Leadership & cybersecurity

20 foundational questions every business leader should ask their IT leader

Business leaders who oversee IT—often CFOs, COOs, and sometimes CEOs—don’t always have the technical background to know
what to ask. The result is that “IT” can feel like a black box, even when the organization is investing in it.

Below is a practical list of foundational questions that can help bridge that gap and create clearer dialogue.

First, a little background

Your IT leader’s life is hard: they receive help requests at all hours, juggle constant employee support, and rarely get
to truly disconnect.

Meanwhile, many IT directors don’t have time to stay current on new tools, trends, and threats—and they often won’t
volunteer where they’re struggling or where they need expert help.

That combination—an overworked IT leader paired with a non-technical business leader—creates some of the most vulnerable
environments we see from a cybersecurity perspective. Even when a company is trying to do the right thing, it can remain
just as exposed as a business with only the most basic measures in place.

Where we add the most value

Rather than hiring an additional junior technician to reduce workload (while leaving foundational risks untouched), many
businesses choose to supplement their IT leader with a co-managed approach.

Often for less than the cost of one FTE, we fill in gaps, co-manage the environment, and bring the tools and expertise
needed to raise both reliability and security.

Need daily helpdesk? Only elevated support for complex issues? Strategic planning and leadership? A modern stack for threat
prevention, email filtering, backup, and more?

The ways to customize services alongside your IT leader are flexible.
Contact us to learn more about our
supplemental (co-managed) services.
Now, let’s get back to that checklist.

A sample of the questions (and topic areas) you should be covering

The full download includes 20 questions designed to help business leaders have more meaningful conversations with IT.
Here’s a preview of the kinds of subject areas and questions you should be asking regularly:

Incident response

1. If a bad actor were to gain access to our network, how would we know?
   This question gets at the need for real detection—not just defenses. Without effective monitoring, intrusion detection,
   and behavioral analytics, an attacker can remain undetected for long periods. That time can be used to steal data,
   deploy ransomware, or compromise email accounts, often causing major financial and reputational damage before anyone
   realizes what’s happening.
2. What are our procedures for identifying and responding to security incidents?
   A written plan matters less than a plan your team can actually execute under pressure. Clear steps, ownership, and
   communication paths help reduce confusion, shorten response time, and limit the blast radius when an incident occurs.

Data backup & recovery

1. How often do we back up critical data?
   Backup frequency determines the maximum amount of data you can lose in a worst-case scenario. Infrequent backups mean
   larger gaps, longer recovery, and more operational disruption. This helps you confirm the backup schedule matches the
   business’s tolerance for downtime and data loss.
2. Where do we store our backups and how are they protected?
   The location and protection of backups are vital for integrity and availability. Secure, offsite, immutable backups
   help ensure a single event—fire, flood, ransomware, or similar—doesn’t wipe out both production data and the backups.
   Without secure and geographically diverse backup storage, recovery can be delayed or impossible.
3. Do we regularly test our backups to ensure they can be restored?
   Untested backups can create a false sense of security. A backup is only useful if it restores successfully when needed.
   Regular restore testing helps catch problems early and validates your ability to recover without surprises.

Get the full checklist

To get the complete set of questions—plus a simple one-on-one checklist any C-level leader can use with the IT
Manager—use the form below to download your copy.