Bridging the Divide
This article discusses the challenges CISOs face in communicating cybersecurity risks effectively to various audiences, including the board, senior management, and technical teams. It highlights the limitations of traditional cybersecurity metrics and advocates for outcome-driven metrics tailored to each audience's needs. The article also explores communication strategies, such as translating technical concepts into business impact and utilizing frameworks like cascading communication, to enhance transparency, build trust, and foster cybersecurity accountability within an organization.
Effective Cybersecurity Communication and Metrics for Organizational Alignment
I. Introduction: The Evolving CISO Mandate and the Communication Imperative
The role of the Chief Information Security Officer (CISO) has undergone a significant transformation, evolving from a primarily technical function to a strategic business enabler.1 As boards and C-suite leaders increasingly recognize cybersecurity risk as a core business risk rather than merely a technology problem 2, CISOs find themselves with greater visibility but also facing mounting pressure to communicate effectively across diverse internal audiences. This includes technical teams focused on operational defense, senior management demanding business alignment and risk justification, and boards of directors requiring strategic oversight and assurance.1
However, a persistent communication gap hinders many CISOs. Only a small fraction feel highly effective in conveying cybersecurity risks to executive leadership.1 This disconnect often stems from differing perspectives on risk, technical jargon unfamiliar to business leaders, and, crucially, the reliance on traditional cybersecurity metrics that fail to resonate with non-technical stakeholders.1 Organizations are shifting towards outcome-driven approaches, demanding measurable performance and transparency across risk committees. Concurrently, there is a recognized need for structured, cascading communication to minimize organizational noise and ensure strategic alignment on security matters.
This report analyzes the common communication challenges CISOs face, evaluates the limitations of traditional metrics, and explores the specific needs of key audiences – the board, senior management (including CEO, CFO, CCO, CDAO), and technical teams. It identifies effective, outcome-driven metrics tailored for each group and outlines communication strategies, including translating technical concepts into business impact and employing structured frameworks like cascading communication. Ultimately, it provides recommendations for CISOs to develop an integrated metrics and communication approach that builds trust, enhances transparency, and fosters cybersecurity accountability throughout the organization.
II. Common CISO Communication Challenges and the Limitations of Traditional Metrics
The difficulty CISOs experience in communicating effectively across the organization is multifaceted, rooted in language barriers, differing priorities, and the inadequacy of commonly used metrics. Many CISOs struggle to get their message heard and understood at the highest levels, despite the increasing importance placed on cybersecurity oversight.1
A. The Communication Gap: Language, Priorities, and Perspectives
A fundamental challenge lies in the differing perspectives and language used by technical security professionals versus business leaders.5 CISOs often present information steeped in technical terminology, acronyms, and jargon that is unfamiliar and potentially alienating to non-technical audiences like board members or C-suite executives.6 This "Techspeak" can cause business leaders to disengage, missing the critical points the CISO is trying to convey.7 The issue transcends mere vocabulary; it reflects fundamentally different approaches to risk and varying definitions of what constitutes important information.5 While security teams focus on technical vulnerabilities and control mechanisms, leadership prioritizes business impact, financial risk, operational continuity, and strategic alignment.5 This disparity often leaves CISOs trying to interpret what they assume the board wants to see, further complicated when presentations are edited by other executives before reaching the board, potentially altering the narrative.5 Without a shared language and mutual understanding of priorities, communication breakdowns are inevitable.5 Establishing this shared understanding requires effort from both sides: executives must provide context on business value and strategy, while CISOs must translate technical risks into their potential impact on those business objectives.5
B. The Ineffectiveness of Traditional Cybersecurity Metrics
A major contributor to the communication gap is the prevalent use of traditional cybersecurity metrics that, while potentially useful for operational teams, are often ineffective or even misleading when presented to leadership.
Focus on Activity, Not Outcomes: Many common metrics report on security activities or technical outputs rather than tangible business outcomes or risk reduction.6 Examples include the number of attacks blocked, vulnerabilities found, or patches deployed. Presenting "Our security tool blocked 40,000 attacks last month" tells the board little about what threats succeeded or whether the right threats were blocked.6 Similarly, reporting the "Number of critical vulnerabilities" acts as a trailing indicator, reflecting past discoveries rather than future risk, and can potentially misdirect investment decisions.14 These metrics measure effort but fail to demonstrate the effectiveness of the security program in protecting the business.
Lack of Financial Quantification: Metrics such as the number of port scans blocked or servers patched lack inherent business context and fail to translate technical issues into the financial terms that resonate with the C-suite, particularly the Chief Financial Officer (CFO).1 Business leaders need to understand risk in terms of potential financial loss, impact on revenue, or return on investment (ROI) – concepts traditional technical metrics rarely address.9
Difficulty Demonstrating Value and ROI: Consequently, these traditional metrics make it extremely challenging for CISOs to demonstrate the value proposition of cybersecurity investments or the overall effectiveness of the security program in reducing tangible business risk.7 This difficulty is reflected in the finding that only 9% of security leaders feel highly effective in communicating cybersecurity risks to executives.1 Without demonstrating value in business terms, securing adequate resources and attention becomes a significant hurdle.1
Attribution and Control Issues: Some commonly reported metrics may not even directly reflect the security team's performance. For instance, server patching is often the responsibility of IT Operations, making patching statistics an indirect comment on another team's efficiency rather than a direct measure of the security function's effectiveness.12 Furthermore, many meaningful security outcomes rely on interdependent activities across multiple departments, making it difficult to isolate the security team's specific contribution and requiring cross-functional data gathering and collaboration to produce truly valuable metrics.8
The persistence of these "weak" or "vanity" metrics 11 is not necessarily due to a lack of effort, but often points to deeper underlying challenges. These can include a lack of clearly defined security program objectives aligned with business goals, the inherent difficulty in quantifying the impact of improved decision-making or mitigated incidents, or inadequate investment in the necessary technology, processes, and skills required to generate more meaningful, outcome-driven metrics.8 Addressing the metrics problem, therefore, requires tackling these foundational issues.
III. Understanding Your Audience: Tailoring the Cybersecurity Narrative
Effective communication hinges on understanding the specific needs, priorities, and perspectives of the target audience. A CISO must tailor the cybersecurity narrative differently for the Board of Directors, various C-suite executives, and the technical teams executing security operations.
