How to Report Security to a Board Without Drowning Them in Detail

The quarterly board meeting is two weeks out, and a director has asked for "a security update." The IT provider sends over a 30-page export: patch percentages, blocked email counts, a list of firewall rule changes. The COO pastes it into the board deck, the slides get skipped for time, and nobody in the room can say afterward whether the company is more or less exposed than it was last quarter.

This is the normal state of security reporting at companies with 25 to 200 employees. The information exists. It just isn't shaped for the people who have to make decisions with it. This post covers what a board actually needs from a security report, what to leave out, a one-page format that works, and who should own putting it together.

Why boards are asking now

Board interest in security isn't a passing trend. Three things have pushed it onto the agenda, even at private companies.

Public company rules set the expectation. In July 2023 the SEC adopted rules that added Item 106 to Regulation S-K. Public companies now have to describe in their annual report how the board oversees cybersecurity risk, which committee is responsible, and how that committee is kept informed. Private companies aren't covered, but their investors, lenders and acquirers sit on public boards and bring the same questions with them.

The frameworks moved security into governance. NIST released Cybersecurity Framework 2.0 in February 2024 and added a sixth function, Govern, ahead of the original five. Its Oversight category says the results of security work should be "used to inform, improve, and adjust the risk management strategy." In plain terms: someone above the technical team has to look at results and make decisions.

Director guidance now asks for business terms. The National Association of Corporate Directors and the Internet Security Alliance released the fifth edition of the Director's Handbook on Cyber-Risk Oversight in April 2026. It is written for public, private and nonprofit boards. Its first principle is to treat cybersecurity as a strategic risk, and its fifth calls for reporting that moves past technical updates toward business and financial risk.

The common thread: directors are expected to oversee security risk, not to manage security tools. A report built for the second job doesn't help with the first.

What a board actually needs to know

A director needs to answer four questions after reading a security report:

1. What are our biggest security risks right now, in business terms? Not "unpatched endpoints," but "if ransomware hit our file servers, we would lose client work for an estimated three to five days."
2. Are those risks getting better or worse? A direction of travel matters more than a single number.
3. What decisions do you need from us? Budget, accepting a risk, approving a policy, buying insurance coverage.
4. Did anything happen that we should know about? Incidents, near misses, failed audits, a client that asked hard questions.

If the report answers those four, it has done its job. Everything else belongs in an appendix or with management.

Ground the risk section in what actually happens to companies this size. The Verizon 2025 Data Breach Investigations Report found ransomware in 88% of breaches at small and midsize businesses, compared with 39% at larger organizations, and put the median ransom payment at $115,000. A board at a 60-person firm will understand that number faster than any count of blocked threats.

What to leave out

Most security reports fail by including too much, not too little. These items rarely belong in front of a board:

• Raw activity counts. "We blocked 14,302 phishing emails" sounds impressive and says nothing about risk. A rising count could mean more attacks or better filtering. Directors can't act on it.
• Tool names and configurations. The board doesn't need to know which endpoint product you run. It needs to know whether devices are protected and monitored.
• Every open vulnerability. Report the few that matter to the business and the plan for them, not the scanner's full list.
• Jargon without translation. If a term needs a glossary, rewrite the sentence.
• Fear. Headlines about other companies' breaches don't help a board make decisions about this one. Specific, sized risks do.

The detail still exists. It belongs with whoever runs security day to day, where it drives the work.

A one-page format that works

Keep the board report to one page, plus an optional appendix. Here is a structure that covers the four questions:

Section	What it answers	Example line
Top risks	What could hurt us most	Wire fraud via a compromised finance inbox
Trend	Better or worse since last quarter	MFA now on 100% of accounts, up from 82%
Decisions needed	What we need the board to approve	Approve budget for a backup upgrade
Incidents	What happened and how it ended	One phishing click, contained same day
Outside pressure	Clients, insurers, regulators	Insurer added a backup testing question

A few rules make this format work:

Use the same measures every quarter. Pick five to eight indicators and keep them stable so the board can see trends. Good candidates for a 25 to 200 person company: share of accounts with multi-factor sign-in, share of devices that are managed and patched on schedule, days since the last successful backup restore test, phishing test click rate, number of former employees with active access (the goal is zero), and the status of any open client or insurer security requests.

Show the direction, not just the number. An arrow or a short "up from" or "down from" beats a dashboard full of gauges.

Put the decisions up front. If you need approval for spending or a risk acceptance, say so in the first lines, with a recommendation and the cost of not acting. Directors read the top of the page.

Write down risk acceptances. When the board decides not to fix something, record the decision, the reason and the date it will be revisited. This is the oversight record that NIST CSF 2.0 and the NACD guidance both point toward, and it is exactly what an insurer, acquirer or auditor will ask to see.

