Overview
Boards expect short, decision-oriented cybersecurity reporting that ties risk to business impact. This quarterly template helps CISOs summarize posture, priority risks, and program progress in a format directors can act on. It lines up with the Govern function in NIST Cybersecurity Framework 2.0, which makes oversight of cyber risk an explicit leadership duty.
Use it to show trend movement, justify spend, and flag where the board needs to decide something. The page structure, risk register fields, filled example, and checklist below can be copied straight into your own deck or memo.
What This Report Covers
- Executive summary with top risks and mitigation status
- KPIs for detection, response, and resilience
- Material incidents and regulatory notifications
- Strategic initiatives, budget usage, and roadmap progress
- Third-party and supply-chain risk posture
- Key decisions required from the board
Template Structure, Page by Page
| Page | Section | What goes in it |
|---|---|---|
| 1 | Executive summary | Three sentences: overall posture, the biggest change since last quarter, and any decision needed |
| 2 | Top five risks | Each risk with owner, rating, trend since last quarter, and target date |
| 3 | Metrics dashboard | Six to eight KPIs showing last quarter, this quarter, and target |
| 4 | Incidents and near misses | Material incidents, regulatory notifications made, and what changed as a result |
| 5 | Program and budget | Roadmap milestones hit or missed, spend against plan, open hiring gaps |
| 6 | Third parties | Vendors whose tier or rating changed, and open remediation items |
| 7 | Decisions requested | Each ask framed as approve, endorse, or note, with cost and the consequence of saying no |
| Appendix | Supporting detail | Technical metrics, audit findings, metric definitions |
Risk Register Entry: Fields to Fill
| Field | What to write | Example |
|---|---|---|
| Risk title | A plain-language name a director would recognise | Ransomware stops card payment processing |
| Business impact | What the business loses if it happens | Card payments offline for up to two days; penalties under two acquirer contracts |
| Owner | The executive accountable, not the security team | Chief Operating Officer |
| Current rating | Likelihood and impact on your own scale | High (likelihood 4, impact 5) |
| Trend | Direction since last quarter, with one reason | Improving: immutable backups now cover the payment database |
| Key controls | The controls that reduce this risk today | Offline backups, endpoint detection on all servers, segmented payment network |
| Open actions | Work in flight, each with a date | Full restore test of the payment database by 30 November |
| Target rating | The rating the owner has agreed to accept | Medium by the end of Q2 |
Board-Level Metrics Table
| Metric | Why it matters | Sample board question |
|---|---|---|
| MTTD and MTTR | Measures operational effectiveness and breach exposure | Are we improving response speed quarter over quarter? |
| Risk reduction percentage | Shows impact of remediation programs | Which top risks moved from high to medium this quarter? |
| Critical asset coverage | Validates protection for crown jewels | Do we have visibility on all tier-0 systems? |
| Compliance milestone status | Tracks regulatory readiness | Are any audits or deadlines at risk? |
| Third-party risk tiering | Reflects supply-chain exposure | Which vendors require immediate remediation? |
| Incident cost estimate | Links security to financial impact | What is the projected loss for top scenarios? |
Risk Narrative Guidance
Pair every metric with a short narrative that explains why it matters to the business. Focus on how changes affect revenue, operations, and reputation. If a metric worsens, explain the root cause, scope of exposure, and the plan to correct it in the next quarter.
Filled Example: Executive Summary
The example below is illustrative and not drawn from a real organization. Replace every figure with your own.
"Overall cyber risk is stable and improving. Time to contain a confirmed incident fell from nine hours to five after we automated endpoint isolation. One risk went up: two payment vendors failed their annual reassessment, and both have agreed remediation plans due before year end. We had one reportable incident, a phishing compromise of a finance mailbox, contained within a day with no customer data exposed. We ask the board to approve funding for privileged access monitoring, which closes the largest remaining gap in our top risk."
Notice what the paragraph does. It gives a verdict first, explains the one metric that moved, admits the one thing that got worse, reports the incident in business terms, and ends with a specific ask tied to a named risk.
Recommended Decisions and Asks
- Approve funding for the top two remediation initiatives
- Endorse an incident response tabletop exercise with executive participation
- Confirm risk appetite for third-party data handling
- Authorize a new control for privileged access monitoring
- Review cyber insurance coverage for updated exposure
Pre-Submission Checklist
- Every metric has a written definition and uses the same data source as last quarter
- Each red or amber item has a named owner and a date
- Incident figures match what legal and compliance reported to regulators
- Numbers in the narrative match the numbers in the dashboard
- Each ask states cost, the risk it reduces, and what happens if the board says no
- Technical terms are removed or defined in one line
- The CFO or general counsel has checked any figure with a financial or legal implication
- Actions the board requested last quarter are listed with their current status
Mistakes That Cost Board Confidence
- Reporting activity, such as alerts processed or patches deployed, instead of risk movement
- Changing how a metric is calculated between quarters, which breaks the trend line
- Softening a bad quarter; directors usually find out later and trust drops
- Asking for budget without naming the risk it reduces
- Showing a heatmap with no explanation of what moved and why
Quarterly Cadence and Ownership
Set clear ownership for data collection, drafting, and review. Most CISOs use a two-week reporting window: week 1 for metric validation and incident analysis, week 2 for narrative writing and executive alignment. Keep one source of truth for metrics to avoid conflicting numbers across reports.
Keeping a Record of Oversight
Keep each quarterly report, the board minutes that discuss it, and any decisions taken in one place. If your company files with the US Securities and Exchange Commission, its annual report must describe how the board oversees cybersecurity risk under the 2023 SEC cybersecurity disclosure rules. A consistent quarterly record is the simplest evidence that oversight happens. Private companies benefit too: lenders, insurers, and acquirers increasingly ask how the board supervises cyber risk.