Reporting cyber risk to the board: what directors actually need

Boards do not need to understand your firewall. They need to know whether the organisation's cyber risk is within appetite, whether it is improving, and what decisions they must make. Most security reporting fails because it answers questions nobody on the board asked.

The four questions directors are actually asking

1. Are we exposed to something that could seriously harm the business? Not a list of vulnerabilities - the two or three scenarios that would genuinely hurt.
2. Are we getting better or worse? Direction of travel matters more than any single number.
3. Are we meeting our obligations? Regulatory, contractual and certification commitments.
4. What do you need from us? Budget, headcount, a risk acceptance, or a decision only they can make.

If your pack does not answer these four, it is an activity report rather than a governance report.

Metrics that support decisions

• Top risks with trend - the five that matter, each with owner, current level, appetite and direction.
• Compliance posture per framework, with audit dates and open findings.
• Control effectiveness - the share of critical controls operating with current evidence.
• Incidents - number by severity, time to detect, time to contain, and what changed as a result.
• Third-party exposure - critical suppliers, assessment status and concentration risk.
• Remediation health - overdue high-risk items and the reason they are overdue.
• Resilience - when continuity and restoration were last tested, and whether they passed.

Give every metric a target and a trend arrow. A number with no context invites the wrong question.

What to leave out

• Raw vulnerability counts with no business framing.
• Volumes of blocked attacks - it sounds impressive and informs nothing.
• Tool names and product roadmaps.
• Technical jargon without a plain-language equivalent.
• Reassurance without evidence. Directors are increasingly personally exposed and will test confident claims.

Translate technical risk into business language

Not "we have 47 critical vulnerabilities", but: "Three internet-facing systems supporting order processing have unpatched critical flaws. Exploitation could halt order intake for up to two days, at roughly X per day. Remediation completes on the 30th; the delay is a vendor patch dependency."

That framing gives the board an impact, a timeline, a cause and an implicit decision. The vulnerability count gives them nothing to govern.

Why regulators now expect this

• NIS2 requires management bodies to approve and oversee cyber risk measures - and to be trained.
• DORA places ICT risk accountability on the management body.
• SAMA CSF expects board-level governance and reporting.
• ISO 27001 mandates management review with defined inputs and documented outputs.

Practical consequence: minute the discussion. Record what was presented, what was decided, and what was accepted. An undocumented board conversation does not satisfy an auditor - or protect a director.

A pack structure that works

1. One-page summary: posture, top three risks, decisions requested.
2. Risk dashboard with trends against appetite.
3. Compliance and audit status.
4. Incidents and lessons learned since the last meeting.
5. Programme progress against the agreed plan.
6. Decisions and approvals required, stated explicitly.
7. Appendix for the detail, for those who want it.

Key takeaways

• Answer the four questions directors actually ask.
• Every metric needs a target, a trend and a business consequence.
• Translate technical findings into impact, timeline and decision.
• Minute the discussion - undocumented oversight does not count.