NACD and ISA’s 2026 Handbook Guides Boards on Cyber-Risk Oversight

Summary

NACD and ISA’s 2026 cyber-risk oversight handbook outlines six governance principles, urging boards to quantify financial exposure, standardize reporting, test incident readiness, and oversee AI, quantum and third-party risks.

Key points

The fifth-edition handbook frames cybersecurity as an enterprise-wide strategic risk and sets out six principles covering governance, disclosure, measurement and systemic resilience.
Citing 2025 NACD surveys, it says 43% of public-company directors and 57% of private-company directors rated improvements in management’s cyber-risk reporting as very or extremely important; samples were 158 and 85, respectively.
It recommends standardized board reporting at least quarterly, with additional updates after material incidents or significant exposure changes, translating technical risks into financial loss estimates and likelihoods.
Ransomware guidance calls for tested cross-functional response plans, defined ransom-payment decision authority, response-service retainers, and offline, immutable backups.
Cloud oversight recommendations include documenting shared security responsibilities, auditing providers, assessing concentration risks, and testing recovery and exit plans.
Emerging-technology guidance addresses post-quantum migration planning and AI safeguards, including controls against unauthorized AI use, prompt injection, data poisoning and excessive agent access.
The handbook encourages threat-intelligence sharing and joint resilience exercises with critical suppliers, industry groups and government partners.

Article Details

Publisher: National Association of Corporate Directors and Internet Security Alliance
Scope: Board-level cyber-risk oversight for public, private, and nonprofit organizations; fifth-edition handbook copyrighted 2026.
Sample Size: NACD reporting survey: 158 public and 85 private company directors; board–CISO relationship survey: 154 public and 84 private company directors. EY disclosure analysis: 80 companies on the 2025 Fortune 100 list.
Key Statistics: In NACD's 2025 surveys, 43% of public company directors and 57% of private company directors rated improving management's cyber-risk reporting as very or extremely important in the coming year.
In NACD's 2025 surveys, 37% of public company directors and 40% of private company directors rated improving the board–CISO relationship as very or extremely important.
The handbook cites Verizon's 2025 Data Breach Investigations Report as reporting that third-party involvement in breaches increased from 15% to 30% compared with 2024 data.
The handbook cites a 2026 Bain & Company analysis finding that 90% of companies were unprepared for quantum security threats; the excerpt provides no sample size.
EY's analysis of 80 Fortune 100 companies reports that audit committees oversaw cybersecurity at 78% of companies in 2025.
Recommendations: Integrate cyber risk into enterprise risk management and quantify potential financial losses against the board-approved risk appetite.
Provide standardized, business-aligned cyber-risk reports at least quarterly and immediately after material incidents or significant changes in exposure, with formal escalation thresholds.
Maintain and exercise cross-functional incident response plans, define ransom decision authorities, and protect and test offline, immutable backups.
Identify critical third- and fourth-party dependencies, document cloud shared responsibilities, enforce contractual security and notification requirements, and test contingency and exit plans.
Assess quantum-related exposure, integrate it into the enterprise risk register and technology roadmap, and oversee migration to post-quantum cryptography.