Board Metric Selection Catalogue

Lists candidate board metrics with the question each answers, its failure modes, and an explicit recommendation on whether it belongs at board level.

Available soon

Format: Excel
Size: 68 KB
Length: 10 sheets
Version: 1.0
Updated: 28 Sep 2026

What's inside

Instructions
Metric Catalogue
Choose Yours
Selection Check
Lists
Definitions
Framework References

Preview

The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.

Instructions

How to use this workbook

Step	What to do
1	Read the Metric Catalogue. Each row is one measure with a stable ID: BM-01 to BM-08 are the pack's board measures (8 recommended 'Board'); CM-01 onwards are the candidates weighed against them — 10 'Executive only', 9 'Operational only' and 8 'Avoid'. Filter on Theme, Recommendation or Applies where.
2	The test every board measure must pass is rule BR-03: "A measure reaches the board only if it answers a question the board asks and has a stated target or tolerance (see the Board Metric Selection Catalogue)." The 'How it misleads' and 'Main weakness' columns show why most measures fail it at board level, and what can still go wrong with those that pass.
3	Tailor the catalogue once, when you adopt it: change a recommendation only with a recorded reason, and add measures of your own on the blank rows with a new ID (CM-28 onwards). Keep the IDs you have, so selections and past reports still point to the right row.
4	On Choose Yours, delete the EXAMPLE rows, then pick your board measures by Metric ID. Start from BM-01 to BM-08: BM-01 answers the question every report opens with (BR-02). Name, recommendation, question and direction fill in.
5	For each measure you choose, write the target (the level you aim for) and the tolerance (the worst level the board accepts before it must act), and name the owner who answers for the figure. Record the data source in your organisation. Each cycle the measure is then reported as 'On target', 'Below target, within tolerance', 'Outside tolerance', 'No target set' (BR-04).
6	Clear every Check on Choose Yours that does not say OK, then read the Selection Check sheet. It warns when you have chosen more measures than your limit (set there; the pack suggests [[8]]), any measure marked Avoid or Operational only, or a measure with no target or no owner.
7	Ask the board or committee [[e.g. Board, or its Audit & Risk Committee]] to agree the selection, targets and tolerances. Then copy the chosen measures into the Measures list of the Board Reporting Data Collection Workbook, which collects the figures every cycle (BR-08).
8	Review the selection once a year with the Board Reporting Effectiveness Self-Check (BR-10): drop measures the board no longer asks about, and change targets as the risk appetite changes.

Legend

Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.

EXAMPLE

Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval.

The four parts of every report (BR-01): Position — Where do we stand against the risk appetite the board set? Direction — Is it getting better or worse, and why? Exposure — What could hurt us most, and how likely is it now? Ask — What do you need the board to decide, note or fund? The 'Report part' column says where a board measure is shown; the Board Reporting Narrative Model explains each part.

The catalogue rows are the template's content, not examples: keep, change or remove them as you tailor it. Only the rows on Choose Yours marked EXAMPLE are to be deleted.

Tailoring — small organisation: five or six board measures are usually enough. Start with BM-01, BM-02, BM-04, BM-06 and BM-07. If you have no exception register, leave BM-03 out until you do rather than report zero; say so in the report.

Tailoring — regulated entity (NIS2, DORA): the management body approves and oversees the risk-management measures and can be held liable (NIS2 Art 20(1)), and under DORA it sets the ICT risk tolerance (Art 5(2)). Keep BM-01 with a tolerance the board has approved in writing, keep BM-04 so major ICT-related incidents reach the board (DORA Art 5(2)(i)), and keep BM-08 with the board's own training shown separately (NIS2 Art 20(2); DORA Art 5(4)).

Tailoring — IT run by a service provider: most figures come from the provider. Make each chosen measure a reporting obligation in the contract, with the definition from this catalogue, and name an owner inside your organisation who checks the figure. Provider reports often lead with CM-02, CM-23 or CM-24; ask for the board measures instead.

Colour in the Recommendation and Check columns only repeats the words beside it.

