Certified Information Security Manager (CISM)Information Security GovernanceMedium
An organization is considering a significant investment in a new cloud-based data analytics platform. The board of directors requires assurance that the security risks associated with this platform are thoroughly understood and will be effectively managed. The CISO needs to provide a concise, high-level overview of the security implications and the proposed risk mitigation strategy. Which type of reporting is MOST appropriate for this scenario?
- AA comprehensive compliance matrix detailing adherence to all relevant industry regulations.
- BA detailed technical review outlining all vulnerabilities found in the platform's architecture.
- CA quantitative analysis of the mean time to detect and respond to incidents on similar cloud platforms.
- DAn executive-level risk report focusing on potential business impact, risk likelihood, and strategic mitigation plans.
Show answer & explanationAnswer & explanation
Correct answer: D. An executive-level risk report focusing on potential business impact, risk likelihood, and strategic mitigation plans.
For the board, a concise, high-level overview of security risks means an executive-level risk report. This type of report translates technical risks into business terms, focusing on potential impact, likelihood, and strategic mitigation, which aligns with the board's need for assurance in managing overall business risk.
Why the other options are wrong
- A. While compliance is important, a matrix is too detailed and doesn't provide the strategic risk overview the board requires.
- B. Detailed technical vulnerabilities are too granular for a board-level overview and don't address overall risk management.
- C. Operational metrics like MTTR are too low-level for a board seeking assurance on a strategic investment decision.
Executive Security Reporting
The practice of creating and delivering concise, business-oriented reports on information security posture, risks, and strategic initiatives to senior leadership and the board of directors.
- Focuses on business impact and strategic implications.
- Avoids technical jargon, uses clear, actionable language.
- Supports informed decision-making at the highest levels.
Memory trick: Give the board the strategic map, not every road detail.