Cyber risks and the board: what a good report must show
Short answer: a good report prepares a decision
Short answer: A good cyber report to the board of directors answers three questions: What is at stake for the business? How well is the assessment supported by evidence? What should the board decide? Activity figures and green traffic lights alone answer none of them.
The one-page template in this article helps you check your current report. It is a SIDD working aid, not a result and not a tested model of the cited study.
What a study on board reporting shows, and what it does not
Opdenbusch, Hielscher and Sasse interviewed 18 senior people from large UK organisations: executives, non-executive board members, consultants and CISOs. A CISO (Chief Information Security Officer) heads information security. The interviews took place in the first half of 2021.
According to the interviewees, board decisions on cyber risks mostly came down to budget questions. Questions were sometimes not asked out of uncertainty. The authors see this as a strong dependence on those reporting, which weakens oversight. The study is qualitative, not representative and says nothing about Swiss SMEs. A UK board is also structured differently from a Swiss board of directors (Verwaltungsrat).
In Switzerland, overall supervision of the persons entrusted with managing the company remains a non-transferable duty of the board of directors (Art. 716a para. 1 no. 5 CO). It “must ensure appropriate reporting to its members” (para. 2). The law does not set out in detail what this means for cyber risks.
Our article “A cyber budget is not cyber oversight: what boards of directors should ask” shows which questions a board of directors can ask about this.
Why activity figures alone do not make a risk assessment
Many reports show how much IT is doing: filtered phishing emails, installed updates, training sessions. Phishing means fake messages designed to steal login credentials. Such figures are useful for managing IT.
For a risk assessment, they lack a link to the business. A falling click rate in phishing tests is welcome. It does not show whether a stolen password would still give access to the ordering system. The study’s authors also note that it has not yet been researched which metrics actually help a board.
Why a green status without evidence says little
A traffic light shows how the reporting person assesses the situation, not what that assessment is based on. “Backup: green” often only means that backups are running. Whether the systems can be restored from them in time remains open.
Evidence can be checked by a third party. It states the date, the result and the scope, i.e. what it covers. Examples are the log of a restore test or a penetration test report with the open findings. A penetration test is a commissioned, controlled attack on your own systems.
An evidence field is not a vote of no confidence. The board of directors can ask targeted questions, and executive management can back up its assessment.
The report template: nine fields on one page
The template describes one risk per page. Start with the two or three processes whose failure would hit your company hardest. The right-hand column helps you check your current report.
| Field | What goes in | Question for your report |
|---|---|---|
| 1. Critical business process | A process without which the company cannot operate. | Does it name a process or just an IT system? |
| 2. Concrete failure scenario | What happens, how, and with which systems. | Is the scenario concrete enough to be rehearsed? |
| 3. Business impact | Consequences for customers, revenue, contracts, personal data and reputation. | Are the assumptions stated? |
| 4. Tolerance set by leadership | Longest acceptable downtime and largest acceptable data loss. | Did leadership decide, or IT? |
| 5. Existing safeguards and verifiable evidence | Each measure with evidence, date and scope. | Is every statement backed by evidence? |
| 6. Remaining risk and uncertainty | What remains open and how certain the assessment is. | Is uncertainty named? |
| 7. Options for action and effort | Two to three options, including consciously accepting the risk. | Is there a real choice? |
| 8. Responsible person | Name and function, not a department. | Is it clear who implements? |
| 9. Decision required and deadline | What the board of directors should resolve, and by when. | Does the report end with a question to the board? |
If tolerance, evidence or the required decision are missing, the report informs but hardly supports oversight. One way to make the template binding is to refer to it in the organisational regulations. These, “in particular, regulate the company’s internal reporting” (Art. 716b para. 3 CO).
Completed example (fictitious)
The example is entirely made up: a trading company with a warehouse and an online shop. Loss amounts and probabilities are deliberately not estimated.
| Field | Fictitious example |
|---|---|
| 1. Process | Order processing from receipt of the order to shipment. |
| 2. Scenario | Malware encrypts the ERP system, the central software for orders, stock and invoices. Orders can be neither recorded nor delivered. |
| 3. Impact | Delivery delays for key accounts, possible contractual penalties. If customer data is affected, a notification to the FDPIC, the federal data protection authority, must be considered (Art. 24 FADP). Revenue loss per day and contractual penalties: still to be determined. |
| 4. Tolerance | Proposal by executive management: orders processed again within 48 hours at the latest, in restricted form if necessary. At most one working day of data loss. Still to be confirmed by the board of directors. |
| 5. Measures and evidence | Daily backup, one copy disconnected from the network (evidence: backup logs). Remote access only with a second factor in addition to the password (evidence: extract from user management). Restore test of the ERP: still to be determined. |
| 6. Residual risk and uncertainty | There is no evidence that the ERP would be running again within 48 hours. So far only individual files have been restored, so the head of IT considers the target uncertain. |
| 7. Options and effort | A: restore test with the IT partner, effort still to be determined. B: define and rehearse an emergency procedure for manual order entry, low internal effort. C: raise the tolerance to 72 hours and consciously accept the risk. |
| 8. Responsibility | Head of Finance and IT, member of executive management (named in a real report). |
| 9. Decision and deadline | Confirm or adjust the tolerance. Approve options A and B or choose C. Deadline: next ordinary meeting. |
The real finding is in field 5: the backup is running, but there is no evidence that it would work in an emergency.
Why financial estimates need assumptions and ranges
A single loss figure looks precise but hides its assumptions. A robust estimate states them: How long will the process be down? What costs arise per day, for example from lost revenue, extra work or external help? What is not included?
Instead of a single figure, the report should give a range, with a favourable and an unfavourable case. It should also say who made the estimate and when. Where a basis is missing, the report says “still to be determined”.
In the study, a consultant wished for better ways to quantify the consequences of cyber risks. A non-executive board member pointed to the financial sector: measuring is familiar there, but cyber risks hardly fit the existing frameworks. Ranges with disclosed assumptions are a pragmatic middle way.
Workshop or ongoing security management?
Whether you need support depends on what happens after the first report. A good report does not require certification.
A one-off workshop is enough if
- you are filling in the template for the first time and want to assess your current report.
- a few critical processes are in focus.
- someone internally or at your IT partner implements the measures and keeps the report up to date.
The cyber risk workshop for boards and executives, a leadership-focused variant of our IT security workshop, is suitable for this.
Ongoing security management makes sense if
- the report needs regular updating and nobody internally can take on this role.
- many measures remain open for months.
- customers, insurers or supervisors regularly ask for evidence.
- the board of directors wants an assessment that does not come only from the IT team implementing the measures.
An external CISO can then take over the steering and report to executive management and the board of directors. Would you like to go through your current report with us? Use the contact form.
Sources
All sources accessed on 20 October 2026.
- Opdenbusch, J. C., Hielscher, J., Sasse, M. A.: “Where Are We On Cyber?” A Qualitative Study On Boards’ Cybersecurity Risk Decision Making, NDSS Symposium 2025, DOI 10.14722/ndss.2025.240595
- Swiss Code of Obligations (CO, SR 220), Art. 716a and 716b, Fedlex, unofficial English translation, as of 1 January 2026
- Federal Act on Data Protection (FADP, SR 235.1), Art. 24, Fedlex, unofficial English translation, as of 7 July 2025
This article is general information and not legal advice. The report template is a SIDD working aid and not a result of the cited study.
