Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

Board and executive reporting

Telling the board where you stand against appetite, what you need from them, and how to answer the hard questions.

The packs behind these answers

How do we…

Methods: how a thing is done well.

  1. How do we report cyber to the board as governance rather than a status update?
  2. How do we choose which metrics the board sees?
  3. How do we turn a budget request into a decision the board can make?
  4. How do we prepare for the questions the board will actually ask?
  5. How do we know whether our board reporting is working?
  6. How do we define a security metric so the number means the same every month?
  7. How do we check a metric's data before it is reported?
  8. How do we decide what the executive committee sees each month, and what goes to the board?

When do we…

Triggers and timing: when something has to happen.

  1. When does the board need a cyber update, and how often?
  2. When do we tell the board about bad news between meetings?
  3. When should a key risk indicator be escalated, and to whom?

If…, then how…

Situations: something has happened, what now.

  1. If the board asks "are we secure?", then how do I answer honestly?
  2. If a board member asks about their personal liability under NIS2, then what do I say?
  3. If the board asks how we compare with our peers, then how do I answer?
  4. If a metric informs no decision, then do we keep reporting it?
  5. If a figure fails its quality check just before the report goes out, then what?

Other categories