Most boards review application security quarterly, with a separate path for urgent events that cannot wait. There is no single mandated frequency for private companies. Public companies in the US must describe board oversight of cyber risk in their annual report, which makes a regular rhythm easy to defend.
What the SEC rules say
The SEC's 2023 cybersecurity disclosure rules require public companies to describe, in the annual Form 10-K, how they assess, identify and manage material cybersecurity risks, and to explain the board's oversight of those risks along with management's role and expertise. Material incidents are reported on Form 8-K, generally within four business days of determining materiality. Foreign private issuers have comparable forms.
Notice what is and is not specified. The rules ask for a description of oversight. They do not set a meeting frequency. Your cadence is your own, but you need to be able to describe it truthfully.
A sensible rhythm
| Forum | Frequency | Content |
|---|---|---|
| Board or risk committee | Quarterly | Five to seven metrics, trend, top risks, decisions |
| Executive staff | Monthly | Operational view, exceptions, resourcing |
| Engineering leads | Weekly | Overdue and new items |
| Escalation | As needed | Material incident or active exploitation of your product |
What a quarterly board slide holds
- Exposure trend for critical and known exploited findings.
- Remediation performance against stated targets, with counts.
- Accepted risks above a threshold, with approver and expiry.
- Coverage of assets and repositories.
- One or two items needing a board level decision.
Keep a stable set of measures from quarter to quarter. Boards learn to read a chart the second time they see it.
Define the escalation trigger
Decide in advance what interrupts the cycle. Examples: active exploitation affecting your product, a confirmed customer data exposure, or a regulator inquiry. Write the trigger down and name who calls the chair.
Common mistakes
- Reporting only when something goes wrong, which makes every update alarming.
- Presenting raw counts with no trend or target.
- Changing metrics each quarter, which prevents comparison.
This post is general information, not legal advice. Check your own obligations with counsel.
Quick check
Is quarterly board reporting legally required?
Not as a fixed frequency. Public companies must describe board oversight in annual filings, so a documented rhythm helps.
What should trigger an off-cycle report?
Pre-agreed events such as active exploitation of your product or a confirmed data exposure.
Safeguard supports reporting with compliance and evidence automation, and you can run a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
