Every quarter the audit committee expects a cyber update — and the session either builds its trust or spends it. This pack gives you the structure to run it well: a framework-anchored posture summary, a remediation tracker with dates you can hit, honest prior-period follow-up, the risks and decisions the committee actually owns, and board-grade metrics — reporting that is trended, checkable, and surfaces the gaps before anyone else finds them.
Educational template — not legal or audit advice. Frameworks and the committee’s oversight role are summarised for orientation; adapt this to your governance structure with your counsel and auditors.
Free · no signup · adapt it in your own doc
Audit Committee Cyber Briefing Pack
The standing pack the CISO brings to the quarterly audit-committee cyber session. It gives the committee what it needs to oversee the program — control posture, open remediation, prior-period follow-up, the risks and decisions it owns, and board-grade metrics — in a form that is honest, trended and checkable. Adapt it to your governance structure.
01Session agenda (standing items)
Reporting period
Quarter / dates covered
Presented by
CISO / name
Also present
GC, CFO, external auditor, as applicable
Posture summary and movement since last quarter (the headline)
Open remediation — findings, owners, committed dates, status
Prior-period follow-up — what we committed last quarter and where it stands
Material gaps and incidents to surface, with impact and interim mitigation
Key risks and the explicit decisions requested of the committee
Board-grade metrics appendix
Executive session with the committee (CISO available, management excused as the committee directs)
Keep the headline honest: lead with what changed, including regressions. A pack that only ever improves is a pack the committee stops trusting.
02Control-posture summary
Map posture to a recognised framework so the committee has a common, trackable vocabulary — here the five NIST CSF functions (or substitute your ISO 27001 / control-set domains). Maturity is your self-assessed level against a defined scale; trend is movement since last quarter.
Domain (NIST CSF)
Maturity (target)
Trend
Top risk in this domain
Identify — asset & risk management
e.g. 3 of 5 (target 4)
↑ / → / ↓
Incomplete inventory of crown-jewel assets
Protect — access, data, training
e.g. 3 of 5 (target 4)
↑ / → / ↓
Privileged-access reviews behind schedule
Detect — monitoring & logging
e.g. 2 of 5 (target 4)
↑ / → / ↓
Log-monitoring coverage gap (repeat)
Respond — IR & comms
e.g. 3 of 5 (target 4)
↑ / → / ↓
IR plan not yet exercised this year
Recover — resilience & backups
e.g. 3 of 5 (target 4)
↑ / → / ↓
Recovery time for tier-1 systems unverified
Prefer a few framework-aligned domain ratings with trend over a single composite "security score" — one number averages away the one domain that could sink you.
03Remediation tracker
Every open finding with a named owner, a committed date you can actually hit, and current status. A missed committed date costs more trust than a realistic later one, so commit to the real date and show interim milestones. Flag repeats explicitly — the committee watches those hardest.
Finding
Severity
Owner
Committed date
Status
Privileged-access reviews not running
High
IAM lead
Realistic date
In progress — interim: quarterly manual review in place
Log-monitoring coverage gap — REPEAT (3rd qtr)
High
SecOps lead
New committed date
Re-scoped — prior approach failed; see prior-period follow-up
Legacy systems cannot be patched to standard
Medium
Infra lead
~18 mo (ERP-migration dependent)
Compensating controls in place; interim risk accepted
Vendor risk reviews incomplete for tier-1 suppliers
Medium
TPRM lead
Realistic date
On track
Mark repeat findings as repeats. Hiding that a finding has rolled over, or re-committing to the plan that already failed, is what erodes the committee's confidence in the remediation process itself.
04Prior-period follow-up
Close the loop on what was committed last quarter — this is where credibility is earned or lost. For each prior commitment: was it met, and if not, the honest reason and the corrected course (not a re-commitment to the same failed plan).
Committed last quarter
Due
Outcome
If missed: root cause & changed approach
Close log-monitoring coverage gap
Date
Missed
Root cause: tooling rollout underestimated. Changed approach: phased by asset tier, new owner, dedicated budget.
