Report security work in terms leadership can decide on

Start with the reader’s decisions

Before selecting metrics, identify what the general manager, executive director, or governing body needs to decide. The report might support an improvement budget, a provider discussion, an operational exception, or a change in priorities. State the requested decision in a sentence and give the date it matters. A report with no decision request can still provide oversight, but it should explain that purpose clearly.

Use service names the reader recognizes. Describe the potential consequence for billing, participant scheduling, public communication, or essential operations before introducing a technical detail. NIST describes Organizational Profiles as a way to understand current and target cybersecurity outcomes and communicate relevant information to stakeholders. That outcome-based structure can help keep a local report connected to organizational priorities.

Separate activity from demonstrated change

A count of closed tickets describes activity. It does not explain which exposure changed or whether the result was checked. Pair an important action with evidence of its effect. If the team reviewed vendor accounts, report which access population was examined, which decisions remain open, and whether approved changes took effect. Keep implementation and verification distinct when they happen at different times.

Avoid suggesting precision the underlying data cannot support. An application inventory that excludes an unknown number of departmental tools cannot establish organization-wide coverage. Report the known denominator and the limitation. If a metric changes because the team found more accounts, explain the change in scope so the reader does not confuse better visibility with a sudden deterioration in the same population.

Use a small set of defined measures

Select measures that answer a recurring management question. Examples include unresolved access review decisions for a named critical application, overdue improvement actions, and recovery exercises awaiting follow-up. Define the population, evidence source, owner, and reporting date. Keep the definition stable long enough to make comparisons meaningful, and mark a break in the series when the definition changes.

Do not combine unrelated controls into an unexplained overall security score. A single percentage can hide a serious gap in a critical service behind improvements elsewhere. If the report uses status colors, define what each means and pair it with text. The reader should be able to distinguish verified completion, work in progress, an accepted temporary exception, and insufficient information.

Show the reasoning behind a request

Illustrative example: a district report identifies uncertainty about after-hours access removal for a maintenance supplier. The report describes the supported service, the current approval process, the missing escalation contact, and the proposed action. Leadership is asked to name an accountable operations deputy and approve time for a coordinated review. The example illustrates a decision request and does not describe client work.

For spending requests, explain the problem, the proposed approach, alternatives considered, internal effort, and what evidence would show the work succeeded. Separate known costs from estimates. Include dependencies that could prevent delivery, such as supplier availability or a required maintenance window. If leadership defers the request, record the decision and its review point so the issue remains visible.

Keep sensitive detail in the right place

A leadership summary rarely needs account identifiers, detailed network diagrams, sensitive incident records, or exploit instructions. Maintain a controlled supporting record for authorized technical readers and summarize the relevant consequence in the report. Before distribution, confirm the audience and information handling arrangements. A public-facing summary and an internal working report may need different levels of detail.

Close the reporting cycle by recording decisions, assigning owners, and checking the previous action list at the next meeting. Ask whether the report helped the reader understand a tradeoff or authorize useful work. The fractional CISO service at Fractional CISO is relevant when ongoing reporting and coordination need an owner. Report improvements with their evidence and limits rather than treating the existence of a dashboard as proof of security.

Sources and further reading

• NIST: guide to creating and using organizational profiles

This field note is general educational guidance. Your organization’s requirements, scope, and service arrangements determine the work that applies.