Lesson 6.22: Capstone: the quarterly security report to the board
Under NIS2 and most governance codes, the board is accountable for cybersecurity, so it needs a report it can act on: not tool output, but risks, gaps, people, incidents and decisions. In the lab you build Northwind's quarterly report from the work in this course: the top risks from the register, the framework gaps from CSF and ISO, policy deviations and awareness results, the incident and disclosure under way with their deadlines, and the decisions you need from the board. Then you seal it.
22 min
You will learn to
- Explain the board's accountability
- Summarise risks and gaps in business terms
- Report people and incident metrics
- Ask for clear decisions
- Seal the report
Key terms
- Accountability
- Being answerable for outcomes; NIS2 makes management bodies accountable for cybersecurity measures.
- KRI / KPI
- Key risk indicators (how exposed we are) and key performance indicators (how well controls work).
- Risk appetite statement
- The board's statement of how much risk it accepts.
- Decision request
- A specific question for the board with options, cost and recommendation.
- Trend
- The change since the last report; often more useful than a single value.
← White, black and grey hats: what makes hacking ethical · All lessons · Capstone: security due diligence for an acquisition →