Glossary
What is board cybersecurity expertise? Cyber skill on the board, defined
Board cybersecurity expertise is cyber knowledge held by directors, not management. Why US disclosure of it is voluntary and how it connects to a CISO's career.
Board cybersecurity expertise is the cybersecurity knowledge or experience held by members of a company's board of directors, as distinct from the expertise of the managers who run the security program. In US public company disclosure it is voluntary: the Securities and Exchange Commission (SEC) proposed requiring it in 2022 and left it out of the final rule it adopted in 2023.
What the SEC proposed and what it kept
On 9 March 2022 the SEC proposed rules that would have required annual or proxy disclosure about the board's cybersecurity expertise, if any, as set out in Press Release 2022-39. The final rule, published in the Federal Register on 4 August 2023, stated plainly: "we are not adopting the proposed requirement to disclose board cybersecurity expertise."
What survived is a duty to describe oversight. Item 106 of Regulation S-K asks companies to describe the board's oversight of cyber risk, name any committee responsible, and explain how the board is informed. Its examples of relevant expertise, such as prior work experience and certifications, apply to management, not to directors.
Where it shows up anyway
Companies that want to name a director's cyber background have a ready place to do it. Item 401 of Regulation S-K asks, for each director, for the specific experience, qualifications, attributes or skills that led the company to conclude the person should serve. Proxy skills matrices and director biographies are where a cybersecurity or technology qualification appears.
Some regulators set a competence bar for the board without requiring a specialist. New York's 23 NYCRR Part 500 expects the senior governing body of a covered financial firm to understand cybersecurity well enough to exercise oversight, which may include the use of advisors.
Why it matters in a CISO's career
For a security executive, a board seat is one possible next step, and the director qualifications section of a proxy is where a CISO's background turns into a board credential. For a sitting CISO, the directors' own background is part of the audience every board briefing has to reach.
Where it appears on cisospotlights.com
- The board cybersecurity-expertise record, which quotes each proxy that names a director this way, with no view on whether the label is meaningful.
- The 2026 CISO-Board Engagement Report, on how CISO updates to boards are received.
- The reporting-line record, for the management side of the same relationship.