Board & Executive Reporting

Board Snapshot PDF: Essentials and above | Board Deck, Scheduled Reports, Custom Report Builder: Command and above

Why Board Reporting Matters

Boards are under increasing pressure to demonstrate cybersecurity oversight. SEC disclosure rules require material incident reporting within four business days. Cyber insurance underwriters expect documented governance. Directors have personal liability exposure in the event of a breach.

A well-structured, consistent security report does two things: it keeps your board informed with the information they need to fulfill their oversight role, and it builds the kind of institutional familiarity that prevents security from being treated as a one-time agenda item. CMDash automates most of the assembly work so you can focus on the narrative.

Two Report Formats

CMDash offers two primary reporting formats for board and executive audiences.

Board Snapshot PDF

Available on: Essentials and above

The Board Snapshot is a single-page PDF summary auto-generated from your current CMDash data. No configuration is required.

What's Included

• Posture Score: current score and directional trend (up/down/stable since last period)
• Top 3 Risks: highest-scored active risks in your Risk Register
• Compliance Framework Summary: for each active framework, a count of controls that are Met, In Progress, and Not Met
• Integration Health: count of connected integrations and any currently unhealthy connections
• Key Metric Changes: notable changes since the last snapshot period (e.g., posture score moved +4 points, 12 new controls passed)

Generating a Board Snapshot

1. Go to Reports → Board Snapshot
2. Click Generate PDF
3. Download immediately — no waiting

The snapshot reflects your current data at the moment of generation. Generate it the morning of your board meeting for the most current view.

When to Use It

• Monthly board update packets (attach alongside financial summary)
• Quick executive briefings where a full deck would be excessive
• Post-incident summaries to show current posture after a security event
• Cyber insurance renewal documentation

Board Deck (.pptx)

Available on: Command and above

The Board Deck is a multi-slide, fully editable PowerPoint presentation generated from your CMDash data. It is designed to serve as the primary security agenda item at a board or executive committee meeting.

Slide-by-Slide Breakdown

Generating the Board Deck

1. Go to Reports → Board Deck → Configure
2. Select which slides to include
3. Set the date range (period covered)
4. Choose which compliance frameworks to show
5. Select risks to highlight (or use top-N by score)
6. Click Generate and download the .pptx file

Branding

If white-label branding is configured for your account, your firm's logo and brand colors replace CMDash's in the generated deck. To configure branding, go to Settings → Branding [Command+].

Editing After Export

The exported .pptx is fully editable in Microsoft PowerPoint or Google Slides. Add speaker notes, adjust the narrative, insert additional company context, or rearrange slides before your presentation.

Scheduled Reports

Available on: Command and above

Configure automatic report delivery so stakeholders receive updates without requiring manual generation.

Setting Up a Scheduled Report

1. Go to Reports → Scheduled → Create
2. Select frequency: daily, weekly, monthly, or quarterly
3. Add recipients: CMDash users (by name) or any external email address
4. Select report type: Board Snapshot, Custom Report, or Digest
5. Save — reports deliver on schedule with a PDF attachment

Scheduled reports are sent from a CMDash system address. If your organization's email filters block external senders, add the CMDash sender domain to your allowlist.

Custom Report Builder

Available on: Essentials and above

Build reports tailored to specific audiences — a risk-focused report for the audit committee, a compliance-focused report for your legal team, an operational summary for your security team.

Building a Custom Report

1. Go to Reports → Report Builder → Create New
2. Select the metrics to include:
   • Posture score (current and trend)
   • Risk counts filtered by status and/or score range
   • Compliance completion percentage
   • Specific control statuses
   • Integration sync statistics
3. Set the date range: rolling window (last 30/60/90 days) or fixed start/end dates
4. Apply a framework filter to scope the report to specific compliance programs
5. Click Preview, then Save as Template for reuse
6. Export as PDF or CSV

Saved templates appear in the Report Builder dashboard and can be used for one-off generation or attached to a scheduled report.

Tips for Effective Board Reporting

Lead with the posture grade, not the score. An A–F grade is immediately legible to any executive. The underlying score gives security professionals precision; the grade gives boards orientation.

Emphasize trend over current state. A posture score of 74 means little in isolation. A posture score of 74 that was 61 six months ago is a compelling story. Lead with the direction of travel.

Cap risks at five. Boards are not risk analysts. The top 5 risks by score — with a one-line business impact description each — are more useful than the full register.

Connect risks to financial impact. If you've run FAIR quantification [Enterprise], include the ALE alongside the risk score. "This risk has an expected annual loss of $1.2M" is more actionable than "this risk is scored 8/10."

Schedule monthly. Boards develop intuition about your security posture over time. A consistent monthly cadence builds that familiarity; sporadic reporting does not.

Customize to your board's priorities. Some boards care intensely about CMMC certification timelines because they're a defense contractor. Others are focused on cyber insurance coverage. Others want to see SOC 2 progress before a fundraise. Configure the deck to surface what your board is tracking.

Related Features

• FAIR Cyber Risk Quantification
• Evidence Collection & Audit Packages
• Risk Register