The information security manager is preparing the quarterly information risk report for the board of directors. Which content would BEST serve the board?
Select an answer to reveal the explanation.
Short Explanation
The board isn't flying the plane; they're deciding where it should go. So you give them the few big risks against appetite, which way they're trending and what they'd cost the business, not a vulnerability phone book.
Full Explanation
The board's role is oversight: it sets risk appetite, holds management accountable and decides whether the enterprise's risk position is acceptable. Reporting that serves this role aggregates information risk into the most significant exposures, compares them with the approved appetite, shows whether each is improving or worsening, and expresses consequences in business terms such as service disruption, regulatory exposure or financial loss. That allows directors to challenge management and direct resources. A full vulnerability list is operational data for technical teams; at board level it obscures what matters and invites directors into management detail. Activity counts show effort rather than outcomes; a quarter with many closed tickets can still end with higher risk. Exporting the whole register shifts the analysis work to the board and gives no prioritization or judgment, which is precisely what management is expected to provide. Exam caveat: detailed data remains necessary for management and operations, and the point is tailoring the report to the audience. Operational check: confirm each risk in the report has an owner, a position relative to appetite, a trend indicator and a short statement of business impact and planned treatment.