Lesson 6.16: Capstone: the annual cyber risk report to the board
Once a year the board must understand Northwind's cyber risk well enough to make decisions and, increasingly, to answer for them under rules such as NIS2 and the SEC's disclosure requirements. The report has to fit on a page: where the company stands against its appetite, which risks drive the tail, which early-warning indicators are red, which regulatory deadlines are at risk, and what the board must decide. In the lab you assemble that page from the year's work and write the decisions requested.
30 min
You will learn to
- Rank risks by their tail, not only the mean
- Report appetite status
- Select breached KRIs
- List regulatory deadlines at risk
- Write clear decisions requested
← Notification across jurisdictions · All lessons · Changing users: su and sudo →