What the reporting should answer
The three questions a governing body needs its cybersecurity reporting to answer are consistent regardless of sector or regulatory position: what are the material risks, what residual exposure remains after controls are applied, and what requires a board decision. A reporting format that answers those three questions gives the board the information needed to exercise oversight.
Most reporting formats that reach boards were designed around what security teams already measure. Those metrics are useful for managing a security programme. They reach the board because they are straightforward to produce, and because no explicit agreement exists on what the board actually needs to receive. The result is reporting that passes through board meetings without producing a decision or a question.
What adequate reporting contains
Three elements are present in reporting that serves a governing body.
- Risk framing
- The reporting should identify the organisation's material cyber risks, state the residual exposure after controls are applied, and describe how the risk profile has changed since the previous report. Those three elements give the board a position to evaluate.
- Decision content
- The reporting should surface the open questions: where investment is needed, where coverage falls short, and what risks the organisation has chosen to carry. The board's role is to evaluate those questions and decide on them. That requires them to be put to the board explicitly.
- Honest disclosure
- Controls degrade and threat environments shift. A report that identifies where the security position has deteriorated, and what is being done about it, allows the board to assess whether the response is adequate.
How a board tests whether its reporting is adequate
A board assessing its current reporting can put three questions to the CISO at the next cycle. What are the organisation's three material cyber risks? What would a successful attack on each cost the organisation? What has the organisation decided to carry, and why?
If those questions are answered clearly in the meeting, the reporting is working. If they require preparation that was not part of the standard reporting process, or cannot be answered in the meeting, the format needs to change.
The change begins with a defined agreement between the board and the CISO on what the board needs to make governance decisions, and a reporting structure built around those requirements.