Topics in this domain
- The Security Program: Charter, Scope and Objectives
- Security Team Structure, Roles and Staffing
- Working with Legal, HR, IT, Audit and the Business
- Program Implementation: From Plan to Operating Controls
- Information Asset Identification and Valuation
- Data Classification: Owners, Custodians and Users
- Data Lifecycle: Retention, Archiving and Secure Disposal
- Enterprise Architecture for Security Managers
- Information Security Architecture: Principles and SABSA
- Defence in Depth and Zero Trust
- Cloud Security and Shared Responsibility
- Control Frameworks: NIST SP 800-53, CIS Controls and ISO 27002
- Security Policy Development and Lifecycle
- Security Standards and Baseline Requirements
- Procedures, Guidelines and Acceptable Use
- Policy Enforcement, Exceptions and Review
- Designing Security Metrics: KPIs, KRIs and KCIs
- Collecting, Analysing and Reporting Metrics
- Security Maturity Models and Program Assessment
- Control Types and Categories
- Control Design and Selection Based on Risk and Cost
- Control Testing: Design vs Operating Effectiveness
- Identity and Access Management
- Network and Endpoint Security Controls
- Application Security and the Secure SDLC
- Configuration, Change and Patch Management
- Cryptography for Security Managers
- Security Testing: Scanning, Pen Testing and Tracking Remediation
- Security Awareness Program Design
- Role-Based Security Training
- Phishing Simulations and Social Engineering Defences
- Third-Party Risk Management and Due Diligence
- Vendor Contracts, SLAs and Right to Audit
- Fourth-Party and Supply Chain Risk
- Outsourcing and Managed Security Services
- Security Stakeholder Communication
- Executive Dashboards and Board Reporting
- Continuous Improvement of the Security Program
Executive Dashboards and Board Reporting
What leaders need
Directors and executives have limited time and many topics. From the security manager they need to know three things:
- Are we within our risk appetite?
- Is the program delivering what we approved?
- What do you need from us?
Everything else is supporting detail. Preparing and presenting reports on program activities, trends and overall effectiveness is a CISM task, and it overlaps with the risk reporting covered in Domain 2.
A one-page board view
| Section | Content |
|---|---|
| Risk posture | Top risks against appetite, trend arrows since last quarter, risks accepted above appetite |
| Program progress | Roadmap milestones on track or late, maturity against target in key areas, budget against plan |
| Events and asks | Significant incidents and lessons, regulatory and audit status, decisions needed from the board |
Effectiveness, not activity
| Activity (avoid at board level) | Effectiveness (use) |
|---|---|
| “2.3 million attacks blocked” | “Ransomware risk reduced from High to Medium” |
| “412 patches deployed” | “Critical exposure window down from 30 to 6 days” |
| “Training completed by 98%” | “Phishing report rate up from 15% to 60%” |
| “New SIEM installed” | “Time to detect intrusions down from weeks to hours” |
Design principles
- One page, with an appendix for detail.
- Trends: the direction since last time matters more than a snapshot.
- Honest colour: red where it’s red, with the plan to fix it. A dashboard of green lights gives false comfort.
- Clear asks: decisions or support needed, stated plainly.
Example. A CISO’s quarterly board paper is 30 pages of charts, and directors stop reading. The new version is one page: five risks against appetite with trend arrows, three roadmap items behind schedule with reasons, and one decision: approve funding for offline backups. It’s approved in ten minutes.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Most important content for the board | Risk against appetite, and decisions needed |
| Best way to show program effectiveness | Trends in outcomes against objectives |
| A board-level metric | A business-linked outcome, not a technical count |
| The program is behind plan | Report it honestly, with a recovery plan |
| Format for executives | A concise dashboard, with detail available |
In short
- Preparing and presenting reports on program activities, trends and overall effectiveness is a CISM task.
- Board and executive reporting focuses on risk posture against appetite, program progress, significant events and decisions needed.
- Dashboards show trends and status at a glance, with detail available underneath for those who want it.
- Report effectiveness (risk reduced, maturity improved, objectives met), not just activity.
- Be honest about problems and setbacks; credibility is the security manager's most valuable asset.
- Reports should end with clear asks: decisions, approvals or support needed.
Exam traps
- Technical metrics (blocked attacks, patches deployed) aren't board-level effectiveness measures.
- A dashboard of green lights with no trends or context gives false comfort.
- Reporting only good news erodes trust when problems surface.
- Too much detail buries the message; use one page plus appendix.
Slides
Click the slide and use the arrow keys. F toggles full screen.
A one-page board view
1 / 8