A. Board of Directors: Strategic Oversight and Governance
The Board of Directors operates at a strategic level, primarily concerned with governance, overall risk management, and preserving long-term organizational value.3 Their focus is not on the intricate technical details but on the bigger picture: understanding the organization's most significant cyber risks and ensuring they are managed effectively within the established risk appetite.9
Priorities: Board members prioritize understanding the overall cyber risk profile, the potential for material business impact (financial, operational, reputational), the organization's resilience and preparedness for major incidents, adherence to regulatory requirements, and how the company's security posture benchmarks against peers.4 They are responsible for setting the security risk appetite and defining tolerances.9
Information Needs: The board requires high-level, concise summaries, not exhaustive technical reports.9 They need clear answers regarding the biggest risks, mitigation strategies, the likelihood and potential financial impact of significant breaches, incident response readiness (including expected recovery times), third-party risk management status, and the ROI of the security program.9 They also need updates on any material changes to the risk landscape.5
Common Questions: CISOs should anticipate questions such as: "What are our biggest cybersecurity risks, and how are we addressing them?" "How likely is a significant breach, and what would be the financial and reputational impact?" "How prepared are we to respond to a major incident?" "What steps are we taking to mitigate third-party risks?" "How does our security posture compare to our peers?" "What events could create a material impact on the business?".9
B. Senior Management/C-Suite (CEO, CFO, CCO, CDAO): Business Alignment and Operational Impact
While the C-suite shares the board's focus on business impact, individual executives have distinct priorities based on their functional responsibilities. Communication must be tailored accordingly, moving beyond generic "business language" to address their specific concerns.
Chief Executive Officer (CEO): The CEO focuses on the alignment of cybersecurity with overall business strategy, ensuring that cyber risks do not impede corporate objectives, operational continuity, market position, or organizational reputation.5 They need assurance that the cybersecurity program effectively manages risks that could impact strategy, both financially and operationally.5
Chief Financial Officer (CFO): The CFO's lens is primarily financial. They are concerned with financial risk exposure, the ROI of security investments, budget justification, the direct and indirect costs associated with data breaches (including potential impacts on credit ratings or funding), and cost optimization.6 Increasingly, CFOs view cybersecurity spending as part of long-term financial strategy, requiring quantifiable justification for investments based on risk reduction.10 They need metrics that drive business-oriented conversations about financial risk and value.27
Chief Compliance Officer (CCO): The CCO prioritizes adherence to external regulations (e.g., SEC disclosure rules, GDPR, HIPAA, PCI DSS, DORA) and internal policies.7 They need assurance regarding internal controls, data integrity, policy enforcement, mandated incident reporting (especially for material events like those requiring SEC Form 8-K filings 6), data privacy measures, and third-party compliance. The CCO requires regular reports on compliance status, audit findings, identified violations, and the effectiveness of remediation efforts.32
Chief Data and Analytics Officer (CDAO): The CDAO is responsible for maximizing value from the organization's data assets while managing associated risks.37 Their cybersecurity concerns center on data governance, data quality, data security throughout its lifecycle, compliance with data privacy regulations, and ensuring the availability and integrity of critical data assets.38 They need to understand how cybersecurity measures protect critical data and enable the safe execution of the data and analytics strategy, including the use of AI.38
Information Needs (General C-Suite): Across the C-suite, there's a need for a clear linkage between cyber risk and business objectives.4 Financial quantification of risk and ROI is highly valued.1 They require information on the impact of security on operations, revenue, and reputation 4, updates on compliance status 21, justification for resource allocation 7, evidence of the effectiveness of security investments 1, and timely updates on significant threats and incident responses.42
C. Technical Teams: Operational Effectiveness and Threat Mitigation
Technical security teams (e.g., Security Operations Center (SOC), vulnerability management, incident response) operate at the tactical and operational level. Their priorities and information needs differ significantly from leadership.
Priorities: These teams focus on operational efficiency, the speed and accuracy of threat detection and response, the effectiveness of security controls and tools, vulnerability remediation, maintaining system health, optimizing tools, and reducing noise like false positives.2
Information Needs: Technical teams require granular, real-time or near-real-time operational metrics. This includes detailed time-based metrics (MTTD, MTTR, MTTC), alert data (false positive/negative rates), specific threat intelligence feeds, vulnerability scan results, patch status updates, system logs, control coverage data (e.g., EDR deployment percentage), control reliability statistics, and detailed incident information for root cause analysis and process improvement.13 They need this data not primarily for upward reporting, but to inform their daily tasks, prioritize actions, identify process bottlenecks, and continuously improve the effectiveness of security operations.8 These operational metrics, while often unsuitable for direct board reporting, form the essential foundation for calculating and influencing the higher-level, outcome-driven metrics that leadership requires. Dismissing them entirely would cripple the operational effectiveness they are designed to measure and improve.
IV. Metrics That Matter: From Technical Outputs to Business Outcomes
Moving beyond traditional, activity-based metrics requires embracing a new set of principles focused on business relevance and measurable outcomes. The goal is to select and present metrics that provide genuine insight into the organization's risk posture and the effectiveness of its security program, tailored to the specific audience receiving the information.
A. Principles of Effective Metrics
Developing metrics that resonate with leadership and drive meaningful action involves adhering to several key principles that go beyond basic SMART criteria:
Business Alignment: Metrics must be directly relevant to the organization's strategic objectives, business goals, and critical functions.6 They should demonstrate how cybersecurity contributes to or protects business value.
Outcome-Driven: The focus should be on measuring results, effectiveness, and actual risk reduction, rather than simply counting activities or outputs.13 For example, measuring the reduction in critical vulnerabilities is more impactful than just counting the number found.
Audience Relevance: Metrics must be tailored to the specific information needs, priorities, and level of technical understanding of the intended audience (Board, C-Suite roles, Technical Teams).8 What is essential for the SOC team may be noise to the board.
