How do you explain the SOC to your CFO and board?

Explain a SOC as the function that watches for attacks and decides what to do about them, with stated hours, owners and outcomes. Finance and boards respond to coverage, response time, residual risk and cost per choice. Avoid alert counts and tool names. Say what is covered, what is not, and what you need.

What does the board actually need to hear?

Directors are asked to oversee cyber risk, not run it. Customers and insurers ask similar questions, even of private companies.

So the board wants answers to four things. Are we watching? How fast do we act? What is not covered? What does it cost to change that?

How do you describe it in one minute?

Try this, with your own facts filled in: "We have a team, in house or from a provider, that monitors our systems during these hours. When something suspicious shows up, this person decides within this time whether to contain it. Outside those hours, this is what happens. Here is what we cannot see today."

Notice what is absent: product names, rule counts, acronyms. If you must use a term, define it once.

What do finance leaders want?

A CFO thinks in terms of cost, risk and options. Give three options with trade-offs. A constructed example, with invented figures left out on purpose: option A, build a daytime in-house team and accept overnight risk; option B, add a provider for nights; option C, a provider for everything with in-house decisions. For each, state hours covered, who decides, and the main risk. Put your own quotes next to each option.

Do not invent a return on investment. Security spend is risk reduction, and made-up percentages are easy to challenge.

Which measures belong in a board pack?

Pick few, stable ones:

• Coverage: hours and systems watched, and the gaps.
• Time to look: how long a high-severity alert waits before a human reviews it.
• Time to contain: for real incidents, how long until the spread was stopped.
• Exercises: when the team last rehearsed, using the plan structure in NIST SP 800-61 Rev. 3, and what was learned.
• Open decisions: choices you need from the board.

Avoid raw alert volume. A rise could mean more attacks, better tuning or a noisy rule.

How do you handle "are we secure?"

Do not answer yes. Say what you know and what you do not. The NIST Cybersecurity Framework 2.0 is a common reference for describing posture across functions, and a framework view lets you show strengths and gaps in a shared vocabulary. Use it as a map for the conversation, not a score.

What goes wrong in these meetings?

Teams over-explain tools, bury the ask, or give a single number that hides gaps. Another common failure is only reporting after an incident. A steady, short update every quarter builds trust you will need on the bad day.

What to do

1. Write the one-minute description and test it on someone outside security.
2. List hours and systems covered, and the gaps, in plain terms.
3. Prepare two or three options with real quotes and one recommendation.
4. Choose five measures and keep them the same each quarter.
5. State the decision you need, with a date.
6. Rehearse the incident handoff so directors know who calls them.

Quick check

Sources

• NIST SP 800-61 Rev. 3
• NIST Cybersecurity Framework

Last reviewed: 18 October 2026.