The board of an organization has been informed of possible cyberthreats.

The board's role isoversight, not direct execution. Upon learning of cyberthreats, the appropriate governance response is toengage executive leadership (e.g., the CIO) to evaluate the riskand report back with an impact assessment and potential responses.

This enables the board to make informed decisions and ensures the matter is handled within the appropriate executive management structure.