What Your Board Should See on Cyber and Technology Risk Each Quarter

Each quarter, a board should see a short, plain-language picture of the company's most significant technology and cyber risks, whether they are getting better or worse, and what management is asking the board to decide. It should not see a wall of technical metrics. The test of a good board report is simple: could a director explain the company's top risks and its plan to a shareholder, lender, or regulator after reading it?

Why Most Board Cyber Reports Miss the Mark

Many boards receive one of two kinds of report. The first is a slide of green status lights that says everything is fine until the day it is not. The second is a dense dashboard of patch counts, blocked attacks, and phishing click rates that tells directors a lot about activity and very little about risk.

Neither helps a board do its job. Board oversight of technology risk means directors understand the exposures that could materially harm the business, confirm management has a credible plan, and hold management accountable for progress. Reporting should be built around that purpose.

The Five Things Every Quarterly Report Should Include

• The top risks, ranked by business impact. Five to seven risks described in business terms, such as "a ransomware event could stop order processing for a week," not a raw count of patched laptops or blocked emails. Each should have an owner and a trend arrow.
• Changes since last quarter. New risks, risks that grew, and risks that were reduced, with a sentence on why.
• Progress on the plan. The handful of initiatives the board approved or funded, whether they are on track, and what is blocking them.
• Incidents and near misses. What happened, what it cost or could have cost, and what changed as a result. A quarter with no incidents reported is worth questioning, not celebrating.
• Decisions or awareness requested. Budget, risk acceptance, policy approval, or a heads-up on something coming. Every report should be clear about what management needs from the board.

Metrics That Actually Mean Something

A small number of well-chosen measures, tracked over time, tell a board more than dozens of snapshots. Useful examples include:

• Time to detect and contain the most serious incidents.
• Whether critical systems can be restored from backup within the time the business needs, and when that was last tested.
• Coverage of multifactor authentication for remote access, email, and privileged accounts.
• The number of critical vulnerabilities older than the company's own policy allows.
• The share of critical vendors assessed for security in the past year.
• Status of technology that is past vendor support and still running important work.

Each metric should come with a target and a sentence explaining what it means for the business. If management cannot say why a number matters, it does not belong in front of the board.

A board report should answer three questions: what could hurt us, are we getting safer, and what do you need from us.

Technology Risk Beyond Cyber

Cyber gets the attention, but boards should also see the technology risks that quietly limit growth: aging core systems that cannot support new products, dependence on a single vendor or a single employee, stalled major programs, and the governance of AI tools staff are already using. A useful framing is to ask whether the company's technology can support the strategy the board approved. If the answer is "not without major investment," the board should know that before it becomes urgent.

Frameworks help structure the conversation. NIST CSF 2.0, published in 2024, added a Govern function that puts cybersecurity strategy, roles, and oversight on the same level as protection and response, which maps well to how boards think.

A Note for Banks, Credit Unions, and Public Companies

For regulated financial institutions, board oversight is an expectation, not a preference. Federal banking agencies and the NCUA expect boards to approve the information security program and receive regular reporting on it, and examiners routinely look at board minutes and materials to see whether directors are engaged. The specifics vary by charter and regulator, so management should confirm what its own examiners expect.

Public companies face a related expectation. SEC rules adopted in 2023 require annual disclosure of how the company manages cybersecurity risk and how the board oversees it, along with prompt disclosure of material incidents. A board that receives clear quarterly reporting is in a much better position to stand behind those disclosures.

How to Get There

• Agree with management on the top risks first, then build the report around them.
• Keep the core report to a few pages, with detail in an appendix.
• Use the same format every quarter so trends are visible.
• Give at least one director, or a committee, time to go deeper once or twice a year.
• Bring in an independent view periodically to test whether management's picture holds up.

The Bottom Line

A board does not need to understand firewalls. It needs a consistent, plain-language view of the technology and cyber risks that could materially harm the business, evidence that those risks are moving in the right direction, and a clear ask from management. If your current reporting does not deliver that in a few pages, it is time to change the format, not add more slides.

If you want an independent read on what your board is seeing, talk with us.