Talk to the board about cyber risk in business terms: what could stop revenue, how likely it is, what you are doing about it, and what decision you need from them. Bring two or three trend numbers, not tool statistics, and end with a specific ask. Board members are accountable for the risk, so help them govern it.
What do boards actually need from you?
The UK National Cyber Security Centre publishes a Cyber Security Toolkit for Boards, organized around the government's Cyber Governance Code of Practice. Its premise is that board members have "a critical role" in making organizations resilient, and it includes a set of questions boards can ask to judge their organization's performance. The NCSC also published guidance for CISOs on how to talk to board members.
NIST made a similar point structurally. CSF 2.0 added a Govern function covering strategy, roles, policy and oversight, and describes outcomes any organization can use to "understand, assess, prioritize, and communicate" its cybersecurity efforts. Communication is part of the job description.
Which words lose the room?
Acronyms, tool names and counts. "We blocked 4 million events" tells a director nothing. Replace volume with consequence: "An attacker who stole one administrator login could reach the customer billing system. We closed that path in September and tested it."
What does a good board update contain?
Keep it to one page, with the same four parts each time so trends are visible.
- Top risks in plain language, three at most, each with the business effect.
- Movement since last time, with two or three consistent measures, such as how many days it takes to patch exploited vulnerabilities on internet facing systems.
- Incidents and near misses, with what you learned.
- One decision or approval needed, such as funding, risk acceptance or policy sign off.
Consistency matters more than polish. Directors learn to read a familiar page quickly.
How do you handle uncertainty?
Say what you know and what you do not. Give ranges. If a risk cannot be quantified, describe a plausible scenario and the control that interrupts it. Do not invent statistics. A calm "we do not know, here is how we will find out by next quarter" builds trust faster than false precision.
What if the board asks for a guarantee?
They will, sooner or later. Do not promise that nothing will happen. Explain that the goal is to reduce the chance and the size of a loss, show which controls do that, and be clear about residual risk. If leadership chooses to accept a risk, write the decision down with a name and a review date. That protects them and you, and it turns a vague worry into a managed item.
A constructed example
A CISO has ten minutes with the board. She opens with one sentence: the company's biggest exposure is a supplier with administrator access to production. She shows that access was reviewed last quarter, two accounts were removed, and one supplier refuses multifactor authentication. Her ask is for the board to support a contract change that makes it mandatory, accepting the risk of losing that supplier. The discussion is short because the decision is clear.
How to check or apply this
- Read the NCSC board toolkit's questions and answer each one for your organization.
- Pick two or three measures and report them in the same form every quarter.
- Write each risk as a sentence a non specialist could repeat.
- End every update with one explicit ask, or state that none is needed.
- Invite a director to a tabletop exercise so incident decisions are not new to them.
- Send the page a few days ahead, and expect questions, not applause.
Safeguard's compliance automation can supply the technical evidence behind such measures, but the story and the ask must come from you.
Quick check
How long should a board cyber update be?
One page, plus time for questions. Use the same four parts each time so changes are easy to spot.
Should I show technical metrics?
Show few, and tie each to a business effect. Directors need to decide, not audit your tooling.
Sources
Last reviewed: 18 October 2026.