Metric Catalogue

35 measures: the 8 board measures (BM) first, then the candidates (CM) by theme. Tailor once (Instructions, step 3); add your own on the blank rows.

Metric ID	Measure	Theme	Question it answers	Definition — how it is calculated	Typical data source	Better when	How it misleads	Main weakness	Recommendation	Reason for the recommendation	Report part	Suggested target or tolerance	Applies where	Framework cross-references
BM-01	Risks outside appetite	Risk and appetite	Are we within the risk appetite we set?	Two counts at the reporting date: top risks in the risk register assessed above the risk appetite the board set, and top risks assessed past their own tolerance limit. Shown as 'n of N top risks above appetite; n past tolerance'. The position follows from them (POSITION_RULE).	Risk register	Lower	Only as honest as the risk assessment behind it: a risk can be re-scored or split to fall under appetite, and a short register looks good. Meaningless if the appetite is vague.	Gaming	Board	Answers the board's first question (BR-02) directly, against limits the board set itself. The position is worked out, not judged: Outside tolerance if any top risk is past its own tolerance limit; otherwise Outside appetite, within tolerance if any top risk is above appetite; otherwise Within appetite. Keep the scoring method stable and report any re-scoring of a top risk.	Position	0 top risks above appetite; 0 past their own tolerance limit (each top risk carries its tolerance limit in the register)	All organisations	NIST CSF GV.RM-02; DORA Art 5(2)
BM-02	Critical exposure fixed on time	Vulnerabilities and exposure	Are the weaknesses attackers use being closed fast enough?	Of the critical-priority weaknesses (exploited, or on internet-facing or critical systems) due to be fixed in the period, the percentage fixed and verified by their deadline.	Vulnerability remediation tracker (P01)	Higher	Depends on what counts as critical: narrowing the definition raises the figure. Says nothing about systems that are not scanned, so keep scan coverage in the appendix.	Gaming	Board	Measures the weaknesses attackers actually use, against a deadline, so a fall means real exposure is rising. The Vulnerability & Exposure Management pack (P01) produces it.	Exposure	[[95]]% by the agreed deadline	All organisations	ISO/IEC 27001 Cl 9.1; NIST CSF GV.OV-03
BM-03	Expired or high-risk exceptions	Accepted risk	Where have we knowingly accepted risk, and is it still under control?	The number of security exceptions (knowingly accepted risks) that passed their expiry date in the period without being renewed or closed first, shown with the number still open and how many of those are rated High.	Security exception register (P02)	Lower	Falls to zero if exceptions are renewed without review, or never raised at all: a register nobody uses shows a perfect score.	Gaming	Board	Shows where the organisation has chosen to live with risk and whether those decisions are still under control. The Security Exception, Waiver & Segregation of Duties pack (P02) produces it.	Exposure	0 expired; every open High exception approved at the right level	All organisations	NIST CSF GV.RM-02; ISO/IEC 27001 Cl 9.1
BM-04	Significant incidents and time to contain	Incidents and detection	Have we been hurt, and how quickly did we recover?	The number of significant incidents in the period (under your incident classification) and, for each, the hours from detection to containment. Report the count and the longest time to contain.	Incident log	Lower	Lagging: it shows harm already done. The count can be kept down by classifying incidents as less severe, and a quarter with none says little about readiness.	Lagging	Board	The board must know when the organisation has been hurt and how well it responded (BR-07; DORA Art 5(2)(i) for major ICT-related incidents). Pair it with BM-06 for readiness.	Exposure	Every significant incident contained within [[24]] hours	All organisations	DORA Art 5(2); NIS2 Art 20(1)
BM-05	Critical suppliers assessed	Suppliers	Are the suppliers we depend on held to our standard?	The percentage of critical suppliers (those whose failure or compromise would stop a critical service) assessed against your security requirements in the last 12 months.	Third-party register	Higher	An assessment can be a questionnaire returned and never read, and the figure says nothing about what was found. The list of critical suppliers can shrink to improve it.	Gaming	Board	Much of an organisation's exposure now sits with its suppliers. This shows whether they are held to its standard; material findings are reported under Exposure.	Exposure	[[100]]% within 12 months	All organisations	ISO/IEC 27001 Cl 9.1; NIST CSF GV.OV-03
BM-06	Critical services restored in tests	Resilience and recovery	Could we recover our most important services, and have we proved it?	The percentage of critical services whose recovery was tested in the last 12 months and restored within their recovery time objective.	Recovery test records	Higher	A test of an easy service, or a paper exercise, can be counted as a pass. With annual tests the figure changes rarely.	Gaming	Board	Proves recovery rather than assuming it, and answers 'could we recover?' in terms of services the board recognises.	Exposure	[[100]]% tested and restored within objective each year	All organisations	ISO/IEC 27001 Cl 9.1; DORA Art 5(2)