Clarity and Simplicity: Metrics should be easy to understand, particularly for non-technical stakeholders. Avoid jargon and overly complex calculations whenever possible.4 Effective visualizations like charts and dashboards can significantly aid comprehension.4
Quantifiable and Measurable: Good metrics rely on objective, verifiable data that can be consistently tracked over time, allowing for trend analysis and objective assessment.8 Financial quantification should be used where feasible and appropriate for the audience.1 However, the challenges associated with quantification, such as subjectivity and data availability, must be acknowledged.11 Robust models like Factor Analysis of Information Risk (FAIR) can provide structure, but require good data foundations (e.g., asset inventory) and potentially specialized tools or expertise.17
Actionable: Metrics should provide insights that directly inform decision-making and lead to clear paths for improvement or intervention.8 They should help determine where to apply resources.8
Contextualized: Raw numbers are rarely sufficient. Metrics should always be presented with relevant context, explanations, and trends over time to provide a complete picture and avoid misinterpretation.1 A snapshot metric can be misleading; tracking progress or decline over time is more valuable.8
Leading Indicators: While challenging, metrics that can predict future risk or potential negative outcomes (leading indicators) are more valuable for proactive management than those that only report on past events (trailing indicators).14
B. Audience-Specific Metrics Examples
Applying these principles leads to different metrics being appropriate for various audiences. While presented here as lists, the core idea is to select a curated set for each group, recognizing the hierarchical flow from operational details to strategic outcomes. Foundational operational metrics used by technical teams often feed into the tactical metrics for management, informing the strategic, outcome-driven metrics essential for the C-suite and Board.13 The very selection of metrics presented to leadership communicates the CISO's priorities; choosing technically focused metrics signals a potential disconnect, whereas outcome-driven metrics demonstrate strategic alignment.5
Board-Relevant Metrics (Focus: Strategic Risk, Governance, Financial Impact):
Quantified Risk Exposure: Financially denominated estimates of potential losses from key cyber events (e.g., ransomware, data breach), potentially using models like FAIR. Examples include Average Loss Expectancy (ALE) or likelihood vs. financial exposure charts.9
Risk Appetite Alignment: Visualizations or metrics demonstrating current risk levels relative to the board-approved appetite and tolerance thresholds.9 Status updates on remediation for key items on the risk register.9
Overall Security Rating: A composite score (e.g., 250-900) indicating overall security performance, often benchmarked against industry peers and correlated with breach likelihood.15
Peer Benchmarking: Comparative analysis of the security program's maturity (using frameworks like NIST CSF, ISO 27001, CMMI) or key risk indicators against industry or sector averages.4
Material Impact Scenarios: Identification and status reporting on risks deemed likely to cause a material impact on the business (financial, operational, reputational).9
Organizational Resilience: Metrics reflecting the ability to recover from major incidents, such as Mean Time to Recover (MTTR) for critical business functions (distinct from operational MTTR), results from tabletop exercises or simulations, and measures of backup and recovery efficacy.9
Third-Party Risk Posture: Trend of average security ratings for the vendor portfolio over time; percentage of critical vendors meeting defined security requirements.9
Security Program ROI/Value: Trend showing reduced quantified financial risk exposure over time relative to security investments; progress against strategic security goals.9
Critical Patching Performance: Time taken (e.g., days) to patch critical vulnerabilities on systems supporting key revenue-generating or mission-essential functions; overall patching cadence grade (e.g., A-F).14
Cyber Insurance Alignment: Metrics demonstrating that cyber insurance coverage (limits, sub-limits, deductibles) is appropriately aligned with the quantified financial exposure from likely cyber events.18
C-Suite-Relevant Metrics (Focus: Financial Risk, ROI, Business Alignment, Operations, Compliance):
Specific Initiative ROI: Calculation showing the financial risk reduction achieved versus the cost for specific security tools, projects, or control upgrades (e.g., implementing EDR on critical servers).15 Essential for CFO discussions.10
Financial Impact of Incidents: Average cost per security incident or breach, tracked over time, to justify investments in prevention and response capabilities.4
Compliance Adherence: Dashboards or reports showing the status of compliance with key regulations (e.g., SEC, GDPR, HIPAA, PCI DSS, DORA, SOX); number and severity of outstanding compliance deficiencies or violations.4
Vendor Risk Management: Detailed risk scores or ratings for key third parties; status of vendor security assessments and remediation tracking.9
Operational Resilience (Service Level): Mean Time to Detect (MTTD) and Mean Time to Respond/Resolve (MTTR) specifically for incidents affecting critical business services or applications, tracked over time.9
Business Disruption Impact: Frequency, duration, and scope (e.g., processes affected, revenue impact) of security-related operational disruptions.4
Security Budget Utilization: Tracking of year-to-date spending against the allocated security budget; percentage completion of planned annual security objectives.14
Data Protection Metrics (for CDAO): Effectiveness of Data Loss Prevention (DLP) controls; compliance rates for access management policies; metrics related to the security of critical data repositories.47
Human Risk Indicators: Trends in phishing simulation click rates (focus on improvement, not blame); security awareness training completion rates and effectiveness scores (e.g., quiz results).9
Technical Team-Relevant Metrics (Focus: Operational Effectiveness, Threat Landscape, Control Efficacy):
Granular Detection & Response Times: Detailed MTTD, MTTR, Mean Time to Acknowledge (MTTA), and Mean Time to Contain (MTTC) broken down by incident type, severity, system, or analyst/team.30
SOC Alert Funnel Metrics: Volume of raw alerts, alerts investigated, incidents declared, False Positive Rate (FPR), False Negative Rate (FNR), Alert Escalation Rate, Alert Closure Rate.45
Vulnerability Management Pipeline: Number and severity of new vs. closed vulnerabilities over time, vulnerability recurrence rate, vulnerability scan coverage percentage, average time to remediate vulnerabilities by severity level.14
Patching Efficiency: Overall patch compliance rate, average time from patch release to deployment (patching cadence), adherence to patching schedules, number of overdue critical patches.30
Threat Detection Efficacy: Number and type of intrusion attempts detected vs. blocked, malware detection success rates, volume of malicious DNS or Command-and-Control (C2) traffic identified, number of threat intelligence indicators actioned.19
Security Control Performance: Percentage of endpoints/servers covered by EDR or other key controls, firewall rule effectiveness, DLP policy effectiveness rates, system hardening compliance scores, control failure rates or reliability metrics.19
Identity & Access Management (IAM) Health: Failed login rates, number of privileged access anomalies detected, user privilege escalation attempts blocked, time/success rate for revoking access for departed users.30
System & Tool Reliability: Mean Time Between Failures (MTBF) for critical security infrastructure components; metrics indicating analyst workload or tool performance bottlenecks.47
C. Using Metrics for Transparency and Accountability
The consistent reporting of mutually agreed-upon, outcome-driven metrics is fundamental to enhancing transparency across various governance bodies, such as the Audit Committee, Risk Committee, and the full Board.32 When these different groups receive the same core messages, supported by clear, understandable data, it fosters a shared understanding of the organization's risk posture and the effectiveness of its security program. Tracking these metrics over time provides objective evidence of progress (or identifies areas needing attention), thereby holding the CISO, the security team, and potentially other relevant business units accountable for performance and risk mitigation outcomes.9 Furthermore, well-chosen metrics lend objective credibility to the CISO's narrative, supporting requests for resources and building confidence in their management of the cybersecurity function.25
V. Strategic Communication Frameworks for CISOs
Beyond selecting the right metrics, CISOs need effective strategies and frameworks to deliver their message clearly and persuasively. This involves translating technical complexities into business-relevant terms, tailoring the communication approach for specific leaders, and potentially leveraging structured communication models like the cascading approach for broader organizational alignment.
