Chapter 9 of 12 · Every board report
Q9: Are You Reporting Outcomes or Activity?
- Why do security reports all look the same?
- What should a good cyber board report contain?
Many security reports to boards count activity: attacks blocked, emails filtered, training completed. Those numbers say the team is busy. They do not say the company is safer.
In the United States, listed companies must describe in their annual report how the board oversees risks from cybersecurity threats. NIST's Cybersecurity Framework 2.0 also places oversight inside its Govern function. Both are reasons to make sure the reports you receive actually support oversight.
What you should hear
- A small number of measures that change when risk changes.
- Trends over time, with an explanation when something moves the wrong way.
- Decisions the board is being asked to make, clearly flagged.
Red flags in the answer
- Every chart goes up and to the right, every quarter.
- Large numbers with no context.
- Nothing the board is asked to decide.
The question you might not ask out loud
I don't understand half the charts. Is that my fault?
No. A report written for a board should make sense to a board. Ask the CISO to explain any chart in one sentence and say what decision it supports. If they cannot, the chart probably does not belong.
Follow-up
"Which of these numbers would worry you if it moved, and what would you do?"
Why this matters: a board that only ever sees reassuring numbers cannot challenge, and cannot later show it oversaw the risk with care. Clear, honest reporting protects both the company and the directors.
Rule of thumb:If a report would read the same in a good quarter and a bad one, it is measuring activity.