Cybersecurity is still largely dealt with on an operational and technical level both in practice and research. A strategic perspective is still missing.  Given that Top Management Teams (TMT) are increasingly held accoutable for cyberrisk and security, the current thesis investigates how (well) boards are engaged in cybersecurity planning and control in practice. It also intends to uncover obstacles to making cybersecurity a TMT concern as a basis for making initial suggestions on how to improve TMT involvement in strategic cbersecurity planning.