A. Translating Technical Risk into Business Impact
Bridging the gap between technical security issues and business understanding requires more than just avoiding jargon; it necessitates reframing risk in terms of its potential consequences for the business. Effective translation focuses on the impact on the audience's specific priorities—be they financial, operational, strategic, or compliance-related.1 Key techniques include:
Focusing on Outcomes: Emphasize the potential business consequences of inaction or the benefits of security measures, rather than the technical mechanics. Discuss financial losses, operational disruptions, regulatory penalties, reputational damage, or loss of customer trust.1 For example, instead of detailing a vulnerability, explain the potential cost if exploited or the risk reduction achieved by patching it.
Using Analogies and Simple Language: Relate complex concepts to familiar business scenarios or everyday examples that resonate with a non-technical audience.4 For instance, explaining a Vulnerability Risk Rating (VRR) as being like a credit score for security can make the concept more tangible.53 Substitute technical terms with simpler equivalents where possible (e.g., "Secure Wi-Fi" for "Encrypted Wireless Networks," "Unauthorized Software" for "Shadow IT").4 If technical terms or acronyms are unavoidable, define them clearly and concisely.7
Employing Data-Driven Storytelling: Weave metrics into compelling narratives that illustrate the risk landscape, demonstrate the value of security investments, show progress over time, or explain the rationale behind strategic decisions.1 Storyboarding common attack scenarios (like ransomware) and showing the controls in place can be more effective than simply comparing incident numbers.25 Using relevant case studies or examples from competitors or parallel industries can also powerfully convey a message.7
Leveraging Visual Aids: Utilize charts, graphs, dashboards, heat maps, and infographics to simplify complex data, highlight trends, and make information more accessible and digestible, especially for time-constrained executives and board members.4 A spider graph, for example, can provide an instant snapshot of maturity gaps and progress.25
Applying Financial Quantification (CRQ): Where appropriate and feasible, translate cyber risk into monetary values (e.g., potential breach costs, risk reduction value in dollars, ROI percentages). This is the most direct way to communicate in the language of finance, particularly crucial for engaging the CFO and the board.1
B. Tailoring Communication for Key Leaders
Recognizing the diverse priorities within the C-suite and board requires tailoring the message content and emphasis:
Engaging the CEO: Communications should focus on strategic alignment, ensuring security enables rather than hinders business objectives. Highlight major risks to strategic goals, potential impacts on reputation and market position, and the overall resilience of the organization.5 Keep messages concise and focused on high-level outcomes.
Engaging the CFO: Emphasize the financial narrative. Focus on ROI calculations for security investments, quantified financial risk exposure (e.g., using CRQ), potential cost savings through breach avoidance, budget justification based on risk reduction, and any efficiency gains achieved through security automation.10 Frame security spending as a strategic investment protecting financial health, not just an operational cost.10
Engaging the CCO: Center the discussion on compliance. Report clearly on the organization's adherence status with relevant industry and government regulations (e.g., SEC, GDPR, HIPAA, DORA). Provide results from compliance audits, evidence of policy enforcement, details on incident reporting processes (especially concerning material breaches requiring disclosure), status of data privacy controls, and risk mitigation efforts specifically tied to regulatory mandates.31
Engaging the CDAO: Focus on data. Discuss risks to critical data assets and intellectual property, the effectiveness of data governance and security controls throughout the data lifecycle, collaboration points for protecting the data value chain, and how security measures enable the safe and effective use of data analytics and AI initiatives.38
General Best Practices: Regardless of the specific executive, CISOs should always strive to understand their audience's background, concerns, and priorities.21 Anticipate likely questions and prepare thoughtful answers.5 Practice delivery to cultivate "executive presence"—clear, jargon-free, precise, and confident communication.22 Maintain honesty and transparency, acknowledging uncertainties while demonstrating a clear plan.42
C. Implementing Structured Communication: The Cascading Approach
To ensure consistent messaging and alignment throughout the organization, particularly for disseminating policies or strategic security initiatives, a structured communication approach like cascading communication can be beneficial.59
Concept: Cascading communication involves a systematic, top-down flow of information. A core message originates from leadership (e.g., the CISO and executive team) and is relayed down through successive management layers (directors, managers, team leads) to frontline employees. Each level is responsible for understanding the core message and tailoring its delivery appropriately for their specific team's context, without altering the fundamental intent.59
Benefits for Cybersecurity: This approach can help ensure that critical cybersecurity information—such as new security policies, awareness campaign details, or responses to emerging threats—is communicated consistently across all departments. It aims to foster transparency, build trust, enhance accountability, and reinforce a security-conscious culture by aligning operational execution with leadership's strategic direction.59 It directly addresses the user query's goal of preventing information misalignment and reducing organizational noise. Consistent messaging is also vital when managing third-party risk, ensuring partners receive clear expectations.60
Challenges: The hierarchical nature of cascading communication presents potential pitfalls. There is a risk that the message can become diluted, distorted, or misinterpreted as it passes through multiple layers.59 The process can be slow, potentially hindering rapid response needed for dynamic cyber threats. Employees further down the chain might feel disconnected from the original message source, reducing its impact.59 Furthermore, the effectiveness heavily relies on the communication skills of managers at each level.59 The analogy of "cascade cyber risk," where system failures propagate through interconnected systems 61, can also apply to information failures in a rigid cascade.
Steps for Effective Implementation (adapted from 59):
Define the Core Cybersecurity Message: Start with a clear, concise, and actionable message aligned with organizational security goals (e.g., "Implement mandatory MFA on all external accounts by X date due to increased credential stuffing attacks").
Identify the Communication Chain: Map the organizational structure to determine the flow of information from the CISO/executives down to individual contributors, identifying key managers and influencers at each stage.
Tailor the Message for Each Audience: Provide managers with the core message plus tailored talking points, context relevant to their teams' work, and anticipated questions/answers, ensuring the core intent remains unchanged.
Train Managers and Leaders: Equip managers with the necessary information and potentially brief training on how to effectively deliver the message, answer questions, and foster discussion within their teams. Emphasize the importance of direct, clear communication.
Choose Appropriate Channels: Select the most effective channels for each stage of the cascade (e.g., executive email, all-hands meeting announcement, manager team briefings, team huddles, internal messaging platforms). A mix of channels can improve reach and retention.
