Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

When do we…

When does the board need a cyber update, and how often?

3 decision pointsThe pack behind this answer: Board Cybersecurity Reporting

Add to board memo

The short answer

Recommendation
Report to the board every quarter, with one longer session a year on strategy, appetite and the year ahead, unless your own board calendar sets a different cadence. Between meetings, send a major incident or a top risk moving past its tolerance limit to the chair out of cycle.
Reasoning
A board oversees cyber risk by hearing about it at planned intervals and deciding when it has to. Reporting only when something goes wrong gives it nothing to judge the bad news against. A quarter is long enough for a risk to move and short enough for the board to act before it moves further. Some things belong once a year: the review of the risk appetite every report is measured against, the check on the reporting itself and board training. Planning each cycle back from the meeting date leaves time for checked figures, a sponsor review and a rehearsal.
Considerations
  • The cadence, the cycle offsets and the 5 working days for an out-of-cycle note are the defaults in the CISO Times board reporting pack. Your own board calendar and reporting procedure may set different ones. Agree the out-of-cycle deadline with the board.
  • In a small organisation, the board may be the owners, partners or directors. The pack suggests reporting twice a year or quarterly on about two pages, with the steps kept but the time between them shortened, and the sign-off of the figures still a step of its own.
  • If you are in scope of NIS2 or DORA, or do not yet know, keep yearly management body training with evidence of attendance. The pack's yearly interval is its own default; the regimes require the training and set no interval.
  • A move outside appetite that stays within tolerance waits for the next report. It still goes first in that report.

The decision, step by step

Select any step for the reasoning behind it and where the pack covers it.

  • Start
  • Step
  • Decision
  • Outcome
StartPlanning the year's cyber reporting to the boardStepGet the year's meeting dates from the board secretaryDecisionIs the board a few owners or directors, with no committee?StepReport twice a year or quarterly, on two pagesStepPlan a report to every quarterly boardDecisionDoes an executive committee also hear about cyber risk?StepGive the executive committee its own shorter cycleStepCount each cycle back from the meeting dateStepAdd the yearly items: deep dive, appetite review, self-checkDecisionAre you in scope of NIS2 or DORA, or not yet known?StepPlan yearly board training, with proof of attendanceStepAgree what cannot wait for the next meetingOutcomeWrite the cadence into your reporting procedure

Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.

Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one.

Read as text

The same flow written out: each step, its reasoning and where the pack covers it. 13 steps.

  1. Start

    Planning the year's cyber reporting to the board

    A board oversees cyber risk by hearing about it at planned intervals and deciding when it has to. Reporting that happens only when something goes wrong gives it nothing to judge the bad news against. The question is how often it hears, what it hears once a year, and what cannot wait for a meeting.

    In the pack

  2. Step

    Get the year's meeting dates from the board secretary

    List every meeting at which cyber risk is reported: the board, any board committee that oversees risk, and the executive committee. Check each date falls on a working day, and look for cycles that overlap, because the same people then prepare two sets of papers at once.

    In the pack

  3. Decision

    Is the board a few owners or directors, with no committee?

    In a small organisation the 'board' may be the owners, the partners or the directors meeting monthly. The reporter may be the IT manager or an outside adviser. The same shape of report still applies; the cadence and the length shrink.

    In the pack

  4. Step

    Report twice a year or quarterly, on two pages

    The pack suggests twice a year or quarterly, on about two pages, with three or four measures. Keep every step of the cycle, but shorten the time between them, for example to half the default. Keep the sign-off of the figures as its own step, even when the same person does it on a different day.

    In the pack

  5. Step

    Plan a report to every quarterly board

    The pack assumes a quarterly board report. A quarter is long enough for a risk to move and short enough for the board to act before it moves further. Keep the same four-part shape each time: the board learns where to look and notices at once when something has changed.

    In the pack

  6. Decision

    Does an executive committee also hear about cyber risk?

    Many organisations report to the senior management meeting below the board as well. Its reports need their own cycle, and its papers must not collide with the board's.

    In the pack

  7. Step

    Give the executive committee its own shorter cycle

    The executive committee needs less preparation time than the board. Where its cycle overlaps a board cycle, move a date with the board secretary or agree in advance who prepares which papers.

