Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

How do we…

How do we report vulnerability posture to executives without quoting CVE counts?

3 decision pointsThe pack behind this answer: Vulnerability & Exposure Management

Add to board memo

The short answer

Recommendation
Report whether the weaknesses that matter are being fixed on time, not how many are open. Give executives scan coverage, deadline adherence, time to fix by priority and overdue exposure; give the board critical exposure fixed on time, and end with the decision you need or say none is needed.
Reasoning
A count of open vulnerabilities treats a low-risk finding the same as one attackers are using, rises when scanning improves and falls when systems drop out of the scan. Measures tied to priority and deadline show whether real exposure is being closed. Each figure needs its target, its direction and a status in words, with the cause of each change in business terms, so executives can act on it. Coverage comes first, because every other figure depends on it.
Considerations
  • The targets shown, such as 95% coverage, zero overdue Priority 1 findings and a suggested 90% adherence, are the defaults or suggestions in the CISO Times packs. Your own standard, and your board, may set different ones.
  • If the latest scanner review did not clear the figures to report upward, name the affected figures and how, as a limitation approved by the standard owner.
  • Critical exposure fixed on time says nothing about systems that are not scanned, so keep scan coverage in the board appendix.
  • Keep the same measures for at least a year, so executives learn to read them and a bad period cannot be hidden by changing the set.

The decision, step by step

Select any step for the reasoning behind it and where the pack covers it.

  • Start
  • Step
  • Decision
  • Outcome
StartExecutives ask how exposed we are to vulnerabilitiesDecisionDid the latest scanner review say the figures can go upward?StepName the limits on the figures beside themDecisionIs this for executive management or for the board?StepReport four measures, with fixed definitionsStepReport critical exposure fixed on timeStepGive each figure its target, direction and status in wordsStepExplain why each figure moved, in terms of the businessDecisionIs a measure off target, or any Priority 1 finding overdue?StepState the exposure as a service, a harm and a costOutcomeAsk for a decision: capacity, an accepted risk or a retirementOutcomeReport the position, and say no decision is needed

Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.

Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one.

Read as text

The same flow written out: each step, its reasoning and where the pack covers it. 12 steps.

  1. Start

    Executives ask how exposed we are to vulnerabilities

    A count of open vulnerabilities treats a low-risk finding the same as one attackers are using. It rises when scanning improves and falls when systems drop out of the scan, so it can move the wrong way for good reasons. It is a workload figure for IT. Executives need to know whether the weaknesses that matter are being closed in time.

    In the pack

  2. Decision

    Did the latest scanner review say the figures can go upward?

    A failed login, a silent scanning engine or an expired suppression can make coverage, deadline and overdue figures wrong without anyone noticing. The scanner configuration review answers whether the figures are ready to report upward. If there was no review in the last 6 months, answer no.

    In the pack

  3. Step

    Name the limits on the figures beside them

    Fix the failed checks first where you can. If you report before then, say which figures are affected and how, for example that authenticated scanning failed on a group of servers, so their open findings are under-counted. The standard owner approves reporting with those limits.

    In the pack

  4. Decision

    Is this for executive management or for the board?

    The pack's default rhythm is a monthly report to IT and security leadership and a quarterly one to the management body or executive committee. The board sees less detail again: a few measures across all of security, of which vulnerabilities are one.

    In the pack

  5. Step

    Report four measures, with fixed definitions

    Scan coverage (pack default target 95%), because every other figure depends on it. Deadline adherence: findings fixed within their deadline, as a share of findings fixed. Mean time to fix, by priority, against each priority's deadline. Overdue exposure: open findings past their deadline with no exception, and the age of the oldest; the pack's target for Priority 1 is zero. Use the same definitions every period.

    In the pack

  6. Step

    Report critical exposure fixed on time

    The pack's board measure for vulnerabilities is critical exposure fixed on time: of the Priority 1 and 2 findings due in the period, the share fixed and verified by their deadlines, each counted against its own deadline. It follows the weaknesses attackers actually use, so a fall means real exposure is rising. Keep scan coverage in the appendix, because this measure says nothing about systems that are not scanned.

    In the pack

    See also

  7. Step

    Give each figure its target, direction and status in words

    A value means nothing without its target, and one period rarely shows whether things are improving. Show this period against the last, and the trend over the year. Write the status as a word, such as 'below target', and let colour only repeat it. A figure with no agreed target, such as the adherence target you set with the approver, is not ready to report.

    In the pack

  8. Step

    Explain why each figure moved, in terms of the business

    Give the cause of each change. 'Worse on fixing critical weaknesses, 81% from 90%, because the ordering platform team lost two engineers' tells executives something they can act on. '1,243 vulnerabilities patched' does not. Name the service at risk: a server name means little to executives.

    In the pack

  9. Decision

    Is a measure off target, or any Priority 1 finding overdue?

    Overdue exposure is the measure that most often needs a management decision. Rising overdue exposure is the direction to act on even when the number is small. Watch active exceptions too: a rising number can hide falling adherence. If you cannot tell, answer yes.

    In the pack

  10. Step

    State the exposure as a service, a harm and a cost

    Say which service a customer or board member would recognise is at risk, what would happen to customers or operations, a cost range with its basis, and how likely it is now. The pack's test is that a risk that cannot be written this way is not yet understood well enough to put in front of the board. The same test works for executives.

    In the pack

  11. Outcome

    Ask for a decision: capacity, an accepted risk or a retirement

    State the decision you need, the real options with their cost, your recommendation and what stays true if nobody decides. For overdue findings the options are usually more people or time, accepting the risk through an exception, or retiring the system. Bad news goes in the first report after it is known.

    In the pack

    See also

  12. Outcome

    Report the position, and say no decision is needed

    If every measure is on target, say so plainly and say that no decision is needed this period. Do not invent an ask. Keep the same measures for at least a year, so executives learn to read them and a bad period cannot be hidden by changing the set.

    In the pack

Practical checklist

  1. Check that the latest scanner configuration review cleared the figures to report upward, and name any limits beside them.
  2. Use the same fixed definitions every period.
  3. For executive management, report scan coverage, deadline adherence, mean time to fix by priority and overdue exposure.
  4. For the board, report the share of Priority 1 and 2 findings due in the period that were fixed and verified by their deadlines.
  5. Give each figure its target, this period against the last, the trend over the year and a status in words.
  6. Explain why each figure moved, naming the service at risk rather than a server.
  7. Where a measure is off target or a Priority 1 finding is overdue, state the service, the harm, a cost range with its basis and the likelihood.
  8. End with a decision that has options, a recommendation, the cost and the risk of not deciding, or say no decision is needed.

Evidence to have ready

  • The metric definitions used, unchanged between periods.
  • The workbook or tracker extract that each reported figure came from.
  • The latest scanner configuration review, and the standard owner's decision on reporting with limits.
  • Each report's commentary: the headline, the limits on the figures and the decisions requested.
  • The decisions taken on overdue findings: more capacity, an accepted risk or a retired system.

Assumptions

Not covered here