Establish Feedback Mechanisms: Create channels for questions, concerns, and feedback to flow back up the chain, allowing for clarification and adjustments.
Monitor and Evaluate: Assess whether the message reached the intended audience accurately and was understood. Measure if it resulted in the desired behavioral change or action.
While cascading communication provides valuable structure for certain types of security communication, its inherent limitations, particularly speed and potential for distortion, mean it should not be the sole communication method. For dynamic situations like incident response or rapidly evolving threats, CISOs must employ complementary, more agile communication strategies, such as dedicated cross-functional incident response channels or direct briefings, to ensure timely and accurate information flow.33
VI. Building Trust and Fostering Accountability Through Integrated Communication
An integrated approach combining audience-appropriate, outcome-driven metrics with tailored, transparent communication strategies is essential for building trust between the CISO, leadership, and the broader organization. This foundation of trust is critical for enhancing transparency across risk committees and fostering a culture where cybersecurity accountability is shared.
A. Establishing CISO Credibility and Trust
Trust is not granted automatically; it must be earned through consistent action and effective communication. CISOs can build credibility and foster trust with the board and C-suite by:
Practicing Transparency and Honesty: Being open and upfront about the organization's security posture, including challenges, vulnerabilities, and the evolving nature of threats, is paramount.42 This extends to crisis situations; acknowledging uncertainty during an incident while clearly communicating the response plan builds more trust than projecting false certainty or remaining silent.42 Avoiding the tendency to hide bad news is crucial for long-term credibility.42
Ensuring Consistency: Using consistent terminology, metrics frameworks, and reporting formats over time helps leadership understand the information presented and track progress reliably.21 This predictability builds confidence.
Demonstrating Control and Preparedness: Clearly articulating incident response plans, mitigation strategies for key risks, and results from preparedness exercises (like tabletop simulations or penetration tests) provides assurance.25 Using metrics such as MTTR for critical services or successful simulation outcomes validates these claims.25 Projecting measured confidence, grounded in demonstrable readiness, is key.42
Exhibiting Business Acumen: Communicating in the language of business, explicitly linking security initiatives to organizational goals and financial outcomes, demonstrates strategic thinking and elevates the CISO beyond a purely technical role.1 This helps build rapport and justifies the CISO's seat at the strategic table.
Maintaining Reliability: Consistently providing accurate, validated data is fundamental to being a trusted advisor.25 Leveraging appropriate tools and processes to ensure data integrity and completeness supports this reliability.57 Meeting commitments and following through on agreed actions further solidifies trust.
Communicating Proactively: Anticipating the information needs of the board and C-suite and providing timely, relevant updates—especially regarding emerging threats, material changes in risk, or significant incidents—demonstrates initiative and fosters confidence.5 Establishing clear escalation paths and reporting thresholds for incidents ensures timely notification without unnecessary noise.42
Critically, trust is often forged not just during periods of calm, but significantly through how leadership, including the CISO, communicates during crises like data breaches.42 Transparent, timely, business-focused, and confidently managed communication during difficult times can solidify the CISO's credibility and strengthen the relationship with the board for the long term, proving essential when seeking resources or support post-incident.42
B. Enhancing Transparency Across Risk Committees
An integrated communication and metrics strategy directly supports increased transparency across various governance and risk oversight bodies (e.g., Board Risk Committee, Audit Committee, full Board). Key elements include:
Shared Language and Metrics: Utilizing a common lexicon and a core set of understandable, outcome-driven metrics ensures that all committees receive consistent information and operate from a shared understanding of the organization's cybersecurity posture and key risks.5
Contextualized Reporting: Presenting metrics with appropriate background, explanations of significance, and trend analysis ensures that data is interpreted correctly and consistently, regardless of the committee reviewing it.6
Regular and Predictable Cadence: Establishing and adhering to a regular reporting schedule allows committees to effectively monitor the risk landscape, track progress against objectives, and identify emerging issues over time.5
Clear Documentation: Maintaining well-organized and accessible documentation for policies, procedures, risk assessments, audit results, and incident reports provides a transparent evidence base that supports reporting and facilitates oversight.32
C. Fostering a Culture of Shared Accountability
Ultimately, the goal is to move cybersecurity from being solely the CISO's responsibility to a shared accountability across the organization. Effective communication and metrics are vital facilitators of this cultural shift:
Linking Security to Business Value: When communication consistently demonstrates how cybersecurity initiatives protect critical assets, enable business objectives, prevent financial losses, and maintain customer trust, it underscores the relevance of security to all parts of the organization, encouraging broader ownership.6
Clarifying Roles and Responsibilities: Clear communication, supported by defined processes and potentially RACI charts, helps ensure that individuals and departments understand their specific roles in managing cybersecurity risks.5
Using Metrics to Drive Behavior: When performance metrics are tied to outcomes that business unit leaders value (e.g., operational uptime, project delivery timelines protected from cyber disruption), it can incentivize their active participation in and support for security measures.8 Incorporating relevant actions and metrics into executive evaluations can further reinforce accountability.55
Securing Leadership Buy-in: Consistent, clear, and business-focused communication is essential for gaining and maintaining the support of senior leadership and the board. This top-level buy-in is crucial for cascading security awareness and expectations throughout the organization, reinforcing the message that security is everyone's responsibility.10
Building Trust as a Foundation: Transparency in communication and reporting builds the trust necessary for genuine accountability.42 When stakeholders trust the CISO and the information they provide, they are more likely to accept their own roles and responsibilities in the collective effort to manage cyber risk. This requires moving beyond merely reporting risks to actively engaging business leaders in dialogue and collaborative decision-making about risk acceptance, mitigation strategies, and resource allocation, making them true partners in cybersecurity governance.5
VII. Recommendations: Implementing an Integrated Metrics and Communication Strategy
To effectively bridge the communication divide, build trust, and foster accountability, CISOs should implement an integrated metrics and communication strategy grounded in the principles and practices outlined in this report. This requires a deliberate, stakeholder-centric approach and continuous refinement. The following recommendations provide a blueprint for action:
A. Develop a Stakeholder-Centric Communication Plan:
Map Stakeholders and Needs: Explicitly identify all key internal audiences, including specific board committees (Audit, Risk), individual C-suite executives (CEO, CFO, CCO, CDAO, CIO), business unit leaders, and technical team leads. Document their distinct priorities, concerns, information needs, and preferred communication styles/formats by referencing audience analysis (Section III) and engaging them directly to confirm requirements.57
Define Communication Objectives: For each stakeholder group, clearly articulate the desired outcome of communication – what knowledge should be imparted, what perspective shifted, or what action encouraged.
