A cybersecurity update should help directors understand the organisation’s important risks, whether management’s actions are working and which decisions or trade-offs need their attention. A dashboard can support that discussion, but a long list of technical indicators is not a substitute for explaining impact, trend, ownership and next action.
Start with the decision the board needs to make
Before choosing a metric, identify the question. Does the board need to understand whether a critical service can recover, whether a major risk is being treated, whether a supplier dependency is acceptable or whether investment is needed? The reporting should connect the evidence to that decision.
NIST’s measurement guidance says information security measures should align with organisational priorities and goals. It also cautions that numbers alone may not provide the full picture, and that poorly selected metrics can reduce reporting quality and confidence.^1 Select measures because they help answer a business question, not because a tool already produces them.
Use a small set of meaningful measures
A report may combine a small number of outcome, exposure and operational measures. Examples could include the status of recovery tests for critical services, coverage of a defined control on high-risk systems, overdue actions for a material risk or external access awaiting review. Choose measures that fit the organisation and can be explained consistently.
Avoid targets without context. A percentage of systems patched may look reassuring while excluding the most important assets. A count of incidents may rise because detection improved, not because underlying risk necessarily worsened. Explain scope, exclusions and changes in measurement method so directors can interpret movement.
NIST SP 800-55 advises organisations to begin with a limited set of quantitative measures and warns that poorly framed figures can mislead. Pair numbers with definitions, owners, evidence and any known data-quality limitations.^1
Translate technical status into business impact
For each material risk, describe the affected service or objective, how a disruption could matter, what controls are in place and what remains uncertain. Avoid presenting a vulnerability count without explaining which assets are affected, what exposure exists and what action is planned.
A useful update might state that a recovery test for a critical application is overdue, identify the business owner, explain what decision is needed and set a date for retesting. Another might describe a supplier access review that is incomplete and state whether the affected access remains necessary during the review.
Do not claim that a control eliminates risk. Explain what it is intended to do, what evidence indicates it is operating and what residual risk remains.
Show trend and action ownership
A single measurement shows a point in time. A trend can show whether work is progressing, provided the underlying data is comparable. State the reporting period, the source of the data, the target or threshold if one is justified and the owner of any follow-up action.
Track actions through completion. If a decision is blocked by cost, capacity, a supplier or a technical dependency, say so and present the options. Give the board a clear request when approval or risk acceptance is needed, rather than making the directors infer the decision from a chart.
Make uncertainty visible
Some security risks cannot be expressed precisely as a single number. Explain what is known, what is estimated and what evidence is missing. If a metric has changed because the organisation improved logging or updated its asset inventory, distinguish that from an actual change in threat or exposure.
Use definitions consistently and review whether a measure still supports the board’s decisions. NIST’s guidance focuses on selecting measures in line with objectives and asset characteristics, not on prescribing one universal board dashboard.^1
Fit the reporting into governance
Agree the audience, cadence and escalation path. The board may need a concise strategic view, while management and technical teams need more operational detail. Make sure important incidents can be escalated between scheduled meetings and that owners can provide evidence behind the reported status.
Security reporting should connect with enterprise risk, business continuity, supplier management and technology investment. A cross-functional view helps directors understand dependencies rather than treating cyber as an isolated technical matter.
Give directors a useful security conversation
A strong board update focuses on a few reliable measures, explains the business context, shows trend and uncertainty, names owners and makes the required decision explicit. It gives directors enough information to govern risk without pretending that a dashboard can capture every detail.
Read why perimeter security no longer holds and how to review third-party access. For AltTab’s current managed security monitoring, response and reporting scope, see Managed Security Services.