Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

How do we…

How do we report cyber to the board as governance rather than a status update?

5 decision pointsThe pack behind this answer: Board Cybersecurity Reporting

Add to board memo

The short answer

Recommendation
Report what the board has to govern, not what the security team did. Give every report the same four parts in the same order: Position against the risk appetite the board set, Direction, Exposure and Ask, and open with a one-sentence answer to "are we within appetite?".
Reasoning
Counts of patches, alerts and green projects answer "is the security team busy?". The board is asking whether the organisation carries more risk than it agreed, and what it must decide about it. A board cannot manage the team's work. It can set the risk it will accept, check the organisation stays within it, and decide when it does not. The Position is read from the risk register by a rule: one top risk past its tolerance limit makes it Outside tolerance, whatever else the report shows. A fixed shape lets the board learn where to look and notice at once when something moves.
Considerations
  • The counts and timings are the CISO Times board reporting pack's defaults: figures signed off 15 working days ahead, three to five top risks, four to six slides, the same shape for four reports. Your calendar may differ. The four parts and their order matter more.
  • The appetite is set by the board or a committee it delegates to, the management board in a two-tier structure, or executive management where there is no board. Security does not set it. If you are unsure one exists, say so and make agreeing one the first Ask.
  • The board decides appetite, priority, money above management's authority, and risk acceptance above tolerance. Choosing a product, a supplier or a project plan is management's call.
  • Certification shows a management system works. It does not show a risk is within appetite.

The decision, step by step

Select any step for the reasoning behind it and where the pack covers it.

  • Start
  • Step
  • Decision
  • Outcome
  • Loop back
StartThe board receives a list of what the security team didStepGather every figure in one source and have it signed offDecisionHas the board approved a cyber risk appetite and tolerance?StepSay there is no appetite, and make agreeing one the first AskDecisionIs any top risk past its own tolerance limit?DecisionIs any top risk above appetite?StepOpen with 'Outside tolerance': a board decision must followStepOpen with 'Outside appetite, within tolerance', plus plan and dateStepOpen with 'Within appetite'StepSupport the Position with a few measures, each with a targetStepDirection: say what moved since last time, and whyStepExposure: the top risks as service, harm, cost and likelihoodDecisionIs there anything the board must decide?StepWrite each Ask as a decision with options and a recommendationStepSay 'No decision is needed this quarter'StepMove activity counts and technical detail to the appendixDecisionCould a director state the position from the first page alone?StepRewrite what still reads as activity or colourOutcomeSend the four-part report, and keep the same shape next time

Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.

Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one.

Read as text

The same flow written out: each step, its reasoning and where the pack covers it. 19 steps.

  1. Start

    The board receives a list of what the security team did

    Counts of patches, alerts blocked and projects in green answer 'is the security team busy?'. The board is asking something else: are we carrying more risk than we agreed, and what must we decide about it? A board cannot manage the team's work. It can set the risk it will accept, check the organisation stays within it, and decide when it does not.

    In the pack

  2. Step

    Gather every figure in one source and have it signed off

    Draft from checked figures, never from memory. The pack's default is one data workbook, checked by someone other than the data owner and signed off 15 working days before the meeting. If a figure is not ready, report it as 'not available', say why and when it will be. Label any estimate as an estimate.

    In the pack

  3. Decision

    Has the board approved a cyber risk appetite and tolerance?

    Appetite is the risk the board will accept. Tolerance is the limit beyond which it must act, not just be told. Each top risk carries its own tolerance limit. The appetite is set at the top of your governance: the board or a committee it delegates to, the management board in a two-tier structure, or executive management where there is no board. Security does not set it. Without it there is no yardstick for the Position. If you are not sure an approved statement exists, treat the answer as no.

    In the pack

  4. Step

    Say there is no appetite, and make agreeing one the first Ask

    Open with a plain sentence such as: 'The board has not yet set a cyber risk appetite, so we cannot say whether our exposure is acceptable.' Do not invent a position. In a small organisation, one paragraph written from what the owners say they will not tolerate is enough to start.

    In the pack

  5. Decision

    Is any top risk past its own tolerance limit?

    The position is read from the risk register by a rule, not chosen by feel. One top risk past its tolerance limit sets the position, however many others are within appetite and whatever the other measures say. If a risk's assessment is out of date and you cannot tell, answer yes and check before the papers go.

    In the pack

  6. Decision

    Is any top risk above appetite?

    Count the top risks assessed above the appetite the board set. Count from the whole register, not from the risks you chose to show, so an awkward risk cannot be left out.

    In the pack

  7. Step

    Open with 'Outside tolerance': a board decision must follow

    The board said it must act at this point, not just be told. The report must carry an Ask with three choices: fund or order treatment, accept the risk explicitly and record why, or change the appetite. If the risk crossed its limit between meetings, the chair should already have had an out-of-cycle note.

