A board report can be accurate and still leave leaders unsure what to do next. Lists of vulnerabilities, completed training and open audit findings describe activity. A useful executive discussion also needs the business consequence, the decision required and someone accountable for the next step.
NIST’s October 22, 2026 initial public draft of SP 800-221 Revision 1 provides a timely reason to revisit that connection. Its emphasis is integrating information and communications technology risk with enterprise risk management, including alignment with the Cybersecurity Framework 2.0 Govern function. The draft discusses presenting risk in terms executives can compare with other business priorities. Comments are due December 7, 2026.
This is proposed guidance, not a finalized revision or a new universal compliance requirement. The practical recommendations below are my interpretation of how leaders can use the discussion to improve their reporting now.
Lead with the decision
Before adding another chart to a board presentation, I would ask one question: what decision should this information support?
A report might seek approval for recovery investment, acceptance of a temporary exposure, agreement on an AI deployment boundary or a change in a vendor relationship. Each calls for different evidence. A chart without a clear purpose can consume meeting time while leaving the underlying decision untouched.
Try writing the decision request before building the slide. Include the options, the recommendation, who must decide and when delay becomes consequential.
Translate exposure into a business scenario
Consider a fictional organization introducing an AI assistant that can search internal documents and initiate workflow requests. A technical report might focus on access permissions and testing results. An executive report should also explain what could happen if the assistant retrieves restricted information or initiates an inappropriate action.
The decision may be whether to limit the pilot to read-only access, require human approval for consequential actions or delay expansion until additional tests are complete. The scenario makes the control discussion understandable without implying that every AI use case has the same risk.
Keep estimates honest. If the potential impact is uncertain, state the assumptions and what evidence would narrow the uncertainty. A precise-looking number unsupported by data does not improve a decision.
Give ownership a name and a date
My recommended reporting format pairs each significant risk with a business owner and a security or technology partner. The business owner helps define acceptable consequences; the technical team explains the exposure and available controls.
A useful entry answers these questions:
- Which business service or objective is affected?
- What event could disrupt it, and what would the consequence be?
- Which controls are operating, and what evidence supports that assessment?
- What decision or action is required?
- Who owns that action, and when will leadership revisit it?
This is also a practical way to distinguish a risk accepted deliberately from one that simply remains unresolved.
Connect risks that share a dependency
Separate reports for cybersecurity, AI, suppliers and operational resilience can describe the same underlying dependency from different angles. I would look for those connections before asking executives to prioritize spending.
For example, a critical hosted platform might support customer service, an AI workflow and recovery operations. Three independent risk entries could obscure the concentration. They could also lead to double counting if each assumes the same outage as a separate event.
Use a shared scenario discussion to identify the dependency, then retain the technical detail where teams need it. The executive view should explain the combined decision without suggesting that unrelated risks can simply be added together.
Improve one reporting cycle first
A wholesale reporting redesign is rarely the best starting point. Select three material scenarios for the next leadership meeting. Rework each around the business consequence, available choices, evidence and owner. Ask the recipients whether the revised report helped them make a decision.
For established teams, this can be a focused improvement initiative. For organizations without dedicated security leadership, it can form part of a broader program assessment or fractional CISO engagement.
The outcome to aim for is a clearer record of what leadership decided, why it decided it and what will demonstrate progress.
Explore Fractional CISO services or email Brian to discuss your reporting needs. Fractional CISO and advisory engagements are scoped through Legion Cyberworks.