Communicating Cyber Security to the Board of Directors

During recent executive meetings of The Conference Board of Canada’s Cyber Security Centre, board interaction on cyber security issues has featured prominently. How do chief information security officers (CISOs) and information technology (IT) security executives make sure their messages are clear, concise, and timely when the subject matter is difficult to communicate?

Our research has suggested three key approaches for improving communication with boards: using the right language, utilizing appropriate metrics and benchmarks, and clarifying the position of the CISO. By paying specific attention to the language, metrics, and governance issues discussed in this briefing, an organization can better position itself to deal with a rapidly evolving cyber security risk environment.