Translate risk into money

Boards think in dollars, downtime and obligations. Every top risk on the page should come with at least one of those.

Breach cost figures help frame the scale, as long as you are honest about who they describe. IBM's Cost of a Data Breach Report 2025 put the U.S. average at $10.22 million, a record high, while the global average fell to $4.44 million. Those averages lean toward large organizations, so don't present them as your company's expected loss. Use them to show direction, then size the risk to your own business: how many days of revenue a week of downtime would cost, what a client contract says about breach notification, what your insurance deductible is.

Example engagement: a 90-person professional services firm's board asks whether the company could survive a ransomware attack. Elevaire would work with the existing IT provider to confirm how long a full restore from backup actually takes, estimate the revenue lost per day of downtime from the firm's own billing data, and bring the board one line: the expected outage today, the expected outage after a specific backup improvement, and what that improvement costs. The board then has a decision to make, not a data dump to read.

Cadence: how often and how deep

A workable rhythm for a growing company:

• Quarterly: the one-page report, reviewed at a regular board or leadership meeting. Five to ten minutes on the agenda is enough when the report is well built.
• Annually: a deeper session covering the overall security strategy, the insurance renewal, any major client or regulatory changes, and a review of every risk the board has accepted.
• Between meetings: a short written notice for any incident that affects clients, money or operations. Agree in advance what counts, so nobody has to decide under pressure whether the board "needs to know."

A tabletop exercise once a year, where leadership walks through a realistic incident scenario, is also worth reporting on. It shows the board how the company would actually respond, which no metric can.

Who should own the report

This is the part most companies get wrong. The IT provider has the data but usually not the mandate or the business context to set priorities. The CEO or COO has the context but not the time to turn security data into risk statements. The result is the 30-page export from the opening of this post.

Board reporting is a core job of a chief information security officer. The issue at this size is cost. The IANS Research and Artico Search 2025 benchmark of small and midmarket CISOs found average total compensation of about $415,000, including roughly $330,000 in annual cash compensation. For a company with 50 or 150 employees, that is hard to justify for a role that may need a few days a month.

A virtual CISO fills that gap. The vCISO owns the risk register, writes the board report, joins the meeting to answer questions, and keeps the record of decisions and risk acceptances. Elevaire's vCISO service is priced on predictable monthly terms with no hourly billing, and it pairs with Elevaire Managed Security, which produces the underlying data the report draws on: monitoring results, access reviews, backup tests and phishing results from the quarterly security review.

Neither replaces the existing IT provider. The IT provider keeps running day-to-day systems. Elevaire handles security operations and leadership alongside them, and the board gets one consistent report instead of whatever each vendor happens to send.

Frequently Asked Questions

What security metrics should I report to my board?

Pick five to eight measures that tie to real business risk and keep them the same every quarter. Strong choices for a growing company are multi-factor sign-in coverage, managed and patched device coverage, the date of the last successful backup restore test, phishing test click rate and former employees with active access. Show the trend for each, not just the current number.

How long should a board security report be?

One page, with an optional appendix for anyone who wants detail. The page should cover top risks, the trend since last quarter, decisions the board needs to make, incidents and any outside pressure from clients, insurers or regulators. If it runs longer, most directors will skim the top and stop.

How much does it cost to have someone own board security reporting?

A full-time CISO is expensive at this size: a 2025 IANS Research and Artico Search benchmark put average total compensation for small and midmarket CISOs at about $415,000. A virtual CISO provides the same reporting and risk leadership for a fraction of the time commitment. Elevaire's vCISO service uses predictable monthly pricing with no hourly billing.

How does a vCISO work alongside our existing IT provider?

The IT provider keeps running daily operations: devices, accounts, help desk and infrastructure. The vCISO sets security priorities, turns technical data from that provider and from managed security monitoring into a board report, and tracks decisions over time. Elevaire works alongside the existing provider rather than replacing it.

Do private companies need to report cybersecurity to their board?

The SEC's Item 106 disclosure rules apply to public companies, not private ones. In practice, private company boards, investors, lenders and insurers increasingly expect the same kind of oversight, and the 2026 NACD Director's Handbook on Cyber-Risk Oversight is written for private and nonprofit boards as well as public ones. A short, regular report is the simplest way to show that oversight exists.

How do I get started if we've never reported security to the board?

Start with a baseline: list your top three to five risks in business terms, record where your key measures stand today, and note any decisions you need. Present that as a one-page report at the next meeting and agree on a quarterly cadence. A vCISO can build the first version and set up the measures so each later report takes far less effort.