Cyber Risk Management for Enterprises: A Board Playbook for 2026

<p><strong>Executive Summary:</strong> Cyber risk is no longer a technology problem to be delegated; it is an enterprise risk that determines revenue continuity, regulatory standing and stakeholder trust. In 2026, Indian boards are expected to demonstrate active oversight rather than rely on policy documents. Regulators such as SEBI, RBI and CERT-In, together with the Digital Personal Data Protection (DPDP) Act, 2023, have raised the bar on incident reporting, accountability and third-party control. This article outlines how enterprises can build a cyber risk management model that is quantified, continuously monitored, aligned to recognised standards and expressed in the language of business impact. It is intended for CEOs, CFOs, CROs, CISOs and audit committee members who need to move from compliance-led security to risk-led resilience.</p><h2>1. Why Cyber Risk Demands Board-Level Ownership in 2026</h2><p>The threat landscape has changed in three ways that matter for governance. First, attacks are faster and more industrialised: ransomware-as-a-service, credential theft and AI-assisted phishing and deepfake fraud have lowered the barrier for attackers. Second, enterprise attack surfaces have expanded through cloud adoption, SaaS sprawl, operational technology (OT) connectivity and remote work. Third, regulatory expectations now assume that boards understand and challenge cyber exposure.</p><p>In the Indian context, the regulatory perimeter is dense and growing:</p><ul><li><strong>CERT-In Directions (2022):</strong> mandatory reporting of specified cyber incidents within six hours of noticing them, and log retention of 180 days within Indian jurisdiction.</li><li><strong>SEBI Cybersecurity and Cyber Resilience Framework (CSCRF):</strong> applicable to regulated entities, with expectations around governance, identification, protection, detection, response and recovery, and recurring audits.</li><li><strong>RBI directions on IT governance, outsourcing and cyber resilience:</strong> placing explicit accountability on boards and senior management of banks, NBFCs and payment entities.</li><li><strong>DPDP Act, 2023:</strong> obligations on data fiduciaries to implement reasonable security safeguards and notify the Data Protection Board and affected individuals of personal data breaches, with penalties that can reach hundreds of crores of rupees.</li><li><strong>Companies Act, 2013 and SEBI LODR:</strong> directors' duties of care and risk oversight, including risk management committee responsibilities for listed entities, which explicitly include cybersecurity.</li></ul><p>The practical implication is that a cyber incident is simultaneously an operational, legal, financial and reputational event. Boards that cannot show how they oversee cyber risk, including the questions asked, the metrics reviewed and the decisions taken, are exposed to regulatory and litigation risk in addition to the incident itself.</p><h2>2. Building a Cyber Risk Governance Architecture</h2><p>Effective governance begins with clarity on who owns what. Many enterprises still have a CISO who owns controls but not risk acceptance, and business leaders who own risk but do not see the data. We recommend a three-tier model.</p><p><strong>Board and Risk Management Committee.</strong> Sets cyber risk appetite, reviews top scenarios and residual exposure, approves major risk acceptances and ensures resourcing. At least one director or committee should have demonstrable cyber literacy, supported by periodic external briefings.</p><p><strong>Executive Risk Forum.</strong> A cross-functional body comprising the CEO or COO, CFO, CRO, CISO, CIO, General Counsel, HR and business unit heads. It translates appetite into thresholds, prioritises investments and owns cyber within the wider operational resilience agenda.</p><p><strong>Business and Technology Execution.</strong> The CISO function, IT, OT and data owners operate controls, monitor KRIs and report exceptions through defined escalation paths.</p><p>Anchor this structure to recognised frameworks rather than building bespoke taxonomies:</p><ul><li><strong>NIST Cybersecurity Framework 2.0</strong>, which added a dedicated <em>Govern</em> function alongside Identify, Protect, Detect, Respond and Recover, directly reflecting the shift toward leadership accountability.</li><li><strong>ISO/IEC 27001:2022</strong> for the information security management system (ISMS), with organisations expected to have completed transition from the 2013 version. Annex A now includes 93 controls, including threat intelligence, cloud services security and data leakage prevention.</li><li><strong>ISO/IEC 27005</strong> for information security risk management and <strong>ISO 31000</strong> for enterprise risk principles, ensuring cyber risk is expressed consistently with other enterprise risks.</li><li><strong>ISO/IEC 27701</strong> to extend the ISMS into privacy management, supporting DPDP Act readiness.</li></ul><p>A common failure point is treating certification as the objective. ISO 27001 certification evidences a managed system; it does not guarantee that the right risks are being prioritised. Use the standard as the operating backbone and the risk register as the decision engine.</p><h2>3. From Heat Maps to Quantified Cyber Risk</h2><p>Boards are used to financial language: loss exposure, return on investment, probability and impact. Traditional red-amber-green cyber heat maps rarely meet that need. They compress very different risks into the same colours and do not help leaders decide whether a crore spent on endpoint detection delivers more risk reduction than a crore spent on backup immutability.</p><p>Cyber risk quantification (CRQ), using approaches such as FAIR (Factor Analysis of Information Risk), allows enterprises to estimate annualised loss exposure for priority scenarios. A pragmatic approach is:</p><ul><li><strong>Select five to eight crown-jewel scenarios,</strong> such as ransomware on core ERP, customer data exfiltration, payment fraud, OT shutdown at a key plant, or a critical SaaS provider outage.</li><li><strong>Estimate frequency and magnitude ranges</strong> using internal incident data, threat intelligence, industry loss data and expert calibration. Use ranges, not false precision.