What cyber metrics should a board actually see?

A board metric is one that can change a decision

The board's job on cyber is to set appetite, fund the strategy, accept or reject residual risk and hold management to account. A number that cannot move one of those decisions is management information, however impressive it looks on a slide.

The NACD and Internet Security Alliance Director's Handbook on Cyber-Risk Oversight (5th edition, April 2026) makes this its fifth principle. It says reports should present cyber risk in financial and operational terms rather than purely technical metrics, aligned to the risk appetite, and observes that many boards still receive updates that are overly technical, inconsistent across business units or disconnected from business objectives. NIST's Cybersecurity Framework 2.0 points the same way: its Govern function expects risk appetite and tolerance statements to be set (GV.RM-02) and the results of risk management to be used to adjust strategy (GV.OV).

Key facts

Four things that belong in front of the board

1. Exposure against appetite. Where the organisation sits today against the cyber risk appetite the board approved, by business unit if that is how the business is run. If there is no written appetite, that is the first gap to close.
2. Top risk scenarios. The handful of events that would hurt most, such as ransomware stopping operations or loss of customer data, each with a likelihood and a plausible loss range. Ranges are fine, as long as the same method is used each time so the numbers can be compared.
3. A few trend indicators. Time to detect and contain incidents, patch compliance on critical systems, and incidents by severity over time. Shown as trends against a threshold the board has agreed, so a director can see at a glance whether exposure is rising.
4. Remediation and investment. What was funded, what has been delivered, what has slipped and why. This is where accountability lives.

What to leave with management

Volumes without context: attacks blocked, phishing emails stopped, alerts handled, vulnerabilities found. They only ever go up, they say more about the tools than the risk, and they invite the wrong question. The same goes for a traffic-light dashboard with no threshold behind the colours. A pack that is green on every page should prompt a closer look.

For US-listed companies there is a second reason to get this right. Item 106(c) of Regulation S-K requires the 10-K to describe how the board oversees cyber risk and the processes by which it is informed. The board pack is the evidence behind that sentence.