BM-07	Security programme delivery	Programme and investment	Is the plan the board funded being delivered?	The percentage of security programme milestones due in the period that were delivered on time, against the plan the board approved.	Programme plan	Higher	Milestones can be re-planned to stay 'on time', and delivery is not the same as risk reduced. Report every re-baselining.	Gaming	Board	Shows whether the plan and money the board approved are being delivered, which is the board's main lever. Link each late milestone to the risk it was meant to reduce.	Direction	[[90]]% of milestones on time	All organisations	ISO/IEC 27001 Cl 6.2; NIST CSF GV.RR-03
BM-08	Board and staff security training	People and behaviour	Do we, and our people, know enough to judge and act on cyber risk?	The percentage of staff who completed required security training in the last 12 months, with board members' own training shown separately (NIS2 Art 20(2); DORA Art 5(4)).	Training records	Higher	Completion is not competence: a click-through course scores 100%. Vanity when reported without any measure of behaviour.	Vanity	Board	Training of the management body is a legal duty for regulated entities, and staff completion shows the baseline is in place. Pair it with CM-04 (phishing report rate) below board level for behaviour.	Direction	[[95]]% of staff; every board member each year	All organisations	NIS2 Art 20(2); DORA Art 5(4)
CM-01	Security incidents logged (all severities)	Incidents and detection	How many security incidents did we have?	The count of every security incident logged in the period, whatever its severity.	Incident log	Lower	A rise can mean better detection and a fall can mean worse; the count depends on how incidents are classified and can be managed down by reclassifying them. Minor events swamp the ones that matter.	Lacks context	Operational only	Useful for staffing the response team. The board needs significant incidents and how fast they were contained (BM-04), not the volume of minor ones.	Not in the board report	—	All organisations	ISO/IEC 27001 Cl 9.1
CM-02	Attacks blocked	Threat activity	How many attacks did our defences stop?	The number of connections, messages or files blocked by firewalls, email filtering or endpoint protection in the period.	Security tool consoles	—	Always large and always 'good'; it measures the internet's background noise, not the risk to the organisation. No level can be a target, and it says nothing about the attacks that were not blocked.	Vanity	Avoid	No decision the board could take depends on it, and it suggests a safety that the figure cannot show. Use threat context in words in the Exposure section instead.	Not in the board report	—	All organisations	—
CM-03	Phishing emails received or quarantined	Threat activity	How much phishing is aimed at us?	The number of emails classified as phishing or malicious by the email filter in the period.	Email filtering reports	—	Moves with attackers' campaigns and the filter's settings, not with the organisation's risk. It has no target and a rise tells the board nothing it can act on.	Vanity	Avoid	Volume of attack is context, not performance. If phishing matters, report whether staff report it (CM-04) and the incidents it caused (BM-04).	Not in the board report	—	All organisations	—
CM-04	Phishing report rate	People and behaviour	Do our people spot and report suspicious messages?	Of the simulated phishing messages sent in the period, the percentage reported by the recipient through the reporting button or process.	Phishing simulation results	Higher	Depends on how hard the simulated messages are; easy tests inflate it. Comparable over time only if difficulty is held steady.	Gaming	Executive only	A better behaviour measure than click rate, and the natural partner to training completion (BM-08). Too detailed for every board report.	Appendix, if the board asks	—	All organisations	ISO/IEC 27001 Cl 9.1
CM-05	Phishing simulation click rate	People and behaviour	How many staff fall for phishing?	Of the simulated phishing messages sent in the period, the percentage whose link was clicked.	Phishing simulation results	Lower	Easily managed by sending easier or harder tests; a low figure invites complacency and a high one blames staff. Clicks alone do not show harm.	Gaming	Operational only	Helps whoever runs awareness training target it. At executive level, report the phishing report rate (CM-04) instead.	Not in the board report	—	All organisations	—
CM-06	Open vulnerabilities (raw count)	Vulnerabilities and exposure	How many vulnerabilities do we have?	The number of open findings from vulnerability scans at the reporting date, all severities.	Vulnerability scanner	Lower	Counts a low-risk finding the same as one being exploited. It rises when scanning improves and falls when systems drop out of the scan.	Lacks context	Operational only	A workload figure for IT. The board form is critical exposure fixed on time (BM-02).	Not in the board report	—	All organisations	—
