Reporting to Senior Management and the Board
Communicating security at the highest level
Reporting to the board requires a different level of abstraction and focus from any other internal security report, prioritizing the business's risk exposure, the decisions that require its explicit approval and how the program compares with industry standards, instead of technical or operational details that belong to lower management levels. A board needs to understand, in a few minutes, whether the organization is reasonably protected against the threats relevant to its sector, which significant risks remain untreated and why, and what additional investment is required to close them, presented in language any board member can understand without prior technical training. In practice, these reports should also include the threat context relevant to the organization's specific sector, because a board that only sees internal figures with no external comparison loses perspective on whether the reported risk level is reasonable or worrying compared with what similar organizations face.