The security manager needs a common, nontechnical language to explain the organization's cybersecurity posture and priorities to the board. Which approach would BEST meet this need?
Select an answer to reveal the explanation.
Short Explanation
The board needs the forest, not every tree. A framework built around a handful of plain-language functions lets you show where you're strong, where you're weak, and where the money's going in a way directors can follow. The trap is drowning them in technical detail and calling it transparency.
Full Explanation
The NIST Cybersecurity Framework organizes cybersecurity outcomes into a small number of high-level functions, such as identifying, protecting, detecting, responding and recovering, together with governance, using language designed to be understood by both technical and nontechnical audiences. That structure gives the board a consistent way to see current and target posture, compare priorities and follow progress over time without needing to understand individual technologies. A detailed technical control catalogue mapped to every system is useful for practitioners and auditors but overwhelms a board, obscures priorities and invites discussion of detail that belongs to management. Vulnerability scan results ranked by severity describe technical weaknesses at a point in time; they do not convey overall posture, business impact or strategic direction, and severity scores are not business risk ratings. Penetration test findings and exploit paths are valuable for remediation but are narrow, technical and episodic, and walking through them would push the board into operational detail. Exam caveat: the framework is a communication and organizing tool; it should still be linked to business risk and appetite to be meaningful at board level. Operational check: present current and target profiles by function, with business risk commentary, and confirm the board can use the view to make prioritization decisions.