We have seen evidence of risks and messages Page | 8  The need for resilience in the face of disruption: Regulatory expectations in the Digital World  being diluted as they are filtered up through the organisation such that they are so high-level once they get to senior levels that they lose their meaning or impact.
I expect boards to: understand how disruptions of key business services could impact their customers and their value chain; ensure operational and cyber resilience strategies are fit for purpose; and oversee risk tolerances and appetite metrics to track, measure and trigger a response to disruptive events.