A board pack is where security turns into decisions. Here you are the CISO's deputy preparing the risk committee pack for a fictional company: telling key risk indicators from performance and control indicators and from vanity counts, reading a draft report the way a non-executive director will, checking indicator values against the board's stated risk appetite and tolerances, and deciding what the board itself should be asked to decide - as opposed to what management should simply get on with.
The security team has sent ten candidate metrics for the quarterly risk committee pack. Sort each into a key risk indicator, a key performance indicator, a key control indicator or a vanity count, tag it leading or lagging, then answer a CEO who wants the headline slide to lead with blocked attacks.
The draft quarterly cyber report reads well until a non-executive director asks 'compared with what?'. Click the lines that would not survive the committee: unexplained jargon, a red-amber-green rating with no thresholds, a trend with no baseline, a risk with no owner or decision, and a coverage figure that improved only because its denominator changed.
The board has approved a cyber risk appetite statement with an appetite level and a hard tolerance for each key risk indicator. Place eight current KRI values within appetite, outside appetite but within tolerance, or in breach of tolerance, then choose which proposed responses respect the framework.
A recovery capability gap now breaches tolerance and fixing it costs more than management can approve. Sort who owns each decision under the three lines model - governing body, first, second or third line - then frame the one ask that actually belongs in front of the board.