A 60-slide PowerPoint with 200 security metrics is not a board report – it's distraction material. Management and supervisory board need 5 statements that drive decisions. Here they are.
The Five Core Statements Every Cyber Board Reporting Should Deliver
1. How Mature Are We – Compared to the Industry?
Maturity per BSI IT-Grundschutz or ISO 27001 (level 1–5) plus industry benchmark. One number, four words: "We're at level 3 (of 5), industry median is 3.5, top quartile is 4." The supervisory board grasps the situation in 10 seconds.
2. What Residual Risk Is the Company Currently Carrying?
Top-10 risks from the risk register, with probability, impact, and current treatment status. Risks formally accepted clearly marked – with justification and acceptor.
3. What Incidents Did We Have, What Did We Learn?
Last 90 days: number of reported incidents, number classified as "significant", average detection time and recovery time, top-3 lessons learned. Trend arrow vs. previous quarter.
4. How Are the Regulatory Obligations?
NIS-2 compliance status, ISO 27001 audit status (internal/external), 12-month GDPR incidents, open regulator correspondence. One traffic light per obligation suffices.
5. Which Investments Do We Need – With Justification?
Top-3 investment proposals with risk reduction argument: "Investment X (€Y) reduces risk Z by an estimated 70 %." The supervisory board decides on this basis – not on the basis of "we'd like more budget".
The Five Reporting Anti-Patterns
- Tool-specific metrics: "We have 12,000 EDR detections this month." Supervisory board: what does that mean? Loss of attention.
- Compliance check marks without substance: "ISO 27001 compliant" without maturity statement – says nothing about actual security posture.
- Heatmap without number basis: colored boxes, but "how high is red?" stays unclear.
- Strategic wishes without risk anchor: "We want to introduce XDR" – but what risk reduction does that concretely deliver?
- Negative numbers without context: "38 % click rate in the latest phishing simulation" is only interpretable when it's clear: was 52 % before, industry median 33 %.
Reporting Cadence and Format
- Supervisory board / advisory board: quarterly, 5–8 slides, 30 minutes discussion.
- Management: monthly, 1-page dashboard with drill-down.
- Incident reporting: event-based within 24 h for significant incidents, with "what, when, what it means, what we're doing".
How an Integrated Platform Carries the Board Reporting
The five core statements should come directly from the platform, not from Excel aggregation:
- Maturity score: from the ISMS module, ISO/BSI-compliant computed.
- Risk register top-10: from risk management, with treatment status.
- Incident history + KPIs: from Wazuh SIEM + audit log, MTTR/MTTD automatic.
- Compliance status: from the multi-framework module, NIS-2/ISO 27001/GDPR as live traffic light.
- Investment proposals with risk anchor: from the treatment workflow, "untreated risk X" ↔ "control Y".
What Management Should Personally Tell the Supervisory Board
- "Our maturity is X, we're heading to Y by [date]."
- "Our highest residual risk is Z – we accept it because…"
- "This quarter we had A incidents, B of them significant – the lesson was C."
- "Compliance status is [green/yellow/red] – open items are D."
- "I need the budget for E because risk F decreases as a result."
Anyone who can say these five sentences clearly with evidence in 90 seconds has effective reporting. Everything else is theater.
Compliance Mapping
- NIS-2 Art. 20: management bodies must exercise approval and supervision functions – reporting is the prerequisite.
- ISO 27001 Cl. 9.3: management review as a formal building block – at least annually.
- DCGK 4.1.4 / 4.1.5 (German listed companies): board ensures appropriate risk management and reports on it.
Conclusion
Cyber board reporting isn't "more slides" – it's a very focused answer to 5 questions. An integrated platform delivers the data so management can substantiate the statements with evidence, without 3 days of PowerPoint building. Anyone who pulls this off gains trust on the supervisory board – and therefore investment headroom.