05Key risks & decisions requested of the committee
State residual risk against the board-approved risk appetite — not against your personal comfort — and name the explicit decision each one forces. This is where the committee exercises oversight; give it something concrete to decide, challenge or escalate.
Top residual risks (vs. appetite)
Each risk: inherent → residual, relative to the stated tolerance
Decisions requested
Accept / mitigate further / transfer — per risk, with the trade-off
Interim risk acceptances to ratify
e.g. legacy-system gap carried by compensating controls for the migration window
Items to escalate to the full board
Potentially material incidents, disclosure implications, enterprise-level exposure
The audit committee oversees that a sound process exists and works and holds management accountable; management owns the technical decisions and operation. Keep that boundary clear — and escalate potentially material or enterprise-wide matters to the full board rather than containing them here.
06Metrics appendix (board-grade)
Outcome- and risk-oriented measures the committee can govern against — not activity vanity metrics (emails blocked, events processed). A handful, trended, each tied to a risk or a target.
Metric
This period
Trend
Target / appetite
Residual risk vs. approved appetite
Within / above
↑ / → / ↓
At or below appetite
Mean time to detect / respond
MTTD / MTTR
↑ / → / ↓
Stated target
Critical-patch SLA attainment
% within SLA
↑ / → / ↓
e.g. 95%
Control coverage of crown-jewel assets
% covered
↑ / → / ↓
100% of tier-1
Repeat-finding rate
# / % of open findings
↑ / → / ↓
Trending to zero
Security-training / phishing-resilience
% completion / fail rate
↑ / → / ↓
Stated target
If a director asks for a single glanceable number, offer this compact dashboard instead and explain that one composite score would hide the exposures that matter.
Practice the decision
This pack structures a session you can rehearse. The free Audit Committee Q&A Lab puts you in the CISO's seat and grades you on ~14 of the exact calls this pack sets up — how to answer “are we secure?”, which gaps to surface, what date to commit to, how to present a repeat finding, and when to escalate to the full board.
TL;DR
What this template is
A board-ready pack the CISO brings to the quarterly audit-committee cyber session: control posture, open remediation, prior-period follow-up, the risks and decisions the committee owns, and board-grade metrics.
Built around what earns a committee's trust — honest, trended, checkable reporting; repeat findings flagged as repeats; remediation dates you can actually hit; residual risk stated against the board-approved appetite.
Copy it or download it as Markdown and adapt it to your governance structure — nothing is uploaded.
Practise the underlying decisions in the free Audit Committee Q&A Lab.
Educational template — not legal or audit advice. Adapt it with your counsel and auditors.
Frequently asked questions
What is this template for?+
It is the standing briefing pack a CISO or security leader uses to run the quarterly audit-committee cybersecurity session. It structures the posture summary, the remediation tracker, the prior-period follow-up, the key risks and decisions requested of the committee, and a board-grade metrics appendix, so the session gives the committee real oversight material rather than a reassurance narrative.
How do I present a repeat finding?+
Flag it explicitly as a repeat — the template's tracker and prior-period follow-up both call for it. Give the root cause of why prior attempts failed, state what you are changing in the approach (not a re-commitment to the same plan), and attach a new committed date with clear accountability. A repeat finding is the one directors watch hardest, so owning it is what rebuilds confidence.
What metrics belong in front of an audit committee?+
Outcome- and risk-oriented measures the committee can govern against: residual risk versus the approved appetite, mean time to detect and respond, critical-patch SLA attainment, control coverage of crown-jewel assets, and the repeat-finding rate. Activity vanity metrics — emails blocked, events processed — look impressive but tell the board nothing about whether the company is actually safer.
Is this legal or audit advice?+
No. It is an educational template. References to frameworks (NIST CSF, ISO 27001) and to the audit committee's oversight role are summarised for orientation and can change; adapt this to your own governance structure with qualified counsel and your auditors.
🎉 New here? Use code WELCOME10 for 10% off any plan at checkout