Which of the following would be the MOST effective way to present quarterly reports to the board on the status of the information security program?

An information security dashboard is the most effective method for presenting quarterly program status to a board of directors. Dashboards are designed to consolidate complex data from various sources (such as KPIs and risk registers) into a high-level, graphical, and easily understandable format. This allows board members, who are a strategic and often non-technical audience, to quickly assess the overall health of the security program, identify trends, and understand the risk posture in relation to business objectives. The visual nature of a dashboard (e.g., using scorecards or traffic-light indicators) facilitates efficient communication and supports informed governance and decision-making.

A. A capability and maturity assessment is a detailed, point-in-time analysis typically performed annually, making it too infrequent and granular for a regular quarterly board update.

B. Detailed analysis of security program KPIs is too operational and technical for a board-level audience, which requires a strategic summary rather than in-depth data.

D. An information security risk register is a comprehensive, operational tool. Presenting the entire register would be overwhelming and ineffective for strategic oversight by the board.

---

1. ISACA

CISM Review Manual

16th Edition. Chapter 1

Section 1.3.4

"Information Security Metrics." The manual states

"Dashboards and scorecards are common tools for reporting metrics to management. They provide a snapshot of the state of security

often using graphics such as 'traffic lights' to provide an at-a-glance indication of performance against pre-established targets." This directly supports the use of dashboards for high-level reporting.

2. Carnegie Mellon University

Software Engineering Institute (SEI). Allen

J. H.

& Westby

J. R. (2020). Reporting Cybersecurity to the Board of Directors (Special Report CMU/SEI-2020-SR-001). This report outlines principles for effective board reporting

emphasizing that reports should be concise

comparable

and contextualized. A dashboard is a primary tool for achieving these principles by translating technical metrics into a business-focused view. (p. 11).

3. ISACA. (2019). COBIT 2019 Framework: Governance and Management Objectives. The framework’s governance objective EDM05 (Ensured Stakeholder Transparency) requires communication to stakeholders on the achievement of governance and management objectives. It notes the importance of "dashboards and reports on the performance of the I&T governance system

" reinforcing that dashboards are a key mechanism for stakeholder (including the board) reporting. (p. 59).