Select and Define Tailored Metrics: Curate a core set of outcome-driven metrics specifically relevant to each audience (drawing from examples in Section IV.B). Ensure each metric is clearly defined, including its calculation method and business relevance, to establish a common understanding.57
Establish Cadence and Channels: Define a regular reporting schedule (e.g., quarterly for the board, monthly for C-suite dashboards, weekly for technical teams) and select the most appropriate channels (formal reports, executive summaries, dashboards, presentations, team meetings, email updates) for each audience and message type.
B. Establish a Robust, Outcome-Driven Metrics Program:
Align with Business Objectives: Ensure the security program's goals, and consequently its metrics, are explicitly linked to the overarching strategic objectives of the organization.6
Invest in Foundational Capabilities: Prioritize establishing and maintaining accurate, comprehensive data sources, particularly a robust asset inventory.17 Invest in tools necessary for effective vulnerability management, security monitoring, reporting, visualization, and potentially Cyber Risk Quantification (CRQ) platforms.11 Actively work to break down data silos that impede a holistic view.39
Implement Risk Quantification Strategically: Adopt a recognized CRQ methodology (e.g., FAIR) where feasible to translate cyber risk into financial terms, particularly for communications with the CFO and board.16 Be realistic about the prerequisites (data quality, asset context, methodology understanding) and limitations.17
Emphasize Trends and Context: Design reporting to highlight trends over time rather than static snapshots. Always provide necessary context and explanations to ensure metrics are understood correctly and their significance is clear.1
Benchmark Meaningfully: Utilize industry frameworks (e.g., NIST CSF, ISO 27001, CMMI) and peer data for comparison and context, but always tailor the interpretation to the organization's specific risk profile, maturity, and strategic goals.4
C. Refine Communication Skills and Techniques:
Cultivate Business Fluency: Actively work to understand and use business terminology, focusing on translating technical issues into their impact on revenue, cost, operations, compliance, and strategy.1 Consider pursuing relevant business education or reading.63
Develop Data Storytelling: Practice constructing clear and compelling narratives around key metrics and security events to make the information engaging, understandable, and memorable for non-technical audiences.1
Enhance Presentation and Delivery: Focus on delivering information with clarity, conciseness, and confidence ("executive presence"). Master the use of visual aids to simplify complexity. Rehearse presentations to refine messaging and timing.4
Prepare for Interaction: Anticipate questions, especially challenging ones ("what if" scenarios), and prepare thoughtful responses. Practice techniques for handling difficult questions calmly and steering conversations back to key messages.21
D. Implement Structured Communication Processes Selectively:
Assess Suitability of Cascading Communication: Evaluate which types of cybersecurity information (e.g., broad policy changes, annual awareness themes) are appropriate for a structured, top-down cascading approach.
Execute Cascades Methodically: If using cascading, follow a defined process: craft a clear core message, map the communication chain, provide tailored guidance to managers at each level, select appropriate channels, and crucially, establish feedback loops to monitor effectiveness and address issues.59
Employ Multiple Communication Methods: Recognize that cascading communication is not sufficient for all needs. Complement it with direct briefings for leadership, cross-functional team meetings for collaborative projects, dedicated channels for incident response, and other methods suited to the specific context and urgency.
E. Foster Collaboration and Actively Solicit Feedback:
Engage Stakeholders in Dialogue: Move beyond one-way reporting. Regularly solicit feedback from the board, C-suite executives, and business leaders on the clarity, relevance, and usefulness of the metrics and communications they receive.5 Ask directly what they need.57
Build Cross-Functional Partnerships: Cultivate strong working relationships with peers in Finance (CFO), Legal/Compliance (CCO), Data/Analytics (CDAO), IT (CIO), and key business units. Collaboration is essential for data gathering, context sharing, risk alignment, and securing buy-in.5
Establish Two-Way Information Flow: Ensure mechanisms exist not only for information to flow down (e.g., via cascades) but also for critical information regarding emerging risks, control gaps, or operational issues to flow up efficiently from technical teams and business units.19
F. Commit to Continuous Improvement:
Regularly Review and Adapt: Treat the metrics and communication strategy as a living process, not a static plan. Periodically review the effectiveness of chosen metrics, reporting formats, and communication approaches based on stakeholder feedback, changes in the threat landscape, evolving business priorities, and regulatory shifts.9
Stay Informed on Best Practices: Continuously monitor developments in cybersecurity metrics, risk quantification, communication techniques, and relevant regulatory requirements to ensure the approach remains current and effective.33
Implementing this integrated strategy is not a one-time project but an ongoing commitment requiring sustained effort, investment in tools and skills, and continuous adaptation.8 Its success fundamentally depends on the CISO's ability to build strong relationships, influence peers, and foster collaboration across the organization, making these interpersonal skills as critical as technical expertise.5
VIII. Conclusion
The increasing complexity of the cyber threat landscape and the growing recognition of cybersecurity as a critical business risk demand a more sophisticated approach to communication from CISOs. The traditional reliance on technical jargon and activity-based metrics creates a significant barrier to effective engagement with boards, C-suite executives, and even internal teams, hindering strategic alignment, resource allocation, and the development of a robust security culture.
Bridging this divide requires a fundamental shift towards an integrated strategy that combines outcome-driven, audience-tailored metrics with clear, compelling, and context-rich communication. By understanding the specific priorities of each stakeholder group—from the board's focus on strategic governance and financial impact to the CFO's emphasis on ROI and the CCO's concern with compliance—CISOs can select metrics that resonate and inform decision-making. Translating technical risks into tangible business impacts using techniques like financial quantification, analogies, and data-driven storytelling is crucial. Furthermore, implementing structured communication processes, such as cascading communication where appropriate, while maintaining agility through other channels, helps ensure consistent messaging and organizational alignment.
This integrated approach does more than just improve reporting; it is foundational to building trust and credibility for the CISO and the security function. Transparency fostered through consistent, understandable metrics and honest communication enhances oversight across risk committees and cultivates a culture of shared accountability for cybersecurity throughout the organization. Successfully implementing and sustaining this strategy requires ongoing commitment, investment in capabilities, strong cross-functional collaboration, and the CISO's continuous development of both business acumen and communication skills. By embracing these principles, CISOs can effectively navigate the evolving demands of their role, transforming cybersecurity from a perceived cost center into a recognized strategic enabler essential for long-term business success.
