A 60-slide deck with 200 security metrics is not a board report. It only distracts. Management and the supervisory board need 5 clear points that drive decisions. Here they are.
The Five Core Points Every Cyber Board Report Should Make
1. How Mature Are We Compared to Our Industry?
Show maturity based on BSI IT-Grundschutz or ISO 27001 (level 1–5) plus an industry benchmark. One number, a few words: "We're at level 3 (of 5), the industry median is 3.5, the top quartile is 4." The supervisory board gets the picture in 10 seconds.
2. What Residual Risk Does the Company Carry Right Now?
List the top 10 risks from the risk register, with likelihood, impact and current treatment status. Mark risks that were formally accepted. Name the reason and the person who accepted each one.
3. What Incidents Did We Have, and What Did We Learn?
Cover the last 90 days:
- number of reported incidents
- number rated as "significant"
- average time to detect and time to recover
- top 3 lessons learned
Add a trend arrow compared to the previous quarter.
4. Where Do We Stand on Regulatory Duties?
Show NIS-2 compliance status, ISO 27001 audit status (internal and external), GDPR incidents over 12 months and open letters with regulators. One traffic light per duty is enough.
5. What Do We Need to Invest In, and Why?
Name the top 3 investment proposals and tie each one to a risk reduction: "Investment X (€Y) cuts risk Z by an estimated 70 %." The supervisory board decides on this basis. It does not decide on "we'd like more budget".
Five Reporting Mistakes to Avoid
- Tool-specific metrics: "We had 12,000 EDR detections this month." The board asks what that means, and you lose its attention.
- Compliance check marks without substance: "ISO 27001 compliant" without a maturity level says nothing about your real security posture.
- Heatmaps without numbers behind them: colored boxes, but nobody knows how high "red" really is.
- Strategic wishes without a risk anchor: "We want to introduce XDR." But how much risk does that actually remove?
- Bad numbers without context: "38 % click rate in the latest phishing test" only makes sense if people know it was 52 % before and the industry median is 33 %.
How Often and in What Format
- Supervisory board / advisory board: every quarter, 5–8 slides, 30 minutes of discussion.
- Management: every month, a 1-page dashboard with drill-down.
- Incident reports: within 24 h of any significant incident. Cover what happened, when, what it means and what you are doing.
How an Integrated Platform Supports Board Reporting
The five core points should come straight from the platform, not from Excel roll-ups:
- Maturity score: from the ISMS module, calculated in line with ISO/BSI.
- Top 10 risks: from risk management, with treatment status.
- Incident history + KPIs: from Wazuh SIEM + audit log, with MTTR/MTTD calculated automatically.
- Compliance status: from the multi-framework module, with NIS-2/ISO 27001/GDPR as a live traffic light.
- Investment proposals with a risk anchor: from the treatment workflow, "untreated risk X" ↔ "control Y".
What Management Should Tell the Supervisory Board in Person
- "Our maturity is X, and we're heading to Y by [date]."
- "Our highest residual risk is Z. We accept it because…"
- "This quarter we had A incidents, B of them significant. The lesson was C."
- "Compliance status is [green/yellow/red]. Open items are D."
- "I need the budget for E because it lowers risk F."
If you can say these five sentences clearly and back them with evidence in 90 seconds, your reporting works. Everything else is theater.
Compliance Mapping
- NIS-2 Art. 20: management bodies must approve and oversee security measures. Reporting makes that possible.
- ISO 27001 Cl. 9.3: the management review is a formal part of the standard and runs at least once a year.
- DCGK 4.1.4 / 4.1.5 (German listed companies): the board ensures proper risk management and reports on it.
Conclusion
Cyber board reporting is not about more slides. It is a focused answer to 5 questions. An integrated platform delivers the data, so management can back each point with evidence. No more 3 days of building slides. If you get this right, you earn the trust of the supervisory board, and with it room to invest.