CM-07	Percentage of systems patched	Vulnerabilities and exposure	Are our systems up to date?	The percentage of systems with all available patches applied, without regard to how critical the system or the patch is.	Patch management tool	Higher	A high figure hides the few critical, internet-facing systems that are not patched; systems outside the tool are not counted at all.	Lacks context	Avoid	Gives false comfort. Measure the critical weaknesses fixed on time (BM-02), which weights by what attackers use.	Not in the board report	—	All organisations	—
CM-08	Mean time to remediate (all vulnerabilities)	Vulnerabilities and exposure	How long do we take to fix vulnerabilities?	The average days from detection to verified fix for all vulnerabilities closed in the period.	Vulnerability remediation tracker (P01)	Lower	An average hides the long tail of old, dangerous findings, and closing many easy findings pulls it down.	Lacks context	Operational only	Useful per priority for the team managing remediation. At board level use BM-02.	Not in the board report	—	All organisations	ISO/IEC 27001 Cl 9.1
CM-09	Security spend as a percentage of IT budget	Programme and investment	Are we spending enough on security?	Security spending in the year divided by total IT spending.	Finance	—	Says nothing about whether the money reduces risk; the ratio changes when IT spending changes, and what counts as 'security' varies. Benchmarks are rarely comparable.	No target	Avoid	Invites a debate about a ratio rather than about risk. Put spending in the Ask, tied to the risk it reduces (BR-06), and track delivery with BM-07.	Not in the board report	—	All organisations	—
CM-10	Security budget spent against plan	Programme and investment	Are we spending the security budget as planned?	Security spending to date as a percentage of the budget planned to date.	Finance	—	Spending on plan is not delivering on plan; under-spend can be good or bad.	Lacks context	Executive only	A finance control for the executive sponsor. The board sees delivery (BM-07) and any funding ask.	Appendix, if the board asks	—	All organisations	ISO/IEC 27001 Cl 6.2
CM-11	Overall security maturity score	Assurance and compliance	How mature is our security?	A single score from a maturity assessment against a framework, for example 3.1 on a scale of 1 to 5.	Maturity or gap assessment	Higher	A composite that hides where the gaps are, moves slowly and can be raised by changing the assessor or the scoring. The link to risk is indirect.	Lacks context	Executive only	Worth taking to the board's yearly deep dive with a target profile agreed in advance. As a quarterly measure it barely moves.	Appendix, if the board asks	—	Larger organisations	NIST CSF GV.OV-03
CM-12	Percentage of controls compliant	Assurance and compliance	How compliant are we?	The percentage of controls in a framework or policy set assessed as implemented.	Compliance assessment	Higher	Every control counts the same, so ninety easy controls hide ten that matter. It rewards ticking boxes and looks like assurance.	Gaming	Avoid	Tells the board neither where the risk is nor what to decide. Report the material gaps as risks under Exposure.	Not in the board report	—	All organisations	—
CM-13	External security rating	Assurance and compliance	How do outsiders rate our security?	A score from an outside-in rating service, based on what it can observe of the organisation's internet-facing systems.	External rating service	Higher	Built on the provider's own method and on what is visible from outside; it can be moved by fixing cosmetic findings, and it misses most of what matters inside.	Gaming	Avoid	Customers or insurers may quote it, so know yours, but do not steer by it. Explain it in words if the board asks.	Not in the board report	—	All organisations	—
CM-14	Overdue audit and assessment findings	Assurance and compliance	Are we fixing what auditors and assessors found?	The number of findings from internal audit, external audit and regulatory assessments that are past their agreed date, at the reporting date.	Audit findings tracker	Lower	Counts a minor finding the same as a serious one, and dates can be extended to keep the count down.	Gaming	Executive only	The audit committee usually tracks audit actions itself. A serious overdue finding belongs in Exposure as a risk.	Appendix, if the board asks	—	Regulated entities (NIS2, DORA)	ISO/IEC 27001 Cl 9.1
CM-15	Multi-factor authentication coverage	Identity and access	Is strong sign-in in place where it matters most?	The percentage of remote-access, email and privileged accounts that require multi-factor authentication.	Identity provider reports	Higher	Accounts outside the identity provider, and exemptions granted 'temporarily', are easily left out of the denominator.	Gaming	Executive only	A strong control measure. It reaches the board when a gap is a top risk, then through BM-01 and Exposure.	Appendix, if the board asks	—	All organisations	ISO/IEC 27001 Cl 9.1
CM-16	Privileged access reviewed on time	Identity and access	Do we know who holds the keys to our systems?	The percentage of privileged accounts whose access was reviewed and confirmed within the required interval.	Access review records	Higher	A review can be a rubber stamp, and the figure says nothing about what was removed.	Gaming	Executive only	Belongs with the executive or risk committee as a control check.	Appendix, if the board asks	—	All organisations	—