Works cited
Data-Driven Storytelling: How CISOs Can Win Over The C-Suite ..., accessed April 25, 2025, https://www.forbes.com/councils/forbestechcouncil/2023/11/29/data-driven-storytelling-how-cisos-can-win-over-the-c-suite-with-metrics/
Top Cybersecurity Trends and Strategies for Securing the Future | Gartner, accessed April 25, 2025, https://www.gartner.com/en/cybersecurity/topics/cybersecurity-trends
The NIST Cybersecurity Framework (CSF) 2.0, accessed April 25, 2025, https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
CISO's Guide to Presenting Cybersecurity Metrics to Board Members, accessed April 25, 2025, https://blackswan-cybersecurity.com/presenting-cybersecurity-metrics-to-board-members/
Enhancing CISO-Board communication: Three key questions for the CISO to answer, accessed April 25, 2025, https://sysdig.com/blog/three-key-questions-for-the-ciso-to-answer/
A CISO's Guide to Effective Communication with the Board | Weaver, accessed April 25, 2025, https://weaver.com/resources/a-cisos-guide-to-effective-communication-with-the-board/
A CISO's Guide to Communicating Cyber Risk to Business Leaders - GDT, accessed April 25, 2025, https://gdt.com/blog/chief-information-security-officers-cisos-and-communicating-risk-to-business-leaders/
Cybersecurity Metrics: Avoiding Common Pitfalls - GDT, accessed April 25, 2025, https://gdt.com/blog/cybersecurity-metrics-avoiding-common-pitfalls/
Best Cybersecurity Metrics to Use in the Boardroom - Kovrr, accessed April 25, 2025, https://www.kovrr.com/blog-post/the-cybersecurity-metrics-that-matter-most-in-the-boardroom
How CFOs Prioritize Cybersecurity: A New Strategic Imperative - RVNA Technologies, accessed April 25, 2025, https://www.rvnatech.com/cfo-forecasting/how-cfos-prioritize-cybersecurity-a-new-strategic-imperative
Beyond Meh-trics: Examining How CTI Programs Demonstrate ..., accessed April 25, 2025, https://www.sans.org/blog/beyond-meh-trics-examining-how-cti-programs-demonstrate-value-using-metrics/
Cybersecurity Metrics: The Good, the Bad and the Ugly - Risk.net, accessed April 25, 2025, https://www.risk.net/cyber-risk/5858641/cybersecurity-metrics-the-good-the-bad-and-the-ugly
Part I: Implementing Effective Cyber Security Metrics That Reduce Risk Realistically, accessed April 25, 2025, https://blog.qualys.com/qualys-insights/2023/07/20/part-i-implementing-effective-cyber-security-metrics-that-reduce-risk-realistically
assets-powerstores-com.s3.amazonaws.com, accessed April 25, 2025, https://assets-powerstores-com.s3.amazonaws.com/data/org/20033/media/doc/technology_risk_and_cybersecurity_metrics_for_your_159985276284300147a6-bfcaa469ac710acf275f33b9dc457bfa.pdf
6 Cybersecurity Metrics Every CISO Should Monitor - SecurityScorecard, accessed April 25, 2025, https://securityscorecard.com/blog/cybersecurity-metrics-cisos-should-monitor/
ISACA Now Blog 2021 Converting Technology Language to ..., accessed April 25, 2025, https://www.isaca.org/resources/news-and-trends/isaca-now-blog/2021/converting-technology-language-to-business-language-with-cyberrisk-quantification
Dear CISO, What's the ROI of Our Cybersecurity Investments? | Balbix, accessed April 25, 2025, https://www.balbix.com/blog/dear-ciso-whats-the-roi-of-our-cybersecurity-investments/
The Top Metrics for Cybersecurity Board Reporting - Kovrr, accessed April 25, 2025, https://www.kovrr.com/blog-post/what-cybersecurity-metrics-should-i-report-to-my-board
I'm a CISO who has built a successful security metrics and reporting program - Ask Me Anything about demonstrating security's value to the business. : r/cybersecurity - Reddit, accessed April 25, 2025, https://www.reddit.com/r/cybersecurity/comments/1iah488/im_a_ciso_who_has_built_a_successful_security/
Five Reasons the Cybersecurity Field Needs Trusted Data Sets and Meaningful Metrics, accessed April 25, 2025, https://insights.sei.cmu.edu/blog/five-reasons-the-cybersecurity-field-needs-trusted-data-sets-and-meaningful-metrics/
The CISO's Guide to Communicating Cybersecurity KPIs to the Board | Pure Storage Blog, accessed April 25, 2025, https://blog.purestorage.com/purely-educational/the-cisos-guide-to-communicating-cybersecurity-kpis-to-the-board/
CISOs and the Board: Why it matters more than ever - CySafe, accessed April 25, 2025, https://www.cysafe.ch/ciso_in_boards
How to Effectively Communicate Top Cybersecurity Metrics to the Board - CyberSaint, accessed April 25, 2025, https://www.cybersaint.io/blog/top-cybersecurity-metrics-for-the-board
How to Effectively Communicate IT Security to the Executive Board: 7 Best Practices - Syteca, accessed April 25, 2025, https://www.syteca.com/en/blog/how-to-effectively-communicate-it-security-to-the-executive-board
CYBER BUSINESS EXECUTIVE RESEARCH: CYBER BOARD COMMUNICATION & METRICS - HubSpot, accessed April 25, 2025, https://cdn2.hubspot.net/hubfs/2539908/Resources%20PDFs/Whitepapers/Executive%20Briefing_Cyber%20Board%20Communication.pdf?submissionGuid=e501fcce-6fd9-40c4-a9a7-23f3cf078aec
The CEO and Board's Guide To Understanding Cybersecurity - CyberSaint, accessed April 25, 2025, https://www.cybersaint.io/blog/the-ceo-and-boards-guide-to-understanding-cybersecurity
How to Present Cyber Risk in CFO-Speak - Balbix, accessed April 25, 2025, https://www.balbix.com/blog/how-to-present-cyber-risk-in-cfo-speak-2/
Balancing Security and ROI: The CFO's Guide to SIEM Investments - AKATI Sekurity, accessed April 25, 2025, https://www.akati.com/insights-blog/balancing-security-and-roi
Spend to save: The CFO's guide to cybersecurity investment - Security Intelligence, accessed April 25, 2025, https://securityintelligence.com/articles/spend-to-save-cfos-guide-to-cybersecurity-investment/
Cybersecurity Metrics & KPIs: What to Track in 2025 - SentinelOne, accessed April 25, 2025, https://www.sentinelone.com/cybersecurity-101/cybersecurity/cybersecurity-metrics/
