A serious cyber incident tests every assumption an organization has made about how decisions get made under pressure. The board's role in that moment is more specific than most governance frameworks acknowledge.

Most cyber incidents are resolved without a board ever being convened. A technical team manages the containment. Legal handles notifications. The privacy officer files the required reports. At the next scheduled board meeting, directors receive a summary of what happened and what was done about it.

Some incidents do not allow for that sequence.

A ransomware attack disables operations across multiple regions simultaneously, while a vishing campaign gives a threat actor privileged system access for weeks before it is detected. A third-party breach exposes customer financial data at a scale that triggers both regulatory and media attention.

When an incident reaches that threshold, the board chair's role changes in ways that most organizations have not fully thought through.

Travis Walker, a partner at Norton Rose Fulbright right who advises organizations on cybersecurity governance, described the dynamic during the firm’s recent 2026 Technology Summit.

"The board oversight role doesn't really change the nature of it in the context of an incident, but it's really the frequency and extent of the oversight" that shifts, Walker said. Strategic governance gives way to active monitoring, and the chair becomes the key figure in managing that transition without overreaching into management's responsibilities.

In practice, the chair is typically the first director advised when an incident reaches a severity threshold that the organization has defined in its response plan. From that point, the chair decides whether to engage a standing committee, convene a subset of directors or activate the full board, based on the scale and operational impact of what is unfolding.

Walker noted that the decision depends on factors the organization should have mapped in advance: what constitutes a major or critical incident, how the size and nature of the organization shapes that definition, and what governance structure is best positioned to oversee the response without slowing it down.

Each of those decisions carries communications weight. When the chair is engaged, employees are already asking questions that someone needs to answer. Regulators may be approaching timelines that require a response. Investors may be entitled to disclosure depending on the materiality of the incident. Customers may be affected.

The sequencing of who hears what, and from whom, shapes how the organization is perceived at a moment when it has very little margin to manage perception alongside the incident itself.

What breaks down most often is not a shortage of goodwill or capable people., but the absence of a pre-defined framework for how those decisions get made. Management may have a detailed technical response plan that says nothing about when the board chair is notified, what format that notification takes, or which decisions require board-level input versus management authority.

When those questions surface for the first time during an active breach, the delay they create compounds the problem.

John Cassell, partner and Canadian co-head of cybersecurity and data privacy at Norton Rose Fulbright, was direct about what good governance looks like in this context. Directors need to ensure management has implemented "appropriate policies to manage cyber risk and respond to cyber incidents," Cassell said, adding that boards should require regular tabletop exercises and a continuous improvement process so that plans do not remain static. A breach update prepared for the board should be a different document from the technical brief going to the CISO. It needs to separate confirmed facts from working assumptions, identify decisions that require board authorization, and surface open risks that directors should understand even if they cannot resolve them.

Building that document in advance, and testing it through a realistic exercise, is the difference between a chair who can move quickly into an oversight posture and one who is improvising at the worst possible moment. Sovereign Advisory works with boards and executive teams to define breach escalation thresholds, prepare chair and CEO message frameworks and design exercises that test governance and communications readiness together.

‍