What the Board Should See Every Quarter

The Decision in Front of You

The board already spends time on technology. The decision is what form that time takes. Most companies give directors a briefing from the CIO or CISO a few times a year, built fresh for each meeting, often with screenshots from a security tool or a list of projects. The alternative is a fixed report: the same small set of measures every quarter, each with a target the board approved, an executive who owns it, and a trend line.

The stakes are now legal as well as operational. Since fiscal years ending on or after December 15, 2023, United States public companies must describe in Form 10-K how the board oversees risks from cybersecurity threats, which committee is responsible, and how it is informed about those risks ¹. Material incidents must be disclosed on Form 8-K, generally within four business days of the company deciding they are material ¹. Whatever the board receives becomes the evidence behind those statements.

Most large companies say they report regularly. EY's review of 80 Fortune 100 companies that filed by July 31, 2025 found that 99% included language about how often management reports to the board on cybersecurity, but only 60% gave a frequency of at least annual or quarterly; the rest used words such as "regularly" or "periodically" ². On AI, 48% cited AI risk as part of the board's risk oversight, while only 16% described management reporting to the board on AI ².

What's Happening

Directors are being asked to judge what they cannot measure

Gartner surveyed 330 non-executive directors between April 14 and May 22, 2025 ³. Ninety percent lacked a measure of confidence in the value of cybersecurity spending, and 10% expressed strong confidence that their company had the right balance of protection and cost ³. Gartner's advice was to report actual exposure and readiness instead of general threat trends and dashboards that confuse boards ³.

The National Association of Corporate Directors makes the same point in its 2026 Director's Handbook on Cyber-Risk Oversight. One of its six principles is that boards should guide cyber-risk measurement and reporting, with reporting that is structured, aligned with the business, and that translates technical metrics into financial terms ⁴.

The frameworks now name the board's job

NIST's Cybersecurity Framework 2.0, published in 2024, added a Govern function. It says organizational leadership is responsible and accountable for cybersecurity risk (GV.RR-01) and that the results of risk management are reviewed to adjust strategy (GV.OV-01 to GV.OV-03) ⁵. It also lists the controls the six measures below draw on: suppliers known and prioritized by criticality (GV.SC-04), backups created, protected, maintained and tested (PR.DS-11), and the integrity of backups verified before use in recovery (RC.RP-03) ⁵.

In the European Union, the Digital Operational Resilience Act, Regulation (EU) 2022/2554, has applied to banks, insurers, investment firms and other financial entities since January 17, 2025 ⁶. Article 5 says the management body bears ultimate responsibility for managing the firm's ICT risk ⁷. It must approve and periodically review the business continuity policy and the response and recovery plans, approve the policy on third-party ICT providers, and set up reporting channels that keep it informed about those arrangements and about major incidents ⁷. Members must keep their knowledge current through regular training ⁷.

Two cases show where the board's view and reality part

SEC disclosure cases, October 2024. The SEC settled charges against four technology companies that had been affected by the SolarWinds Orion compromise ⁸. Unisys paid $4 million after describing cyber risks as hypothetical when it had already suffered two intrusions involving data exfiltration ⁸. Avaya paid $1 million for describing access as limited to some email messages when it knew at least 145 files had also been accessed ⁸. Check Point and Mimecast paid $995,000 and $990,000 ⁸. The SEC's case against SolarWinds itself ended differently: a court dismissed most claims in July 2024, and the SEC dropped the rest with prejudice in November 2025 ⁹. The lesson for directors is the narrower one the four settlements share. What the company tells investors must match what management knows, and the board can only check that if it receives the facts in a consistent form.

Clorox and its service desk, 2023 attack, 2025 lawsuit. In July 2025 Clorox sued Cognizant, its IT service desk provider, for $380 million ¹⁰. Clorox alleges that on August 11, 2023 an attacker called the service desk, posed as an employee, and had passwords and multifactor authentication reset without the identity checks Clorox's procedures required ¹⁰. Clorox says it took systems offline, paused manufacturing and processed orders by hand for weeks ¹⁰. Cognizant disputes the claims and says it was hired for a narrow help desk scope ¹⁰. Whoever prevails, the case shows that a vendor with the power to reset credentials is a critical vendor. A board that tracks only spend by supplier would not have seen it.

