Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

How do we…

How do we know whether our board reporting is working?

8 decision pointsThe pack behind this answer: Board Cybersecurity Reporting

Add to board memo

The short answer

Recommendation
Judge the report by whether the board can govern from it, not by how much it contains. Review it briefly after every meeting, and once a year score the last report the board received against the self-check's tests, fixing the essential gaps first.
Reasoning
Reporting is a control like any other, and it decays the same way: measures stop answering the questions the board now asks, and reports grow. A short review after each meeting shows which questions the report failed to answer. The yearly check tests whether the report opens with the position against appetite, carries targets, states risks in business terms, writes each ask as a decision, reports bad news early and follows up the board's actions. Any essential test scored absent holds the result at "Partly serving the board" or below, however well the rest scores.
Considerations
  • The tests, priorities and levels are the defaults in the CISO Times board reporting self-check. Your board may add its own tests. Results are levels in words, never a percentage.
  • Score what the board actually received, including the one-page summary and appendices. Ideally two people score separately, then agree. When between two scores, choose the lower.
  • For a first report, the test on following up earlier actions does not apply.
  • Review the reporting model itself too when the appetite statement, the board's membership or your regulatory status changes. For NIS2 and DORA entities, the completed check and the changes it led to are part of the evidence of oversight.

The decision, step by step

Select any step for the reasoning behind it and where the pack covers it.

  • Start
  • Step
  • Decision
  • Outcome
StartYou want to know whether the board report does its jobDecisionDid the board ask what the report should have answered?StepAdd the question to your bank, and change the next reportStepOnce a year, score the report the board actually receivedDecisionDoes the first sentence state the position against appetite?StepOpen with the position, or ask the board to set an appetiteDecisionDoes every measure answer a board question and carry a target?StepKeep only measures with a board question and a targetDecisionAre top risks stated as service, harm, cost and likelihood?StepRewrite each top risk in business termsDecisionDoes every ask give options, a recommendation and the cost?StepEnd the report with each ask written as a decisionDecisionWas bad news in the first report after it was known?StepPut bad news first, with action, owner and dateDecisionAre the board's earlier actions reported until they close?StepAdd a short list of open board actions to every reportStepTake out what should not be in the reportDecisionDoes the check put the report at 'Largely' or 'Fully serving'?OutcomeRebuild the next report on the fixes, then score it againOutcomeKeep the shape, close the remaining gaps, check again next year

Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.

Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one.

Read as text

The same flow written out: each step, its reasoning and where the pack covers it. 20 steps.

  1. Start

    You want to know whether the board report does its job

    Reporting is a control like any other, and decays the same way: measures stop answering the questions the board now asks, and reports grow. A yearly check catches the drift before the board stops reading. Review the reporting model itself too when the appetite statement, the board's membership or your regulatory status changes.

    In the pack

  2. Decision

    Did the board ask what the report should have answered?

    After every meeting, by default within 2 working days, the reporter and executive sponsor spend 15 minutes on three questions: which questions did the board ask that the report did not answer, which parts did it skip, and which figure was challenged. If you did not hold this review, answer yes and hold it now.

    In the pack

  3. Step

    Add the question to your bank, and change the next report

    Add each unexpected question to your own question bank with a good answer. If it shows a measure is missing, test that measure the same way as the others before adding it.

    In the pack

    See also

  4. Step

    Once a year, score the report the board actually received

    Score what the board got, including the one-page summary and appendices, not what you meant to send. Ideally two people score separately, the reporter and the sponsor or a board member, then agree. Score each test as absent, partly or fully; when between two, choose the lower. Note the evidence for each score, such as 'slide 4: no targets'. The self-check has 24 tests; the questions below cover the essential ones and a few important ones.

    In the pack

  5. Decision

    Does the first sentence state the position against appetite?

    The test is fully met when the report opens with 'Within appetite', 'Outside appetite, within tolerance' or 'Outside tolerance' and the reason, measured against the appetite and tolerance the board approved. A summary that opens with activity, a dashboard or threat news fails. Both tests here are essential.

    In the pack

  6. Step

    Open with the position, or ask the board to set an appetite

    Write the opening sentence from the count of top risks above appetite and past tolerance. If there is no approved appetite statement, say so and make agreeing one the first ask.

    In the pack

    See also

  7. Decision

    Does every measure answer a board question and carry a target?

    Each measure should show value, target, its direction since last time in words ('Better', 'Same' or 'Worse') with the previous value, and status in words, never colour alone. Counts such as emails blocked, with no target, fail. The question, target and direction tests are essential.

