How Do I Report Cyber Security Risk to the Board?

Why Board Reporting Matters

Regulatory pressure:

• NIS2 requires board-level accountability
• GDPR holds directors responsible
• UK Corporate Governance Code expects risk oversight
• Cyber is now a board-level risk like financial or legal risk

Business reality:

• Boards allocate budget
• Boards set risk appetite
• Boards answer to shareholders and regulators
• Cyber incidents destroy companies

If the board doesn't understand cyber risk, they can't govern it properly.

What Boards Actually Need

Directors aren't technical. They need:

Business impact language:

• "We could face £X in losses" not "We have Y vulnerabilities"
• "This affects our ability to deliver contracts" not "Our CVSS scores improved"
• "Regulators could fine us" not "We're non-compliant with control 5.3"

Decisions to make:

• Should we invest in X capability?
• Do we accept this risk or mitigate it?
• Is our security posture adequate for our risk appetite?
• Are we meeting our obligations?

Confidence that it's managed:

• Is someone competent in charge?
• Do we have the right controls?
• Are we improving over time?
• Would we know if something went wrong?

A Board Reporting Framework

1. Risk exposure summary

What's at stake:

• Key assets and their value
• Top risks and potential impact
• Changes since last report

*Example: "Our customer database represents our core business asset. Top risk is ransomware causing operational shutdown (potential impact: £500K-2M). Risk level: Medium, unchanged from Q2."*

2. Security posture

How protected are we:

• Overall security maturity score
• Key control effectiveness
• Comparison to industry/peers
• Trend over time

*Example: "Security maturity: 3.2/5 (industry average: 2.8). Improved from 2.9 last year. Key strengths: endpoint protection, MFA coverage. Gap: third-party risk management."*

3. Incident summary

What happened:

• Significant incidents this period
• Near misses
• Response effectiveness
• Lessons learned

*Example: "One significant incident: phishing attempt targeting finance (blocked). 47 low-severity events handled routinely. No data breaches. No regulatory notifications required."*

4. Compliance status

Are we meeting obligations:

• Regulatory compliance status
• Certification status
• Customer/contract requirements
• Upcoming requirements

*Example: "Cyber Essentials Plus: Certified (renewal due March). ISO 27001: On track for certification Q2. NIS2: Gap assessment complete, remediation 60% complete."*

5. Investment and resources

Are we spending wisely:

• Security spend vs plan
• Key initiatives status
• Resource adequacy
• Investment recommendations

*Example: "Security spend: £180K YTD vs £200K budget. EDR deployment complete. SIEM project 70% complete, go-live November. Request: Additional £30K for NIS2 compliance work."*

Metrics That Work

Good metrics (business-relevant):

• Mean time to detect incidents
• Mean time to respond
• Percentage of critical systems with current patching
• MFA coverage percentage
• Security training completion
• Overdue vulnerability remediation

Bad metrics (technical noise):

• Number of firewall rules
• Total events in SIEM
• Number of vulnerabilities found
• Spam emails blocked
• Malware signatures updated

Presentation Tips

Keep it short:

• 3-5 pages or slides maximum
• Executive summary on page one
• Detail available on request

Use visuals:

• Traffic light status indicators
• Trend charts
• Risk heat maps
• Maturity spider diagrams

Tell a story:

• What's our situation?
• What's changed?
• What should we do?

Prepare for questions:

• "What keeps you up at night?"
• "How do we compare to peers?"
• "What would you do with more budget?"
• "What happens if X vendor is breached?"

Our vCISO Service

Board reporting is core to our vCISO offering:

• Quarterly board reports prepared
• Risk language translation
• Metrics dashboards
• Board meeting support
• Director briefings

We help you communicate security in ways the board can understand and act on.