    In the pack

    See also

  8. Step

    Open with 'Outside appetite, within tolerance', plus plan and date

    Name the count and the movement: for example, '2 of our 12 top risks are above appetite (3 last quarter), and none is above tolerance.' Give the plan and the date each risk returns within appetite. The board notes or challenges them, and decides only if the plan needs money or a change of priority.

    In the pack

  9. Step

    Open with 'Within appetite'

    Every top risk is at or below the level the board accepts. The board notes the position; no decision is needed on it. Say so in one sentence, with the count, and move on. If every measure stays on target quarter after quarter while incidents happen elsewhere, check the targets: a report that never shows a problem is usually measuring the wrong thing.

    In the pack

  10. Step

    Support the Position with a few measures, each with a target

    Show only measures that answer a question the board asks and carry a target. Give each its value, target, direction since last time and a status in words: On target; Below target, within tolerance; Outside tolerance; No target set. Colour may repeat the word, never replace it. Put any bad news first, before good news.

    In the pack

    See also

  11. Step

    Direction: say what moved since last time, and why

    Give a cause, not a list of activity. 'Worse on fixing critical weaknesses because the ordering platform team lost two engineers' tells the board something. 'We continued to progress remediation' does not. A finished project belongs here only as the risk it moved.

    In the pack

  12. Step

    Exposure: the top risks as service, harm, cost and likelihood

    Show the few risks that could hurt most: three to five in the pack's default. Name the service a director recognises, the harm, a cost range with its basis, and a likelihood word: Unlikely, Possible, Likely or Almost certain. Add where each stands against appetite. 'Ransomware' is a threat. 'Online ordering down for more than 2 days, about €1.2m of orders lost a week' is a risk.

    In the pack

  13. Decision

    Is there anything the board must decide?

    The board decides appetite, priority, money above management's authority, and risk acceptance above tolerance. Choosing a product, a supplier or a project plan is management's call. A position of 'Outside tolerance' always needs a decision. With no appetite set, agreeing one is the first decision.

    In the pack

  14. Step

    Write each Ask as a decision with options and a recommendation

    State the decision, why now, the options, the recommended one, the cost, the risk of not deciding, and who has seen it first. Keep anything the board is only asked to note in a separate short list after the decisions.

    In the pack

    See also

  15. Step

    Say 'No decision is needed this quarter'

    Do not invent an ask to fill the slot, and do not end on 'the board is asked to note the report'. Say plainly that nothing needs deciding, and list anything to note.

    In the pack

  16. Step

    Move activity counts and technical detail to the appendix

    The body speaks of services, harm and money. Tool screenshots, vulnerability names and counts of things done go to the appendix or are dropped. Keep the body short: the pack's default is four to six slides or two pages, plus a one-page summary.

    In the pack

  17. Decision

    Could a director state the position from the first page alone?

    Read the draft as a director who skims. Check it against the common failures: an activity report, traffic-light tiles with no words, fear from headlines with no link to your services, an open-ended ask, compliance presented as security. Ask the executive sponsor to read it the same way. If you are unsure, the answer is no.

    In the pack

  18. Step

    Rewrite what still reads as activity or colour

    Turn each activity into the risk it moved or the cause of a change. Turn each colour into a status word. Turn each 'we need more budget' into a decision. Use the same facts: the rewrite changes the framing, not the evidence.

    In the pack

  19. Outcome

    Send the four-part report, and keep the same shape next time

    Send it through your board papers with the one-page summary. Keep the structure unchanged for at least four reports, so the board learns where to look and notices when something moves. Record the board's decisions and actions, and report on each until it is closed.

    In the pack

    See also

Practical checklist

  1. Gather every figure in one workbook, checked by someone other than the data owner and signed off before you draft.
  2. Check the board has approved a cyber risk appetite and tolerance. If not, say so in the Position and make agreeing one the first Ask.
  3. Read the Position from the whole risk register: Outside tolerance if any top risk is past its limit, otherwise Outside appetite, within tolerance if any is above appetite, otherwise Within appetite.
  4. Support it with a few measures, each with its value, target, direction and a status in words. Put bad news first.
  5. In Direction, say what moved since last time and why. In Exposure, state the top risks as service, harm, a cost range with its basis, and a likelihood word.
  6. Write each Ask as a decision with options, a recommendation, the cost and the risk of not deciding, or say "No decision is needed this quarter".
  7. Move activity counts and technical detail to the appendix, and check a director could state the position from the first page alone.
  8. After the meeting, record the board's decisions and actions, and report on each until it is closed.

Evidence to have ready

  • The approved risk appetite statement, and the minute of the meeting that approved it.
  • Each quarterly report in the four parts, with its one-page summary.
  • The signed-off data workbook behind each report.
  • The minutes showing the decisions taken on each Ask, and the action log following each action to closure.

Assumptions

  • You report to a board or its delegated committee; in a two-tier structure, the management board; with no board, executive management or the owners.
  • You keep a risk register with a short list of top risks the board follows by name.
  • Timings and counts shown are the defaults in the CISO Times board reporting pack. Your own reporting calendar may set different ones. The four parts and their order matter more than the numbers.

Not covered here