How to report cyber risk to your board

This guide is for CISOs and security leaders who report to boards, and for directors who want better reporting. It explains what boards need from cyber risk reporting, how to structure a report, which measures help and which do not, and how to align reporting with UK government guidance for boards.

Two references anchor the approach. The UK government's Cyber Governance Code of Practice, published on 8 April 2025 by DCMS, DSIT and the NCSC, sets out the actions boards and directors should take to govern cyber risk. The NCSC's Cyber Security Toolkit for Boards helps boards put the Code into action.

#What does the board actually need to know about cyber risk?

The board needs to know which critical services and information are at risk, how exposed they are compared with the agreed risk appetite, whether that position is improving and what decisions or resources are needed. It does not need raw technical data. Good reporting turns security activity into business impact, trends and clear requests.

The Code sets out actions for boards across risk management, strategy, people, incident planning and assurance. Reporting is the main way the board gets the information it needs to carry out those actions, so build your reporting around the questions the board must be able to answer.

• What are our most critical technology, information and services, and are they protected in line with our risk appetite?
• What are our biggest cyber risks, who owns them and what is changing?
• Are we delivering the cyber strategy we agreed, and is it achieving what we intended?
• How ready are we to respond to and recover from a serious incident?
• What do our suppliers and partners expose us to?
• What do you need from us?

#What does the Cyber Governance Code of Practice expect from boards?

The Code sets out actions under five principles: risk management; strategy; people; incident planning, response and recovery; and assurance and oversight. For reporting, it asks boards to require formal reporting at least quarterly, set suitable metrics, agree tolerances aligned with strategy and risk appetite, and maintain regular two-way dialogue with senior executives, including the CISO.

The Code is designed for the boards and directors of medium and large organisations in both the public and private sectors. Smaller organisations are encouraged to apply its principles. It is not aimed at the people running day-to-day cyber security, but it is a useful way to explain to them what the board is responsible for.

Each principle suggests content for your reporting:

• A. Risk management: critical technology, information and services identified and prioritised, senior ownership of cyber risks, a defined risk appetite, proportionate supplier assessment and regular risk assessments.
• B. Strategy: a cyber strategy aligned with the organisation's strategy and risk appetite, resourced effectively and delivering its intended outcomes.
• C. People: a positive security culture, clear supporting policies, board cyber literacy and an effective training and awareness programme measured with suitable metrics.
• D. Incident planning, response and recovery: a plan exercised at least annually with internal and external stakeholders, clear board responsibilities during incidents and post-incident reviews.
• E. Assurance and oversight: a clear governance structure, formal reporting at least quarterly, two-way dialogue with executives and integration with internal and external audit.

#How should a board cyber report be structured?

Structure a board cyber report around decisions and risk, not activity. Start with a one-page summary of the overall position against risk appetite and any decisions required. Follow with the top risks and their trend, strategy delivery, incident readiness, supplier exposure and assurance findings. Keep technical detail in an appendix for those who want it.

1. Summary and requests: overall position, what has changed since the last report and any decisions or resources needed.
2. Top cyber risks: each with an owner, current rating, trend and link to the enterprise risk register.
3. Key risk indicators: a small, stable set of measures, each with an agreed tolerance.
4. Strategy delivery: progress on major programmes against plan.
5. Incidents and near misses: what happened, the impact and the lessons learned.
6. Readiness: date and outcome of the last incident exercise and recovery test.
7. Suppliers: material supplier risks and any supplier incidents.
8. Assurance: audit findings, certifications and results of independent testing.

Keep the format consistent from one report to the next. When the same measures appear in the same place each time, the board can see trends and changes at a glance.

#Which cyber metrics are useful for boards?

Useful board metrics show the exposure and resilience of critical services, and each has an agreed tolerance. Examples include how quickly critical vulnerabilities are fixed, MFA coverage on important systems, the date of the last successful recovery test and progress on high-risk findings. Avoid volume counts that rise and fall without telling the board anything useful.

• Time taken to apply critical security updates on internet-facing systems, against target.
• Coverage of multi-factor authentication on email, remote access, cloud services and administrator accounts.
• Date and result of the last restore test for each critical service.
• High-risk audit or test findings still open past their agreed deadline.
• Critical suppliers assessed within the agreed review period.
• Progress against the incident exercise programme, and actions arising.

#Measures to avoid or explain carefully

• Raw counts of blocked attacks or emails, which reflect attacker activity more than your resilience.
• Training completion alone, without any sign of changed behaviour or better reporting.
• Traffic-light ratings shown without the underlying measure or trend.
• Measures whose definition changes from one report to the next.

#How do you talk about cyber risk in business terms?

Talk about cyber risk in terms of the services, revenue, obligations and reputation it threatens, rather than the technology involved. Describe scenarios the board will recognise, such as losing a core system for a week or a key supplier outage, and explain likelihood, impact, current controls and the choices available. Plain language builds trust and better decisions.

The NCSC's Board Toolkit is designed to support exactly this conversation. It is organised around the Code's principles and includes modules on identifying critical assets, managing cyber risk, working with supply chains, developing a positive security culture, planning for incidents and understanding the threat. It also offers briefing packs, a discussion script for board meetings and questions boards can use to evaluate their organisation.

• Use scenarios: if the finance system were unavailable for a week, could we pay suppliers and staff?
• Link each risk to the enterprise risk register and to a named executive owner.
• Present options with their trade-offs, rather than a single request.
• Be candid about uncertainty and what is not yet known.
• Explain acronyms once, or avoid them altogether.

#How should the board be involved in incident readiness?

The board should confirm that a plan exists to respond to and recover from cyber incidents, that it is exercised at least annually with relevant internal and external stakeholders, and that lessons feed back into plans and risk assessments. During an incident, directors take responsibility for their regulatory duties, such as reporting, and support critical decisions and external communications.

Include board members in some exercises, particularly scenarios that involve difficult decisions such as taking services offline or responding to extortion. The NCSC's guidance on disruptive cyber attacks is written for executive leaders and boards as well as security teams, and covers recovering from, preparing for and reducing the risk of attacks that disrupt critical systems.

#What to do next

Next, compare your current board report with the Cyber Governance Code's actions and the questions in the NCSC Board Toolkit, and note the gaps. Agree a small set of metrics and tolerances with the board, confirm formal reporting happens at least quarterly and schedule an incident exercise that includes directors.

1. Map your current report to the Code's five principles and note any gaps.
2. Agree risk appetite statements and tolerances for your key measures.
3. Draft a one-page summary template and test it with the chair or the audit committee chair.
4. Schedule the next incident exercise with board participation.
5. Point directors to the NCSC Board Toolkit and its training and briefing resources.

#Frequently asked questions