A board paper on cyber security is usually written by someone who understands the subject for people who do not, which sounds like a translation problem and is really a purpose problem. The paper describes what the security function has been doing. The board is trying to decide something. Those are not the same document.
The Three Decisions
Strip away the format and a board is asking three questions about cyber risk, in order. What could plausibly happen to us, and how badly would it hurt? Are we doing enough about it, given what it costs? And is anything getting worse in a way we should act on now rather than next quarter?
Almost none of that is answered by a slide of control counts, patch percentages or a heat map with no explanation of what moved it. Those describe effort. A board is accountable for exposure, and the two are related only loosely.
What to Report Instead
The exposure, in business terms: which services, obligations or revenue lines are affected if a specific scenario occurs — not a list of vulnerabilities.
Decisions taken, and by whom: risks accepted since the last meeting, who accepted them and on what basis. This is the record that matters after an incident.
Direction of travel: what has improved and what has degraded since the last report, with the reason. A stable number with no explanation is not reassurance.
What is blocked: the small number of things the board can actually unblock — funding, a supplier decision, a business-side owner who has not been appointed.
Regulatory position: which obligations apply, where the organization stands against them, and what changes are coming.
“If a report does not end with something the board can decide, it is a status update wearing a board paper's clothes.”
The Uncomfortable Part
Reporting this way makes accepted risk visible, which is precisely why it is often avoided. A heat map absorbs bad news; a written acceptance with a name against it does not. But the alternative is worse: after an incident, the first question asked is what the board knew and when, and a year of activity reports is a poor answer to it.
The practical fix is usually structural rather than editorial. Reporting improves when someone with a governance remit — rather than the person running the security tooling — owns the standing report, because that person's job is the decision, not the defence of the work.
