

Barbara Berlin

Managing Director, Governance Insights Center, PwC US

Matt Gorham

Matt Gorham

Cyber & Risk Innovation Institute Leader, PwC US

Catie Hall

Catie Hall

Director, Governance Insights Center, PwC US

Follow us

Required fields are marked with an asterisk(*)

Your personal information will be handled in accordance with our Privacy Statement. You can update your communication preferences at any time by clicking the unsubscribe link in a PwC email or by submitting a request as outlined in our Privacy Statement.

Hide