The Quarterly Security Board Pack

Executive summary

• Boards are not asking for a security update; they are asking for oversight evidence. SEC rules require public companies to describe board oversight of cybersecurity risk annually and disclose a material incident within four business days of determining materiality — a board pack is that oversight record, not a slide deck nobody reads twice.^[1]
• A board asks six things, in some order, every quarter. Trend, maturity, risk, compliance, incidents, and whether the programme is working toward something. Section 1 below is a template for each.
• Lead with the grade, not the score. A–F is legible to a director in one second. The number underneath is for the security team.

1. Six questions, six metrics, six surfaces

Fill in your own numbers under each question before the meeting. The right-hand column names where CMDash already produces that number today — not every metric has a dedicated one-click slide, and the answer for the two that don’t is below the table rather than papered over.

1. "Are we getting better or worse?" — Posture score, with its trend since last period.
   The Dashboard’s posture score tile and the Board Snapshot / Board Deck’s "Posture Score Deep-Dive" slide, which breaks the grade into its underlying signals.
2. "Is the programme maturing, or just staying afloat?" — Maturity trajectory over the last two to three quarters.
   The /maturity workspace’s trend view — a point-in-time audit tells you where you were; this is the same score computed continuously and charted over time.
3. "What could actually hurt us, and how bad?" — Open risks by criticality band (High / Medium / Low).
   The Risk Register, normalized likelihood × impact score, and the Board Deck’s "Risk Register Summary" slide (top risks by score, status distribution).
4. "Are we compliant with what our customers and regulators require?" — Control coverage per active framework (Met / In Progress / Not Met).
   The Board Snapshot’s "Compliance Framework Summary" and the Board Deck’s "Compliance Framework Progress" slide.
5. "Did anything happen, and did we handle it well?" — Incident count and severity mix over the period.
   Security → Incidents (severity Critical/High/Medium/Low, status Open/Contained/Monitoring/Closed) feeding remediation progress on the Board Deck’s "Remediation Progress" slide.
6. "Is the programme working toward something, or just reacting?" — Progress against stated security objectives.
   Security → Program → Objectives (owner, measure, target date, review cadence) — summarized in the Board Deck’s Executive Summary slide as "top 3 priorities."

2. Cadence and format

• Monthly: a one-page Board Snapshot PDF (Essentials plan and above), generated on demand and current at the moment you click Generate. It needs a verified e-mail address.
• Quarterly: the full Board Deck (.pptx, Command plan and above) — cover, executive summary, posture deep-dive, compliance progress, risk summary, remediation progress, integration health, and an optional peer benchmarking slide, fully editable afterward in PowerPoint or Slides. The benchmarking slide shows a reference baseline, not real peers, until ten organizations in your industry opt in, and the deck needs a verified e-mail address too.
• Ad hoc: a Board Snapshot the morning of an incident update, or a Custom Report Builder view scoped to whatever the audit committee specifically asked for last time.

3. Writing the narrative around the numbers

• Trend over snapshot. A posture score of 74 in isolation means little. A 74 that was 61 six months ago is a story a director will remember.
• Cap risks at five. Boards are not risk analysts. Five risks with a one-line business-impact sentence each beat the full register every time.
• Dollars when you have them. If a risk has been run through FAIR quantification, put the expected annual loss next to the score — “$1.2M expected annual loss” lands harder than “scored 8 out of 10.”
• Match the format to the audience. An audit committee wants the appendix with the full control list. A board that only sees security once a quarter wants the executive summary and nothing else.

Build this quarter’s pack from your own data

References

1. U.S. Securities and Exchange Commission. “SEC Adopts Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies.” 2023. https://www.sec.gov/newsroom/press-releases/2023-139
   Cited for: Registrants must disclose a material cybersecurity incident on Form 8-K within four business days of determining materiality, and describe risk management, strategy and board oversight annually. Checked 2026-09-06.

Not ready to trial today?