Finance chiefs may find it useful to know which issues boards of directors will be concerned about in 2018; more valuable, however, is knowing both areas of concern for directors and the issues that directors feel (1) they need more information on from management or (2) they would like to spend more time on in board meetings.

According to the National Association of Corporate Directors’ 2017-2018 Public Company Governance Survey,  the results of which were released on Thursday, three areas fit the mold described above:

Cybersecurity threats. These are not only a top concern, but the NACD survey results showed that only 37% of board respondents felt “confident” or “very confident” that their company was properly secured against a cyberattack. That was five percentage points less than a year ago. About half (49%) of board members were confident in the ability of management to address cyber risk.

“This lack of board confidence in their ability to control cyber risk may be driven by the fact that existing defense systems quickly become obsolete when cyber threats mutate and companies adopt new technologies,” the NACD said in the report accompanying the data.

Regardless, directors realized they need more information on the issue. More than one-fifth (22%) of directors said they were dissatisfied with the quality of cyber-risk information provided to the board by management. Of those that were either “dissatisfied” or “very dissatisfied,” 44% said the information they received “doesn’t provide enough transparency into problems” and 41% that the information “doesn’t allow for effective internal and external benchmarking.”

Business strategy. Seventy-one percent of directors indicated that their boards must better understand the risks and opportunities that will affect performance and drive strategic choices over the next 12 months. Similar percentages said that the boards they are on need to improve their contribution to strategy development and strengthen their monitoring of strategy execution.

Either way, boards seem to be having a tough time moving from a “traditional review-and-concur approach to deep and continual engagement with strategy,” said the NACD.

One possible barrier is time. Fifty-one percent  of respondents said the lack of adequate time for in-depth strategy discussions during board meetings was an important barrier to effective strategy engagement, up from 44%  last year.

Corporate culture. Eighty-seven percent of directors said they had a good understanding of their companies’ tone at the top, but only 35% of directors said they had a good understanding of “the mood in the middle,” and just 18% of them indicated they had a good grasp of the health of the culture at lower levels of the organization.

While directors generally were confident that management could “sustain a healthy corporate culture during a period of performance challenges,” 92% of directors said they relied totally on reporting from the CEO about the health of organizational culture.

According to the survey, it was rare for a director to get a direct take on corporate culture  from functions such as internal audit (39%), compliance and ethics (30% ), and enterprise risk management (20%), “which possess a much deeper and perhaps more independent perspective on the strength of the corporate culture than the CEO does,” according to NACD.

More frequently, board respondents held confidential conversations about possible culture issues with leaders below the C-suite (41%) or visited different company locations to develop a firsthand view of culture (48%). But directors who did either of those things were still in the minority.

The NACD survey, which corralled responses from 587 corporate directors representing 520 public companies, was conducted from June through August, 2017.