What's the board's first question when a cybersecurity incident occurs?

I guess the first question will be around "how long to fix this".   The longer it takes, the more visibility it will have.   This will impact the reputation of the organization and will cost more (customer loss, cost to fix, penalties if any).

But I agree with James, has it impacted any regulatory rules?  Because this leads to another ball game: you will be audited by the regulator authority.

This also applies not only to Cyberattack but also for databreach/dataleak.