Boards need evidence that digital dependencies are understood, responsibilities are clear and essential care can continue through disruption. Three questions help turn cybersecurity reporting into meaningful assurance.