    In the pack

  8. Step

    Count each cycle back from the meeting date

    In the pack's default board cycle the data request goes out 25 working days before the meeting, figures are signed off 15 working days before, the rehearsal is 7 working days before and papers reach the secretary 5 working days before. Actions are recorded 3 working days after. Working days leave out weekends and public holidays. Where a step falls in a leave period, such as the year-end, bring it forward.

    In the pack

  9. Step

    Add the yearly items: deep dive, appetite review, self-check

    Once a year the board holds a longer session on strategy, appetite and the year ahead, and reviews and restates the risk appetite every report is measured against. The reporting itself is checked against the pack's self-check and the result goes to that session. Once a year, agree next year's meeting dates and roll the calendar forward.

    In the pack

    See also

  10. Decision

    Are you in scope of NIS2 or DORA, or not yet known?

    Both regimes place duties on the management body itself: approving and overseeing cyber or ICT risk management, and following regular training. If you do not yet know whether you are in scope, plan as if you are until it is confirmed.

    In the pack

    See also

  11. Step

    Plan yearly board training, with proof of attendance

    Keep management body training as a yearly item, at least once a year, with evidence of who attended. Make sure the out-of-cycle rule also covers the reporting of major incidents to the management body that DORA expects.

    In the pack

  12. Step

    Agree what cannot wait for the next meeting

    The calendar covers planned reporting only. In the pack's defaults, a note goes to the chair within 5 working days of a major incident or of a top risk moving past its tolerance limit. A move outside appetite that stays within tolerance waits for the next report. Agree the number of days with the board.

    In the pack

    See also

  13. Outcome

    Write the cadence into your reporting procedure

    Write the cadence, the cycle offsets, the yearly items and the out-of-cycle rule into your own reporting procedure. The pack asks you to agree the out-of-cycle deadline with the board; agreeing the rest with it at the same time is your choice. The board then knows when it will hear about cyber risk.

    In the pack

Practical checklist

  1. Get the year's meeting dates from the board secretary for every meeting where cyber risk is reported, and check for overlapping cycles.
  2. Choose the cadence: quarterly, or twice a year for a small board.
  3. Give any executive committee its own shorter cycle that does not collide with the board's.
  4. Count each cycle back from the meeting: data request, figures signed off, sponsor review, rehearsal, papers, then actions recorded after. Bring forward any step that falls in a leave period.
  5. Plan the yearly items: the deep dive, the appetite review, the reporting self-check and next year's calendar.
  6. If NIS2 or DORA applies or may apply, plan yearly board training with proof of attendance.
  7. Agree with the board what cannot wait for the next meeting, and the number of days for an out-of-cycle note.
  8. Write the cadence, the offsets, the yearly items and the out-of-cycle rule into your reporting procedure.

Evidence to have ready

  • Your reporting calendar for the year, with each cycle's steps and whether they were done on time.
  • The yearly items with their dates: deep dive, appetite review, self-check, and board training with attendance.
  • Your reporting procedure, with the out-of-cycle rule the board agreed.
  • Out-of-cycle notes to the chair, with the date the event was known and the date the note was sent.

Practitioner pulse

What other practitioners do

One question about your practice. Answer it to see how others answered. We don't ask who you are or where you work.

How often does the board you report to receive a cyber report?

You can't change your answer once it's counted.

How this works

Answers are counted, not attributed: your answer adds one to the count for the option you chose, and we keep no account, IP address or organisation with it. A Cloudflare check confirms the answer comes from a person.

We discourage repeat answers from the same browser, but cannot prevent them, so treat the results as indicative. To do that, this browser remembers for 30 days that it answered this question, but not which option.

The results are the readers who chose to answer, not a survey of the profession, and the pack default is a starting point, not a norm. Results show once a question has 100 answers.

All pulse results

Assumptions

  • The top body you report to depends on how you are governed: the board, or a board risk committee it has delegated to; the management board in a two-tier structure; executive management where there is no board. 'The board' here means whichever of these you report to.
  • The cadence, offsets and deadlines shown are the defaults in the CISO Times board reporting pack. Your own board calendar and reporting procedure may set different ones.

Not covered here