The CISO's Guide to Board Reporting on Cyber Risk

The Communication Gap

Most CISOs are excellent at security. Many struggle with board communication. The challenge isn't knowledge:it's translation. Boards don't need to understand attack vectors or CVE scores. They need to understand business risk, resource requirements, and strategic trade-offs.

What Boards Actually Want to Know

After surveying board members across dozens of organisations, the questions they care about fall into five categories:

1. Are we adequately protected? Not perfectly protected:adequately. What's our risk posture relative to our risk appetite?
2. What are the biggest risks? Not a list of 500 vulnerabilities:the top 3-5 business risks from cyber threats.
3. Are we compliant? What's our status against the regulations and frameworks that matter to our business?
4. Are we spending the right amount? Not too much, not too little. How does our spending compare to peers?
5. What do you need from us? What decisions, approvals, or resources require board action?

A Practical Reporting Framework

Open with business context. Start every board report with the business context:revenue at risk, regulatory obligations, recent industry incidents. This anchors the security conversation in business reality.

Use a risk heat map. Present the top risks as a 3x3 or 5x5 matrix of likelihood and impact. Colour-code by treatment status: red (unacceptable risk, action needed), amber (within tolerance but monitoring), green (adequately managed).

Show trend, not just snapshot. Boards care about direction. Are we improving or deteriorating? Show quarter-over-quarter trends in key metrics: mean time to detect, mean time to respond, patch compliance percentage, phishing simulation results.

Report on compliance as a dashboard. A simple red/amber/green dashboard showing status against each applicable framework (ISO 27001, SOC 2, GDPR, etc.) with next audit dates and any outstanding findings.

Close with asks. Be explicit about what you need: budget approval, policy endorsement, risk acceptance decisions, or strategic direction.

Metrics That Work

Skip the technical metrics. Board-friendly metrics include: percentage of critical systems with current patches, mean time to detect and respond to incidents, compliance status against key frameworks, security training completion rates, third-party risk assessment coverage, and cyber insurance coverage relative to estimated exposure.