</li><li><strong>Model loss categories:</strong> business interruption, incident response and forensics, regulatory penalties, legal costs, customer notification and remediation, and revenue or contract loss.</li><li><strong>Test control investments</strong> by modelling how specific controls reduce frequency or magnitude, producing a defensible cost-benefit view.</li><li><strong>Align to risk appetite</strong> by setting tolerance in rupee terms and recovery objectives for critical services, then tracking where exposure sits relative to those limits.</li></ul><p>This quantification also strengthens conversations about cyber insurance. Underwriters increasingly demand evidence of multi-factor authentication, privileged access management, tested backups, and incident response plans. Enterprises with quantified exposure can right-size limits and retentions instead of purchasing coverage by benchmark alone.</p><h2>4. Third-Party and Supply Chain Cyber Risk Goes Continuous</h2><p>A significant share of material breaches now originates in the vendor ecosystem, whether through a compromised managed service provider, a vulnerable software component or a cloud misconfiguration. Yet many organisations still rely on onboarding questionnaires that are outdated within weeks.</p><p>A modern third-party cyber risk programme should include:</p><ul><li><strong>Tiering by criticality:</strong> classify vendors by data access, system integration and business dependency. A payroll processor and a stationery supplier should not be assessed alike.</li><li><strong>Contractual controls:</strong> breach notification timelines aligned to CERT-In and DPDP obligations, audit rights, sub-processor transparency, data localisation where required, and exit and data return provisions.</li><li><strong>Continuous monitoring:</strong> external attack surface ratings, breach and dark-web alerts, certificate and vulnerability monitoring, and periodic evidence refresh for critical vendors.</li><li><strong>Concentration risk analysis:</strong> identify where multiple critical services depend on a single cloud region, provider or fourth party. RBI's outsourcing and IT governance expectations make this a regulatory as well as a resilience issue.</li><li><strong>Joint testing:</strong> include critical vendors in incident response exercises and recovery tests, not only your internal teams.</li></ul><p>Software supply chain risk deserves explicit attention. Maintain a software bill of materials (SBOM) for critical applications, enforce secure development practices (for example, aligned to NIST SSDF or ISO/IEC 27034) and require vendors to disclose vulnerability management timelines.</p><h2>5. Continuous Control Monitoring, AI and Resilience Integration</h2><p>Point-in-time audits cannot keep pace with environments that change daily. Leading enterprises are shifting toward continuous control monitoring (CCM), where integrated GRC and security platforms automatically collect evidence, test controls and surface exceptions. With the global GRC technology market projected at roughly $24 billion in 2026, and AI-enabled capabilities increasingly embedded, this shift is accelerating in India as well.</p><p>Practical use cases include automated tracking of MFA coverage, patch latency, privileged account reviews, backup success and restoration tests, and cloud configuration drift. Feed these into a live dashboard with a limited set of key risk indicators tied to risk appetite, for example:</p><ul><li>Mean time to detect and contain incidents for critical systems</li><li>Percentage of critical assets with tested recovery within target RTO</li><li>Critical vulnerabilities open beyond policy thresholds</li><li>Share of critical vendors with current assurance evidence</li><li>Phishing simulation failure and reporting rates</li></ul><p>Use of AI introduces its own risk. Attackers use generative AI for convincing social engineering, while internal use of AI tools can leak sensitive data or introduce model vulnerabilities. Establish an AI acceptable-use policy, vet AI vendors under the same third-party process, and ensure AI-driven security tooling is validated and not treated as a black box.</p><p>Finally, integrate cyber into operational resilience. Define critical business services, map the people, processes, technology and third parties that support them, set impact tolerances, and run scenario exercises that include severe but plausible cyber events. Boards should see at least one tabletop annually in which they take decisions under pressure, including whether to pay a ransom, when to notify regulators and how to communicate with customers. ISO 22301 for business continuity and ISO/IEC 27031 for ICT readiness help formalise this link.</p><h2>6. A 90-Day Roadmap for Senior Leaders</h2><p><strong>Days 1-30: Baseline.</strong> Confirm regulatory applicability across CERT-In, SEBI, RBI, DPDP and sector rules. Inventory crown-jewel assets and critical vendors. Assess current maturity against NIST CSF 2.0 and ISO 27001:2022 and review the last board cyber paper for decision-usefulness.</p><p><strong>Days 31-60: Quantify and prioritise.</strong> Run quantification on the top scenarios, define risk appetite and tolerances, and rebuild the cyber roadmap around exposure reduction rather than tool acquisition.</p><p><strong>Days 61-90: Operationalise.</strong> Launch KRI dashboards, tier vendors and begin continuous monitoring of the most critical, update the incident response plan with six-hour CERT-In and DPDP notification workflows, and schedule a board-level simulation.</p><p>Enterprises that follow this sequence typically find that governance clarity, not additional technology, delivers the largest early gains in risk reduction and regulatory confidence.</p><h2>Conclusion</h2><p>Cyber risk will not be eliminated, but it can be governed, priced and made resilient. The enterprises that earn stakeholder trust in the digital economy will be those whose boards ask sharper questions, whose data is live rather than retrospective, and whose cyber, vendor, privacy and continuity programmes tell one coherent story. Praxis Consulting works with Indian and global enterprises to design cyber risk governance, align ISO 27001 and NIST-based programmes, quantify exposure and prepare boards for regulatory scrutiny. If you are reassessing how your organisation oversees cyber risk, our advisory team would be glad to start the conversation.</p>