Tools · Board Cybersecurity Reporting
Does our board report work?
Score your last board cyber report against 24 criteria and a short checklist. You get a level in words, the content to add, most important first, each with the document that helps, and the content to take out. Free, no account, and nothing is stored.
Question 1 of 33 0 answered
Part 1 of 7
Position
Where do we stand against the risk appetite the board set?
Score what the board actually received, not what you intended. If you are between two, choose the lower. Use N/A only where a criterion cannot apply, for example ASK-04 when this was the first report to the board.
Position
Direction
Exposure
Ask
Measures
Process
What the report should not carry
You can move on with questions unanswered. They are left out, never counted against you. Nothing is saved, so reloading the page starts again.
- About 30 minutes
- Nothing is stored, not even in your browser: reloading starts again
- If you accepted analytics, we count how far people get through the questions, never what they answer.
- Also as a workbook: Board Reporting Effectiveness Self-Check
How this is worked out, and what it is not
- Points: each criterion scores 0, 1 or 2; N/A and blank are left out. Points available = 2 × the criteria scored. A part's points and the overall points are shown as 'x of y'.
- Level: 'Not yet serving the board' for fewer than a third of the available points; 'Partly serving the board' for at least a third, but fewer than two thirds, of the available points; 'Largely serving the board' for at least two thirds of the available points, but not all; 'Fully serving the board' for every available point. Overall, if any Essential criterion scores 0 the level is held at or below 'Partly serving the board'.
- Content to add: every criterion scored 0 or 1, ordered by priority (Essential, then Important, then Helpful), then by score (Absent before Partly), then by the order of the criteria.
- Content to remove: every checklist item answered Present, in checklist order.
Nothing here is scored out of 100 and there is no percentage. Results are in words and counts, and the questions, the levels and the rule are the workbook's: the same answers give the same result in both.
- This is a self-check of one report by the people who wrote it. It is only as honest as the scores; a second scorer, ideally a board member, is the best check.
- It tests whether the report gives the board what it needs to govern, not whether the organisation's security is good. A well-written report can describe a poor position — that is its job.
- The criteria follow the pack's reporting rules (BR-01 to BR-10). They are not a benchmark, and the level cannot be compared with other organisations or with any certification requirement.
- It does not assess the meeting itself — how the board discussed the report or what it decided — beyond whether earlier actions are followed up (ASK-04).