CM-17	Leavers' access removed on time	Identity and access	Do people lose access when they leave?	The percentage of leavers whose accounts were disabled within the required time of their leaving date.	HR leaver list and directory records	Higher	Depends on HR telling IT in time; contractors and supplier accounts are often missed.	Lacks context	Operational only	A process check for IT and HR.	Not in the board report	—	All organisations	—
CM-18	Endpoint protection coverage	Vulnerabilities and exposure	Are all our devices protected?	The percentage of known laptops, desktops and servers reporting to the endpoint protection tool.	Endpoint protection console and asset inventory	Higher	Only as good as the inventory it is compared with; unknown devices are invisible.	Lacks context	Operational only	A hygiene measure for the IT team.	Not in the board report	—	All organisations	—
CM-19	Asset inventory coverage	Vulnerabilities and exposure	Do we know what we own?	Devices and systems seen on the network or in the cloud that are recorded in the asset inventory, as a percentage of all seen.	Asset inventory and discovery scans	Higher	Depends on how complete discovery is, which is the thing being measured.	Lacks context	Operational only	Underpins every other figure but is not a board question.	Not in the board report	—	All organisations	—
CM-20	Unsupported software on critical systems	Vulnerabilities and exposure	Are we running critical services on software that no longer gets security fixes?	The number of critical systems running an operating system or application past its end of support.	Asset inventory	Lower	Can be kept low by leaving systems out of the critical list.	Gaming	Executive only	Often the root of a funding ask. Take it to the board as a risk and an Ask, not as a standing measure.	Appendix, if the board asks	—	All organisations	—
CM-21	Backup success rate	Resilience and recovery	Are our backups working?	The percentage of scheduled backup jobs that completed successfully in the period.	Backup system reports	Higher	A completed job is not a restorable backup, and backups the attacker can reach are no protection.	Vanity	Operational only	The board form is critical services restored in tests (BM-06).	Not in the board report	—	All organisations	—
CM-22	Mean time to detect significant incidents	Incidents and detection	How quickly do we notice an attack?	The average hours from the start of a significant incident to its detection, for incidents closed in the period.	Incident log	Lower	Few data points, so one incident swings it; the start time is often an estimate made afterwards.	Lagging	Executive only	Worth tracking by the executive; explains BM-04 when detection was the problem.	Appendix, if the board asks	—	Organisations with an in-house security team	—
CM-23	Security alerts handled	Incidents and detection	How busy is our security monitoring?	The number of alerts triaged by the security monitoring team or service in the period.	Security monitoring service reports	—	Measures effort, not outcome; more alerts can mean worse tuning. Reports from a managed service often lead with it.	Vanity	Avoid	Activity is not assurance. Ask the service for significant incidents and containment times (BM-04).	Not in the board report	—	All organisations	—
CM-24	Security tasks or tickets closed	Programme and investment	How much has the security team done?	The number of security tickets, tasks or projects closed in the period.	Ticketing system	—	Rewards splitting work into small tickets and says nothing about risk reduced.	Vanity	Avoid	A list of activity is not a direction (BR-01). Report delivery against the approved plan (BM-07).	Not in the board report	—	All organisations	—
CM-25	Penetration test findings	Assurance and compliance	What did the latest penetration test find?	The number of findings from the latest penetration test, by severity.	Penetration test report	Lower	Depends on the test's scope, the tester and the time allowed; a narrow test finds little.	Lacks context	Operational only	Serious findings become risks in the register and appear through BM-01 and BM-02.	Not in the board report	—	All organisations	—
CM-26	Regulatory incident notifications made on time	Incidents and detection	Do we tell regulators in time when we must?	Of the incidents that required a notification to a regulator or authority in the period, the percentage notified within the legal deadline.	Incident log and notification records	Higher	Usually zero or one event a year, so the percentage swings between 0% and 100%.	Lagging	Executive only	A late notification is reported to the board at once as bad news (BR-07); as a standing measure it rarely moves.	Appendix, if the board asks	—	Regulated entities (NIS2, DORA)	NIS2 Art 20(1); DORA Art 5(2)(i)
CM-27	Cyber insurance cover against estimated loss	Risk and appetite	Would our insurance cover a serious incident?	The limit of cyber insurance cover as a percentage of the estimated loss from the most severe plausible incident.	Insurance policy and risk scenario analysis	Higher	The loss estimate is uncertain and exclusions matter more than the limit.	Lacks context	Executive only	A yearly deep-dive question at renewal, not a quarterly measure.	Appendix, if the board asks	—	Larger organisations	NIST CSF GV.RM-02

