Module 08 · Lesson 04

The board wants answers, not data

Board members don't want 50 metrics. They want answers to four questions about your security posture. This presentation builds the dashboard that answers them.

Question 1

How exposed are we?

Metric
External attack surface score: Internet-facing services, unpatched critical vulns, exposed credentials, misconfigured cloud resources.
Trend
Arrow: improving or worsening? A single number is useless without direction. Show the 90-day trend.
Context
Peer benchmark: "Our exposure score is 72/100. Industry median is 65. We're above average but improving — down from 81 last quarter."
Question 2

How fast do we detect & respond?

MTTD
Time to detect
From compromise to detection. Industry average: 200+ days. Your target: under 24 hours for critical threats. Show the trend.
MTTR
Time to respond
From detection to containment. Target: under 4 hours for critical incidents. Show by severity level.

These two numbers tell the board more about your security effectiveness than any other metric. If MTTD is improving, your detection is getting better. If MTTR is improving, your response process works.

Question 3

Are we compliant?

Posture
Compliance by framework: ISO 27001: 94% controls passing. SOC 2: 91%. GDPR: 88%. Show as simple percentages with trend arrows.
Findings
Open audit findings: 3 high, 7 medium, 12 low. Average age: 45 days. Trend: down from 8 high last quarter.
Deadlines
Upcoming: NIS2 compliance due October 2024. SOC 2 audit scheduled March 2025. Board needs to know the timeline.
Question 4

What's the risk?

RiskRatingTrendStatus
Ransomware (critical systems)High→ StableBackup testing underway
Third-party data breachMedium↓ ImprovingTPRM program deployed
Insider threatMedium→ StableDLP monitoring active
Cloud misconfigurationLow↓ ImprovingCSPM deployed, auto-remediation
AI data leakage (shadow AI)High↑ NewAUP drafted, enforcement pending

Top 5 risks, trend arrows, action status. No surprises — board should never learn about a risk from the press.

Dashboard Design

The one-page format

Top left
Exposure score + trend
Single number, 90-day sparkline, peer comparison.
Top right
MTTD / MTTR
Two numbers, trend arrows, target indicators.
Bottom left
Compliance posture
Framework percentages, open findings count, next deadlines.
Bottom right
Top 5 risks
Risk name, rating, trend arrow, action status.

Everything on one page. If the CISO needs more than one page to communicate security posture, the message is unclear.

Key Takeaway

Four questions, one page

Remember this

1. How exposed are we? → Attack surface score + trend.

2. How fast do we detect? → MTTD + MTTR.

3. Are we compliant? → Framework percentages + findings.

4. What's the risk? → Top 5 risks + trends + actions.

The board doesn't need to understand security. They need to understand risk. Translate everything into risk language.

1 / 7