Board & Executive Reporting Calendar

Instructions

How to use this workbook

Legend

Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.

Out-of-cycle reporting. The calendar covers planned reporting only. An out-of-cycle report goes within [[5]] working days of a major incident or of any top risk moving outside its tolerance limit, to the chair (a move outside appetite but within tolerance waits for the next report) (BR-07: Bad news is reported in the first report after it is known, with what is being done and by when.) — do not wait for the next meeting. Agree the number of working days with the board and write it into your reporting procedure.

Cadence the pack assumes: a quarterly board report, and once a year, a longer session on strategy, appetite and the year ahead. Your own board calendar overrides it.

The EXAMPLE year. The workbook ships with a complete EXAMPLE year running from October 2026: four quarterly boards, the annual deep dive and four executive committees, with public holidays and leave periods, for the fictional organisation used across this pack (a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders). To clear it, delete the EXAMPLE rows on the Meetings sheet, the EXAMPLE progress and notes on the Calendar, the EXAMPLE dates on the Annual Items and Lists sheets, and set the year start on the Year View.

Dates are counted in working days: Monday to Friday, less the public holidays on the Lists sheet. Other periods in this workbook are stated in working days or calendar weeks.

Dependencies: the figures come from the Board Reporting Data Collection Workbook (BR-08); the report is built with the Board Cybersecurity Report Deck Template and the Cyber Risk One-Page Board Summary; the rehearsal uses the Board Question Bank & Preparation Brief; the reporting is reviewed each year with the Board Reporting Effectiveness Self-Check (BR-10). Resources: the time of the people named on the Cycle Steps sheet, about 25 working days before each board.

Tailoring — small organisation: the reporter may also be the risk function and one of the data owners. Keep the steps but shorten the offsets (for example half the default), and keep the sign-off of the figures (BR-08) as a separate step even if the same person does it on a different day.

Tailoring — regulated entity (NIS2 or DORA): the management body approves and oversees cybersecurity risk management and must follow regular training (NIS2 Article 20; DORA Article 5). Keep management body training as an annual item with evidence of attendance, and make sure the major-incident reporting to the management body DORA requires is covered by the out-of-cycle rule above.

Tailoring — IT run by a service provider: the provider is a data owner. Agree the data request dates in the contract or service calendar at the start of the year, and allow two to three extra working days for the data to be returned.

Meetings

One row per meeting at which cyber risk is reported, in date order. Yellow columns are yours; the rest calculate. Delete the EXAMPLE rows first.

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

Cycle Steps

The reporting cycle, counted in working days from the meeting (day 0): negative before, positive after. Keep the steps in date order.

Calendar

Every step of every meeting's cycle, with its date in working days. Set Progress to Done when a step is complete. Columns in yellow are yours; do not re-order the rows.

Annual Items

The items a board needs once a year, outside the quarterly cycle. Replace the EXAMPLE dates, meetings and owners with yours; keep the rows.

Out-of-cycle reporting: a report goes within [[5]] working days of a major incident or of any top risk moving outside its tolerance limit, to the chair (a move outside appetite but within tolerance waits for the next report) (BR-07). It is not planned here; record it on the Calendar's notes for the next meeting, so the board sees it again (BR-09).

Year View

Year view

The year week by week. Each meeting column shows the step numbers (Cycle Steps sheet) that fall in that week; M marks the week of the meeting itself.

Checks

Week by week

Legend: numbers are step numbers from the Cycle Steps sheet (step 1 is the data request sent to data owners; step 8 is the meeting). "3–5" means steps 3 to 5 fall that week. M marks the week of the meeting, also shaded blue. The as-at week is shaded yellow. "Overlap" means more than one meeting's cycle is active that week.

Out-of-cycle reporting is not shown: an out-of-cycle report goes within [[5]] working days of a major incident or of any top risk moving outside its tolerance limit, to the chair (a move outside appetite but within tolerance waits for the next report).

Lists

Yellow cells are yours: public holidays (columns C and D) are left out of working days; leave periods (columns E to G) are flagged on the Calendar and the Year View. Replace the EXAMPLE dates.

Definitions

Definitions

Framework References

Framework references

These references indicate relevance only and do not reproduce the text of any standard.

Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0; Directive (EU) 2022/2555 (NIS2); Regulation (EU) 2022/2554 (DORA)