Choose Yours

Your board measures: up to [[8]], each with a target, a tolerance and an owner (BR-03). Yellow columns are yours. The seven EXAMPLE rows show passes and failures — delete them first.

Example	Metric ID	Measure (calc)	Recommendation (calc)	Report part (calc)	Why our board needs it — the question in our words	Target	Tolerance	Better when (calc)	Owner (role)	Data source in our organisation	Selection no. (calc)	Check (calc)
EXAMPLE	BM-01	Risks outside appetite	Board	Position	Are we inside the appetite we approved in March?	0 top risks above appetite	0 top risks past their own tolerance limit	Lower	Head of Risk	Risk register, quarter-end review	1	OK
EXAMPLE	BM-02	Critical exposure fixed on time	Board	Exposure	Are we closing the holes attackers use, fast enough?	95% fixed within 14 calendar days	80%	Higher	IT Operations Manager	Vulnerability remediation tracker	2	OK
EXAMPLE	BM-04	Significant incidents and time to contain	Board	Exposure	Have we been hurt, and how fast did we contain it?	Contained within 24 hours	48 hours	Lower	Information Security Manager	Incident log	3	OK
EXAMPLE	BM-06	Critical services restored in tests	Board	Exposure	Could we get the online ordering service back?	4 of 4 critical services each year (50%, 2 of 4, by Q3)	25%	Higher	IT Operations Manager	Recovery test records	4	OK
EXAMPLE	BM-07	Security programme delivery	Board	Direction	Is the plan we funded being delivered?	100% (9 of 9 milestones by quarter end)	75%	Higher	Security Programme Manager	Security programme plan	5	OK
EXAMPLE	CM-15	Multi-factor authentication coverage	Executive only	Appendix, if the board asks		100% of remote and admin accounts		Higher	IT Operations Manager	Identity provider report	6	Executive only — say why the board needs it
EXAMPLE	CM-02	Attacks blocked	Avoid	Not in the board report	The previous report always showed it			—		Firewall reports	7	Marked Avoid — choose a board measure

Selection Check

Selection check

The whole selection on Choose Yours against the pack's rules. Every line should say 'Meets the check' before the board is asked to agree the measures.

