What have you learned? What would be your top one, two or three lessons from dealing with the cyber crisis?

In many ways, it's the same as dealing with any crisis, that the problem's never as you first think it is, or as it's first presented to you, and that you will be working in an environment that's dynamic with incomplete information, with stressed individuals, not the exact team that if you planned it would be there, or someone will be on holiday, someone will be uncontactable, all of those sorts of things.

So having pre-agreed processes and structures, and having built a bit of that muscle of working under stress through whether it's simulations or whatever, I think one of the key things I've learned.

I think that communications is just absolutely critical.

The technical problem may be manageable, but how it's communicated, the narrative internally, externally, with regulators, stakeholders, it's a long list.

Because I've seen organizations manage an incident technically, but have lost control of the narrative.

But what do you think makes a good lawyer in a crisis? Yeah.

Yeah.

hill.

And the board's job and the chair facilitates making sure that we create an environment where management can tell us what's going wrong, what they don't know, what they're concerned about, and where we can have a really constructive debate, bringing in those different perspectives.

And walk away with management having a very clear understanding of what is concerning the board, perhaps thinking about things differently.

I think good boards help lift management's eyes up and out.

You have to be very deliberate in looking out.

And so really good directors and chairs ask really good questions, and the chair then synthesizes it so management walks out understanding where the board sits.

And board agendas are finite.

What do you think?

Is it still top one, two, three risks? And if so, what does that actually translate to in terms of what does the board expect of your organisations? Maybe Catherine, if you wouldn't mind starting.

Sure.

Thanks, Cheng.

Well, unfortunately, it's not that uncommon to see large, sophisticated, well-resourced organisations fall victim to cyber breaches.

And so the need to continue to be vigilant remains there.

In my organisations, and I expect for most organisations, that we all have a very low risk appetite for a cyber breach, for a sustained systems outage or for data loss.

And hence, there's a significant focus on ensuring that we have the right controls, that they are maintained, they are tested and they evolve in response to the external framework.

What kind of use cases you're exploring?