How do we choose which metrics the board sees?

Start

You have far more figures than the board can use

Every extra number competes for the same few minutes of attention. A dashboard of twenty coloured tiles with no targets moves the discussion to the numbers and away from the risk. The aim is a handful of measures a director can judge at a glance.

• Then: Write down the questions this board asks about cyber risk

Step

Write down the questions this board asks about cyber risk

Start from the board's questions, not from what your tools can report. The pack's board measures answer eight: are we within appetite, are we closing the weaknesses attackers use, where have we knowingly accepted risk, have we been hurt, are key suppliers held to our standard, could we recover, is the funded plan on track, and are we trained.

• Then: Start from the board measures, with risks outside appetite first

Step

Start from the board measures, with risks outside appetite first

The pack's eight board measures each answer one of those questions: risks outside appetite, critical exposure fixed on time, expired or high-risk exceptions, significant incidents and time to contain, critical suppliers assessed, critical services restored in tests, programme delivery, and board and staff training. A small organisation usually needs five or six.

• Then: Does the measure answer a question this board asks?

Decision

Does the measure answer a question this board asks?

Test each candidate, including those already in the report. 'The previous report always showed it' is not a reason. A measure that answers no board question takes attention from the ones that do.

• Yes: Can you set a target the board will agree?
• No: Is it a figure that only looks like assurance?

Decision

Is it a figure that only looks like assurance?

Some measures mislead at any level above the team: attacks blocked, phishing emails received, percentage of systems patched, security spend as a share of IT budget, percentage of controls compliant, external security ratings, alerts handled, tickets closed. They reward the wrong thing, cannot carry a meaningful target, or look like assurance when they are not.

• Yes, or not sure: Drop it, and use the board measure it points to
• No: Would it explain a board measure when that measure moves?

Outcome

Drop it, and use the board measure it points to

Replace each with the measure that answers the real question. Percentage patched becomes critical exposure fixed on time. Alerts handled becomes significant incidents and time to contain. Attacks blocked becomes threat context, in words, in the Exposure part. Security spend becomes a costed ask tied to the risk it reduces. If customers or insurers quote your external rating, know it and explain it in words when asked.

Decision

Would it explain a board measure when that measure moves?

Some figures are useful to the executive or a risk committee but too detailed for every board report: phishing report rate, multi-factor authentication coverage, privileged access reviewed, overdue audit findings. The pack's catalogue marks them 'Executive only'. They earn a place when they explain why a board measure moved.

• Yes: Keep it below board level, for the appendix if asked
• No: Keep it on the operational dashboard

Outcome

Keep it below board level, for the appendix if asked

Report it to the executive or risk committee. Bring it to the board only when it explains a board measure, and then in the appendix. If a gap it shows becomes a top risk, it reaches the board through the risk count and the Exposure part instead.

Outcome

Keep it on the operational dashboard

Raw vulnerability counts, backup job success, endpoint coverage and leavers removed on time help the team that runs the control. They say little about risk to the organisation, so they stay with that team.

Decision

Can you set a target the board will agree?

The target is the level you aim for. Without one a measure cannot be judged good or bad. Set a tolerance too: the worst level the board accepts before it must act, not just be told. Without a tolerance, any miss of the target reads as 'Outside tolerance'. If you cannot yet say, answer no.

• Yes: Name an owner by role, and the data source
• No, or not known: Hold it back until a target is set

Outcome

Hold it back until a target is set

A measure with no target should not reach the board. If it matters, propose a target and tolerance for the board to agree, then add it. Until then it would appear as 'No target set' and invite 'so what?'.

Step

Name an owner by role, and the data source

Someone must answer for each figure when the board asks. Name the role and the source in your organisation. Where a service provider supplies the figure, make it a reporting obligation in the contract and name an owner inside your organisation who checks it.

• Then: Note how each measure can mislead, and fix its definition

Step

Note how each measure can mislead, and fix its definition

Most board measures can be improved by changing what is counted: rating fewer weaknesses Priority 1 or 2, re-scoring a risk, reclassifying an incident. Write the definition down, keep it stable, and report any change with the previous figure restated. Keep scan coverage in the appendix beside the fix rate.

• Then: Is the selection within the limit you set?

Decision

Is the selection within the limit you set?

More measures than the board can discuss is the commonest way reports stop being read. The pack suggests no more than eight; set your own limit. Five to eight measures with targets beat twenty tiles.

• Yes: Is the count of risks outside appetite in the selection?
• No: Cut back to the measures that answer the board's questions

Step

Cut back to the measures that answer the board's questions

Remove the measure whose question is already answered by another, or which the board has not asked about. It can still sit below board level.

• Then: Is the selection within the limit you set? (back to an earlier step)

Decision

Is the count of risks outside appetite in the selection?

Every report opens by saying whether the organisation is within appetite, and this is the measure that answers it. It counts top risks above appetite and top risks past their own tolerance limit, from the whole risk register.

• Yes: Ask the board to agree the measures, targets and tolerances
• No: Add it: the report cannot open without it

Step

Add it: the report cannot open without it

If the board has not set an appetite, the measure cannot be calculated yet. Say so in the report and make agreeing an appetite the first ask.

• Then: Ask the board to agree the measures, targets and tolerances

Step

Ask the board to agree the measures, targets and tolerances

Who agrees depends on how you are governed: the board, or a risk committee it has delegated to; the management board in a two-tier structure; executive management where there is no board. For NIS2 or DORA entities, the pack keeps the risk count with tolerances the board has approved in writing.

• Then: Report the agreed set every cycle, and keep it for a year

Outcome

Report the agreed set every cycle, and keep it for a year

Copy the agreed measures into your data collection workbook. Do not drop measures that look bad or add new ones each quarter. Change the set only at the yearly review, and say what changed.