Most measures the board sees

[[8]] is the pack's suggestion — set your own limit.

Checks

Check	Result	Status	What it means
Measures chosen	7	Meets the check	Warns above the limit in C5. More measures than the board can discuss in its time is the commonest way reports stop being read (BR-03).
Measures marked Avoid	1	Action needed	Replace each with the board measure its reason names.
Measures marked Operational only	0	Meets the check	Keep them on the operational dashboard, not in the board report.
Measures with no target	1	Action needed	BR-03: a measure reaches the board only with a stated target. A tolerance is strongly advised: without one, any miss of the target reads as 'Outside tolerance'.
Measures with no owner	1	Action needed	Someone must answer for each figure when the board asks.
Measures chosen more than once	0	Meets the check	Keep one row per measure.
Rows with a check to resolve	2	Action needed	Any row on Choose Yours whose Check does not say OK.
BM-01 Risks outside appetite chosen	1	Meets the check	Every report opens by saying whether you are within appetite (BR-02); BM-01 is the measure that answers it.

Overall

Not ready

The number of checks above that do not yet say 'Meets the check'.

Your selection by report part

Report part	Measures	Share of selection	Question the part answers
Position	1	14%	Where do we stand against the risk appetite the board set?
Direction	1	14%	Is it getting better or worse, and why?
Exposure	3	43%	What could hurt us most, and how likely is it now?
Appendix, if the board asks	1	14%	Executive measures, shown only where they explain a board measure (BR-05).

The Ask part carries decisions, not measures (BR-06). EXAMPLE rows on Choose Yours are counted until you delete them.

Lists

Recommendation	Weakness	ReportPart	Theme	AppliesWhere	BetterWhen
Board	Vanity	Position	Risk and appetite	All organisations	Higher
Executive only	Gaming	Direction	Vulnerabilities and exposure	Regulated entities (NIS2, DORA)	Lower
Operational only	Lagging	Exposure	Accepted risk	Organisations with an in-house security team	—
Avoid	No target	Appendix, if the board asks	Incidents and detection	Larger organisations
	Lacks context	Not in the board report	Suppliers

