<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-security-board-reporting
description: >-
  Create security reports for board of directors including risk
  translation, business impact framing, visual dashboards, and
  regulatory compliance status updates.
domain: cybersecurity
subdomain: security-leadership
tags:
  - board-reporting
  - executive-communication
  - risk-translation
  - compliance-reporting
  - business-alignment
  - stakeholder-management
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Performing Security Board Reporting

## Overview

Board reporting transforms technical security posture into business
risk language directors can act on. Covers report structure, risk
quantification, visual communication, and peer benchmarking.

## Prerequisites

| Requirement | Purpose |
|---|---|
| Risk quantification | FAIR framework for financial risk estimation |
| Metrics program | Established KPIs/KRIs with history |
| Regulatory mapping | Compliance obligations and status |

## Key Concepts

### Board Report Structure

```python
board_report = {
    "executive_summary": "Overall risk posture and top 3 items",
    "risk_dashboard": {"overall_risk": "MEDIUM", "trend": "IMPROVING"},
    "key_metrics": {"mttd_hours": 18, "mttr_hours": 3.2, "incidents": 12},
    "investment_summary": {"budget_utilized": "87%", "roi": "2.3x"},
    "ask": "Approve $200K for cloud security — reduces risk by 40%",
}
```

## Workflow

1. **Gather metrics** — Collect KPI/KRI data for reporting period
2. **Quantify risk** — Translate findings to financial impact
3. **Frame for audience** — Business impact, not technical jargon
4. **Build visuals** — Traffic-light dashboards, trend charts
5. **Draft narrative** — Executive summary with risk trajectory
6. **Include the ask** — Specific budget or decision request
7. **Rehearse delivery** — Prepare for board questions

## Verification

| Check | Method |
|---|---|
| Workflow completed | All steps executed and documented |
| Output validated | Results match expected format and content |
| Quality assured | Peer review or automated validation passed |

## References

- [NIST Cybersecurity Framework](https://www.nist.gov/cyberframework)
- [MITRE ATT&CK](https://attack.mitre.org/)
