Run the monthly review as a decision meeting, not a presentation. Send the one page report beforehand, spend 30 minutes on exceptions, trends and asks, and end with a short list of decisions, each with an owner and a date. If no decision comes out of a metric, question the metric.
Before the meeting
Prepare a single page, sent at least a day ahead:
- The top five metrics with trend and threshold status.
- A list of what changed in definitions or scope since last time.
- The worst five open items past SLA.
- Open decisions from last month and their status.
Ask attendees to read it. If they do not, spend the first five minutes of the meeting reading it together, once, and then expect pre reads next time.
Suggested agenda
Minutes 0 to 5. Last month's actions. Done, not done, blocked. No explanations beyond one line.
Minutes 5 to 15. Exceptions. Only items outside thresholds. For each: cause, owner, plan, date.
Minutes 15 to 22. Trends. Net debt, coverage, age of oldest critical. Ask what changed and why.
Minutes 22 to 27. Data quality. Suppression age, reopen rate, scan failures. Is the data trustworthy?
Minutes 27 to 30. Decisions and asks. Resources, policy changes, risk acceptances. Record each.
Who attends
Keep it small: security lead, one or two engineering leads who own the biggest areas, and a delegate from platform or infrastructure. An executive sponsor can join quarterly instead of monthly.
Rules that keep it useful
- No new metrics introduced in the meeting. Propose them for next month with a definition card.
- No comparisons between teams. Compare each to its own history, in line with DORA's guidance against competing with other teams.
- Every exception needs a plan or a formal acceptance with an expiry.
- Decisions go in a log that anyone can read.
The decision log
A table with date, decision, owner, due date and status is enough. Review it at the start of the next meeting. A log gives you evidence of the program working, and it helps new members catch up quickly.
What a good outcome looks like
After three or four months you should see fewer surprises in the written report, shorter exception discussions, and a decision log that shows items moving from open to done. If the log is empty, the meeting is informational and could be an email. If it is full of items that never close, the meeting is raising problems without the authority to fix them, and the sponsor needs to remove blockers.
Also watch the mood. Teams that dread the review will start to manage the report rather than the risk. Keep the tone about plans and help, not about blame, and thank people for surfacing bad news early.
Quarterly variation
Once a quarter, spend the time on the metrics themselves: retire any that triggered no action, add one that the team needs, and check for signs of gaming. See Goodhart's law in security metrics.
Quick check
What if the meeting becomes a status update?
Cut the agenda to exceptions and decisions only, and move status into the written report.
How often should leadership see these?
Quarterly is typical, with a short note in between when something crosses a red line.
Sources
Last reviewed: 19 October 2026.