    In the pack

  8. Step

    Keep only measures with a board question and a target

    Move the rest to operational reporting. Agree a target or tolerance for each measure before it reaches the board, and show its direction in words. Write every status in words, so the report works in black and white and in the minutes.

    In the pack

    See also

  9. Decision

    Are top risks stated as service, harm, cost and likelihood?

    Each top risk should name the service affected, the harm, a cost range and a likelihood in agreed words (Unlikely, Possible, Likely, Almost certain), with its position against appetite. 'Ransomware; phishing; third-party risk' fails. Business terms are essential; the likelihood and appetite test is important.

    In the pack

  10. Step

    Rewrite each top risk in business terms

    One sentence per risk: if an event stopped a service, the harm, costing about a range, with a likelihood word and its movement. Move the technical description to the appendix. Keep the body to the few risks that matter most.

    In the pack

  11. Decision

    Does every ask give options, a recommendation and the cost?

    An ask passes when it is stated as a decision, sets out realistic options including doing nothing, recommends one with the reason, and states the cost over a period and the risk of not deciding. A report marked 'for information' only fails. The first two are essential.

    In the pack

  12. Step

    End the report with each ask written as a decision

    State what the board is asked to decide, note or fund. If nothing is needed, say so. Keep items to note apart from decisions.

    In the pack

    See also

  13. Decision

    Was bad news in the first report after it was known?

    Every significant problem should appear in the first report after it was known, with the action, the owner and the date. Bad news left out, softened into activity, or reported only when asked fails. This test is essential: boards lose trust through surprise, not bad news.

    In the pack

  14. Step

    Put bad news first, with action, owner and date

    Open the next Position with it, before any good news. Between meetings, a major incident or a risk moving past tolerance goes to the chair as an out-of-cycle note.

    In the pack

    See also

  15. Decision

    Are the board's earlier actions reported until they close?

    Every open action should carry its owner, date and status, and stay in the report until closed. Actions that drop out before closing fail. The action log is also the evidence that the board oversees cyber risk rather than simply hearing about it.

    In the pack

  16. Step

    Add a short list of open board actions to every report

    Each action with its owner, due date and status, kept in the report until it is closed.

    In the pack

  17. Step

    Take out what should not be in the report

    Remove raw counts with no target, status shown by colour alone, jargon, lists of activity, tool screenshots, technical detail in the body, measures that answer no board question, figures that disagree without explanation, and threat news not linked to your own exposure. These do not change the points, but they bury what matters.

    In the pack

  18. Decision

    Does the check put the report at 'Largely' or 'Fully serving'?

    The self-check gives a level in words, from 'Not yet serving the board' to 'Fully serving the board'. Any essential test scored absent holds the level at 'Partly serving' or below, however well the rest scores. 'Largely serving' needs at least two thirds of the available points. If you are unsure, take the lower answer.

    In the pack

  19. Outcome

    Rebuild the next report on the fixes, then score it again

    Work down the gaps in order: essential tests first, then important, then helpful, and absent before partly. A report that mostly tells the board what the team did needs rebuilding on the four-part structure before anything is refined.

    In the pack

    See also

  20. Outcome

    Keep the shape, close the remaining gaps, check again next year

    The report supports governance. Keep the result and the changes it led to with your board papers; for NIS2 and DORA entities they are part of the evidence of oversight. Repeat the check each year, before the board's deep dive.

    In the pack

Practical checklist

  1. After every meeting, note which questions the report did not answer, which parts the board skipped and which figure was challenged.
  2. Add each unexpected question to your question bank, and change the next report.
  3. Once a year, score the last report the board received against each test as absent, partly or fully, noting the evidence for each score.
  4. Check the opening sentence states the position against the board's appetite, and every measure answers a board question with value, target, direction and status in words.
  5. Check top risks are in business terms, each ask gives options, a recommendation, cost and the risk of not deciding, bad news came early, and actions are followed to closure.
  6. Take out what should not be there: raw counts with no target, colour alone, jargon, activity lists, screenshots and unlinked threat news.
  7. Fix the gaps in order, essential first and absent before partly, then score the next report again.

Evidence to have ready

  • The completed yearly self-check, with the evidence noted for each score.
  • The changes made to the report because of it, kept with the board papers.
  • The notes from the review after each board meeting.
  • The reports scored, so the next check can compare.

Assumptions

  • The board has had at least one cyber report. For a first report, skip the test on following up earlier actions.
  • The tests, priorities and levels are the defaults in the CISO Times board reporting self-check. Your board may add its own tests. Results are levels in words, never a percentage.

Not covered here