SEC Requirements for Chief Compliance Officer - DFIN, accessed April 25, 2025, https://www.dfinsolutions.com/knowledge-hub/thought-leadership/knowledge-resources/chief-compliance-officer-sec-guidelines
Responsibilities of a Chief Compliance Officer - CyberArrow, accessed April 25, 2025, https://www.cyberarrow.io/blog/responsibilities-of-a-chief-compliance-officer/
Chief Compliance Officer, accessed April 25, 2025, https://www.chief-compliance-officer.org/
Chief Compliance Officers: How They Save the Day (and Your Firm) - Oyster Consulting, accessed April 25, 2025, https://www.oysterllc.com/what-we-think/blog-chief-compliance-officers-how-your-cco-saves-the-day-and-your-firm/
Navigating the New Cybersecurity Rules: What Companies Need to Know - Pastore LLC, accessed April 25, 2025, https://www.pastore.net/navigating-the-new-cybersecurity-rules-what-companies-need-to-know/
Chief Compliance Officer: What CCOs Do (and Why Your Company Should Have One), accessed April 25, 2025, https://www.digitalguardian.com/blog/chief-compliance-officer-what-ccos-do-and-why-your-company-should-have-one
Definition of Chief Data and Analytics Officer - Gartner Information Technology Glossary, accessed April 25, 2025, https://www.gartner.com/en/information-technology/glossary/chief-data-and-analytics-officer
What Is a Chief Data Officer (CDO)? - IBM, accessed April 25, 2025, https://www.ibm.com/think/topics/chief-data-officer
Understanding the Role and Organizational Impact of Chief Data and Analytics Officers, accessed April 25, 2025, https://cioinfluence.com/analytics/understanding-the-role-and-organizational-impact-of-chief-data-and-analytics-officers/
CDAO Strategy - Aus Government Data Summit, accessed April 25, 2025, https://govdata.com.au/stream-events/cdao-strategy/
Chief Data and AI Officer | Calendar, Costs, and Curriculum | Carnegie Mellon University's Heinz College, accessed April 25, 2025, https://www.heinz.cmu.edu/programs/executive-education/chief-data-ai-officer-certificate
Post-Breach Communication - How CISOs Should Talk to the Board - Cyber Security News, accessed April 25, 2025, https://cybersecuritynews.com/post-breach-communication/
Be Ready, Be Resilient: Hands-On Cybersecurity Training & Skill Validation for Real-World Threats | SANS Institute, accessed April 25, 2025, https://www.sans.org/blog/be-ready-be-resilient-hands-on-cybersecurity-training-skill-validation-for-real-world-threats
LDR519: Cybersecurity Risk Management and Compliance - SANS Institute, accessed April 25, 2025, https://www.sans.org/cyber-security-courses/cybersecurity-risk-management-compliance/
SOC Metrics That Matter: KPIs Every Security Team Should Track | ChannelE2E, accessed April 25, 2025, https://www.channele2e.com/native/soc-metrics-that-matter-kpis-every-security-team-should-track
SOC KPIs: Measuring the Effectiveness of Your Security Operations, accessed April 25, 2025, https://www.cadosecurity.com/wiki/soc-kpis-measuring-the-effectiveness-of-your-security-operations
20 Cybersecurity Metrics & KPIs to Track in 2025 - SecurityScorecard, accessed April 25, 2025, https://securityscorecard.com/blog/9-cybersecurity-metrics-kpis-to-track/
22 Cybersecurity Metrics & KPIs for Every CISOs - Sprinto, accessed April 25, 2025, https://sprinto.com/blog/cybersecurity-metrics/
Cybersecurity Metrics And KPIs You Need To Be Tracking - PurpleSec, accessed April 25, 2025, https://purplesec.us/learn/cybersecurity-metrics-kpis/
Cybersecurity Board Communication: How to Engage with Impact - Threat Intelligence Lab, accessed April 25, 2025, https://threatintelligencelab.com/blog/cybersecurity-board-communication-how-to-engage-with-impact/
Takeaway from ISACA Report: Cybersecurity Needs New, Quantitative Focus, accessed April 25, 2025, https://www.fairinstitute.org/blog/takeaway-from-isaca-report-cybersecurity-needs-new-quantitative-focus
7 Cybersecurity KPIs For Your Board of Directors | Bitsight, accessed April 25, 2025, https://www.bitsight.com/blog/7-cyber-security-dashboard-kpis-your-board-directors
Demonstrate Cybersecurity Effectiveness: 8 Powerful Factors and Metrics - Aryon, accessed April 25, 2025, https://www.aryon.com.au/blog/demonstrate-cybersecurity-effectiveness-8-powerful-factors-and-metrics/
Developing metrics to assess the effectiveness of cybersecurity awareness program, accessed April 25, 2025, https://academic.oup.com/cybersecurity/article/8/1/tyac006/6590603
Using transparency to build trust: A corporate director's guide - PwC, accessed April 25, 2025, https://www.pwc.com/us/en/services/governance-insights-center/library/using-transparency-to-build-trust.html
A CISO Blueprint for an Effective Board Narrative - Balbix, accessed April 25, 2025, https://www.balbix.com/blog/a-ciso-blueprint-for-an-effective-board-narrative/
Tactics for CISOs to create positive relationships with the board - Axonius.com, accessed April 25, 2025, https://www.axonius.com/blog/how-cisos-are-createing-positive-relationships-with-their-board
Getting the Board on Board with Cybersecurity | Binary Defense, accessed April 25, 2025, https://www.binarydefense.com/resources/blog/getting-the-board-on-board-with-cybersecurity/
7-Step Cascading Communication Strategy for Consistent Information - Cerkl Broadcast, accessed April 25, 2025, https://cerkl.com/blog/cascading-communication/
How to Secure the Extended Enterprise - CISO Insights on Third-Party Risk, accessed April 25, 2025, https://cybersecuritynews.com/third-party-risk/
Cascade Cyber Risk Management Between Rule and Reality - The Hague University of Applied Sciences, accessed April 25, 2025, https://www.thuas.com/media/inaugural-lecture-peter-roelofsma
7 Crucial Lessons for Cybersecurity Board Reporting | Kovrr, accessed April 25, 2025, https://www.kovrr.com/blog-post/communicating-cyber-risk-at-the-board-level-7-lessons-for-2025
Translating Cyber Risk into Business Risk - Cybersecurity Leadership Summit 2021, accessed April 25, 2025, https://www.youtube.com/watch?v=7swoRqTa_vI
