The six questions a board actually asks about security, and where the answer already lives

A board or audit-committee security update tends to run long and say little, not because the information does not exist but because nobody sat down and mapped the questions directors actually ask to the metric that answers each one. Our quarterly security board pack is that mapping, written as a template rather than a lecture.

The six questions, verbatim from the template, are: "Are we getting better or worse?", "Is the programme maturing, or just staying afloat?", "What could actually hurt us, and how bad?", "Are we compliant with what our customers and regulators require?", "Did anything happen, and did we handle it well?", and "Is the programme working toward something, or just reacting?" Each one maps to one metric — posture score trend, a maturity trajectory over two to three quarters, open risks by criticality band, control coverage per active framework, incident count and severity mix, and progress against stated objectives — and each metric names the surface it already lives on: a dashboard tile, a board-deck slide, a risk register, an objectives tracker. Three of the six are generated onto the board deck automatically; the other three (maturity trajectory, incident handling, and objective progress) are tracked live but summarised into the deck by a person, and the template says which is which rather than blurring the two together.

That distinction — "this is computed" versus "this is a person's judgment, recorded" — is the difference between a board pack that survives a follow-up question and one that does not. A board member who asks "how did we get this number" deserves a real answer, and "a person looked at the register" is a legitimate one as long as it's the true one.

If you are the person who has to stand up in that meeting, the CISO persona page covers the rest of what CMDash does for that job; the board pack itself is free to read online, no form required for the on-page version.