Why the Usual Approach Fails

Board technology briefings are usually written for the meeting at hand. The presenter chooses what to show. A quarter with good news shows a maturity score; a quarter after an incident shows the incident. The measures change, so nothing can be compared across quarters, and directors fall back on judging the presenter.

Tool dashboards do not solve this. A vulnerability scanner reports thousands of findings, most never exploited. A count of blocked attacks says something about the internet and little about the company. These numbers rise and fall for reasons unrelated to the company's exposure, and directors cannot tell which movement matters.

A third problem is missing targets. A number without a target cannot be over or under. When a board sees "212 critical vulnerabilities," it has no way to know whether that is good, and the conversation turns to explanation instead of decision.

The Framework: The Six-Line Report

The Six-Line Report gives the board one page each quarter with six rows. Each row has a definition fixed for at least a year, a target the board approved, an executive owner, and the last four quarters of results. Management may add commentary. It may not change the definitions without board approval.

Restore tests passed. A backup that has not been restored is a claim. This row counts restores that worked, within the recovery time the business approved. Untested systems count as failures.

Exploited vulnerabilities on exposed systems. CISA's Known Exploited Vulnerabilities catalog lists flaws confirmed as attacked in the wild, 1,766 entries at the time of writing, and CISA recommends using it as an input to patching priority ¹¹. Restricting the count to internet-facing systems keeps the number small enough to reach zero.

Critical vendor concentration. This row counts dependencies, independent of spend. It includes the cloud region that runs every customer system, the payroll processor, and any service desk that can reset a password, as in the Clorox case ¹⁰.

Change failure rate. Google's DORA research program, the long-running DevOps Research and Assessment study, defines change fail rate as the share of deployments that need immediate intervention afterward ¹². In the author's experience it is the most useful single indicator of whether engineering changes are under control. The program warns against turning delivery metrics into mandated goals, because teams game them ¹², so the board sees the trend and a review threshold rather than a quota.

Recovery targets met. Recovery time and data-loss targets are business decisions the board should have approved. This row reports whether they held, in tests and in real events.

AI systems in production. The NIST AI Risk Management Framework, released in January 2023 ¹³, expects mechanisms to inventory AI systems, resourced according to risk (GOVERN 1.6) ¹⁴. The board needs the count, the owner of each system, and when each was last evaluated.

flowchart LR
    A[Fixed definition<br/>approved by board] --> B[Quarterly result<br/>with owner]
    B --> C[Compare to target<br/>and 4-quarter trend]
    C --> D[On target:<br/>noted, no discussion]
    C --> E[Missed:<br/>owner explains<br/>and proposes action]
    E --> F[Board decides<br/>fund, accept risk<br/>or change target]

The flow above is the point of the format. Measures on target take no meeting time. Measures that missed get the discussion, and the discussion ends in a recorded choice: fund a fix, accept the risk with a date to revisit, or change the target. That record is what a 10-K description of board oversight should rest on ¹.

Costs, Risks, and Tradeoffs

The report is cheap to produce once the data exists, and expensive when it does not. For many companies the first quarter shows blanks, such as tier-one systems never restore-tested or AI tools with no owner. Those blanks are findings.

The disclosure row deserves a direct answer. Some counsel prefer that boards receive less in writing. The October 2024 settlements were about statements that did not match what the companies knew ⁸. A board that receives the facts consistently is in a better position to keep public statements accurate.

How to Act

Questions to Ask Your Team

1. Which of our systems are tier one, and when was each last restored from backup in a test?
2. How many flaws on CISA's exploited list are open on our internet-facing systems today, and how old is the oldest?
3. Which vendors could stop a critical business function on their own, and which can reset our employees' credentials?
4. What share of our production changes needed a rollback or emergency fix last quarter, and is that rising?
5. Did we meet our approved recovery times in every test and incident this year?
6. How many AI systems and agents do we run in production, and who owns each one?
7. Does what we wrote in our last 10-K about board oversight match what the board actually receives?

Closing

Directors are accountable for technology risk in disclosure and, for EU financial firms, in regulation. They cannot oversee what changes form every meeting. Approve six measures, give each an owner and a target, and receive them every quarter with a year of history. Spend the meeting on the rows that missed, and record what the board decided.