Resilience and recovery

Programme and investment

People and behaviour

Identity and access

Threat activity

Assurance and compliance

Definitions

Definitions

Term	Meaning in this workbook
Board measure	A figure reported to the board every cycle. It passes BR-03: it answers a question the board asks and carries a target or tolerance the board has agreed.
Recommendation — Board	Answers a question the board asks, can carry a target or tolerance the board sets, and moves when risk moves. Report it every cycle.
Recommendation — Executive only	Useful to the executive or a risk committee, but too detailed or too narrow for the board. Report it below board level; bring it to the board only when it explains a board measure.
Recommendation — Operational only	Helps the team that runs the control manage its work. It says little about risk to the organisation. Keep it on the operational dashboard.
Recommendation — Avoid	Misleads as a headline measure at any level above the team: it rewards the wrong thing, cannot carry a meaningful target, or looks like assurance when it is not.
Weakness — Vanity	Looks impressive and always moves the right way, but no decision would change because of it (for example, attacks blocked).
Weakness — Gaming	Can be improved by changing what is counted rather than by reducing risk (for example, narrowing what counts as critical).
Weakness — Lagging	Shows harm or failure only after it has happened, so it cannot warn the board in time on its own.
Weakness — No target	No level can be called good or bad, so the board cannot judge it and can only ask 'so what?'.
Weakness — Lacks context	A count or average with no denominator, weighting or comparison, so a rise or fall can mean opposite things.
Target	The level the organisation aims for, for example 95% fixed on time.
Tolerance	The worst level the board will accept before it must act, not just be told — for example 90%. Under DORA the management body sets the ICT risk tolerance (Art 5(2)).
Status — On target	At or better than its target. One of the words a board measure is reported with each cycle (BR-04).
Status — Below target, within tolerance	Short of its target but inside the tolerance the board set; a plan and date are given. One of the words a board measure is reported with each cycle (BR-04).
Status — Outside tolerance	Beyond the limit at which the board said it must act, not just be told; an ask follows (BR-06). One of the words a board measure is reported with each cycle (BR-04).
Status — No target set	Reported without a target: it should not reach the board until one is set (BR-03). One of the words a board measure is reported with each cycle (BR-04).
Position — Within appetite	Every top risk is assessed at or below the level of risk the board has said it is willing to accept. The status words for BM-01, which answers BR-02.
Position — Outside appetite, within tolerance	At least one top risk is above appetite but below the tolerance limit, with a plan and a date to bring it back. The status words for BM-01, which answers BR-02.
Position — Outside tolerance	At least one risk is above the tolerance limit: the point at which the board said it must act, not just be told. The status words for BM-01, which answers BR-02.
Position rule	How BM-01's two counts give the position: Outside tolerance if any top risk is past its own tolerance limit; otherwise Outside appetite, within tolerance if any top risk is above appetite; otherwise Within appetite. BM-01 therefore has no single tolerance figure; each top risk carries its own tolerance limit in the risk register.
Risk appetite	The amount and type of risk the board is willing to accept in pursuit of its objectives, set by the board.
Report part	Where a board measure is shown in the report, in the order BR-01 sets: Position, Direction, Exposure, Ask. Measures below board level go in the appendix or not in the report at all.
Better when	Whether a higher or a lower value is an improvement. '—' marks a measure where neither is, which is itself a sign it cannot carry a target.
Metric ID	The measure's stable reference: BM for the pack's board measures, CM for the other candidates. Keep IDs when you tailor the catalogue.
Critical service	A service whose loss would stop the organisation meeting its main obligations to customers, regulators or the public. Your business impact analysis names them.
Owner	The person, by role, who answers for a measure's figure when the board asks about it.
BR-nn, BM-nn	Reporting rules and board measures defined in the Board Reporting Narrative Model.
(calc)	A column or cell the workbook calculates. Do not type or paste over it.
EXAMPLE row	A worked example on Choose Yours showing how a completed row looks, including two that fail the checks. Delete before approval.

Framework References

Framework references

These references indicate relevance only and do not reproduce the text of any standard.

Framework	Reference	Supported by
ISO/IEC 27001:2022	Clause 9.1 — Monitoring, measurement, analysis and evaluation	Metric Catalogue: what is measured, how, from which source; Choose Yours
ISO/IEC 27001:2022	Clause 6.2 — Information security objectives and planning to achieve them	Choose Yours: target, tolerance and owner for each board measure
NIST CSF 2.0	GV.OV-03 — “Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed”	Board measures BM-01 to BM-08; Selection Check
NIST CSF 2.0	GV.RM-02 — “Risk appetite and risk tolerance statements are established, communicated, and maintained”	BM-01, BM-03; the Tolerance column on Choose Yours
NIS2 — Directive (EU) 2022/2555	Article 20(1) — management bodies approve the cybersecurity risk-management measures, oversee their implementation and can be held liable for infringements	The selection as the measures through which the management body oversees implementation
NIS2 — Directive (EU) 2022/2555	Article 20(2) — members of management bodies are required to follow training to identify risks and assess cybersecurity risk-management practices	BM-08: management body training shown separately
DORA — Regulation (EU) 2022/2554	Article 5(2) — the management body defines, approves, oversees and is responsible for the ICT risk management framework, bears ultimate responsibility for ICT risk and sets the risk tolerance	BM-01 against the risk tolerance the management body sets; the Tolerance column
DORA — Regulation (EU) 2022/2554	Article 5(4) — members of the management body keep up to date with sufficient knowledge and skills to understand and assess ICT risk, including through regular training	BM-08: management body knowledge and training

Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0; Directive (EU) 2022/2555 (NIS2); Regulation (EU) 2022/2554 (DORA)