I Built the Cyber Reference Guide I Couldn’t Find
Every time I prepared for a board meeting or reviewed cyber governance guidance, I ran into the same problem.
There was no single source.
SEC disclosure requirements lived in one document. Fiduciary duty standards in another. Insurance underwriting requirements scattered across carrier applications and claims reports. NIST frameworks. NACD principles. Industry benchmarks.
Each source was valuable. None of them talked to each other. And none of them answered the question a board member actually needs answered:
What do I need to know—and what happens if I don’t?
So I built the tool I couldn’t find.
To use it on Stasiak.com click here!
The Problem With Existing Resources
Board members don’t need to become cybersecurity experts. But they do need to understand what questions to ask, what topics matter, and where their personal liability lives.
The challenge is that “what matters” depends on who’s asking:
Regulators care about disclosure accuracy and timing. The SEC now requires material incident disclosure within four business days and annual reporting on cyber risk management. Miss that, and you’re facing enforcement action.
Insurers care about specific controls. 82% of denied claims in recent years involved organizations that lacked multi-factor authentication. 94% of ransomware attacks specifically target backup systems. If your policy requires a control and you don’t have it, your claim gets denied.
Courts care about oversight. Under Caremark doctrine in Delaware, directors face personal liability for failure to monitor known risks. “I didn’t know” isn’t a defense when cyber risk is on every front page.
Each of these creates real consequences. But no single resource mapped the topics to the consequences.
What the Cyber Oversight Card Does
I compiled guidance from eight authoritative sources—NIST CSF 2.0, the NACD Director’s Handbook, SEC cybersecurity rules, Coalition and Marsh McLennan insurance data, the Verizon Data Breach Report, NIST AI Risk Management Framework, and Delaware Caremark case law.
Then I organized it into something a board member can actually use.
10 domains. 48 specific topics. Three consequence badges.
The domains cover the full governance landscape:
- Governance & Oversight – Board accountability, reporting cadence, fiduciary duty
- Risk Identification – Critical assets, threat landscape, financial quantification
- Protection & Controls – MFA, EDR, backups, email security, segmentation
- Detection & Monitoring – 24/7 monitoring, vulnerability management, log retention
- Response & Recovery – Incident response plans, tabletop exercises, crisis communications
- Supply Chain & Third-Party – Vendor assessment, contractual requirements, fourth-party visibility
- Cloud & Data Security – Posture management, classification, encryption, DLP
- AI & Emerging Technology – Acceptable use policies, deepfake awareness, quantum timelines
- Regulatory & Compliance – SEC disclosure, industry regulations, privacy laws
- Cyber Insurance – Coverage adequacy, exclusions, claims readiness, D&O coverage
Each topic includes a plain-language explanation of what it is and why it matters.
The Badges That Show Consequences
Here’s what makes this different from a checklist.
Every topic that carries a specific consequence is tagged:
🔴 Claim Risk – 13 topics that, if neglected, commonly result in denied insurance claims. These aren’t theoretical—they come from actual claims data.
🔵 SEC – 5 topics directly tied to SEC cybersecurity disclosure requirements. Public company boards need to know these cold.
🟣 Board Duty – 6 topics that create personal liability exposure for directors under fiduciary duty standards.
When you review the card, you’re not just learning about cyber. You’re seeing exactly where the consequences live.
How to Use It
The Cyber Oversight Card is a single HTML file. No installation, no account, no subscription.
Download it. Open it in any browser. Use it during your next CISO briefing or board session.
As you review topics you’re familiar with, check them off. The tool tracks your progress, shows your coverage by domain on a radar chart, and saves your results locally so you can pick up where you left off.
It also shows your coverage against the three consequence categories—so you can see at a glance whether your awareness gaps align with your liability exposure.
Why I’m Giving It Away
This started as a personal reference tool. But the more I used it, the more I realized other board members and executives face the same problem I did.
Cyber governance shouldn’t require a decoder ring.
The Cyber Oversight Card is available for free on GitHub. Download the HTML file, use it however you want, share it with your board.
[Download the Cyber Oversight Card →]
If you have feedback or suggestions for additional topics, I’d like to hear them.
Because the goal isn’t perfection—it’s giving directors a single place to start.
