The information security manager has been asked to give a program status update at the next board meeting, with ten minutes on the agenda. Which content is MOST appropriate?
Select an answer to reveal the explanation.
Short Explanation
Ten minutes with the board is like an elevator pitch with a much nicer elevator. They want to know: what are our biggest risks, are we on track, and what do you need from us? Activity counts and tool tours are the trap; they're busy numbers that don't help a director make a decision.
Full Explanation
The board's role is oversight: it sets direction, confirms risk appetite and holds management accountable. Reporting to it should therefore be brief, in business language, and focused on the organization's most significant information risks relative to appetite, the status of the security strategy and program against agreed objectives, and the specific decisions or support the board is being asked to give. This lets directors exercise oversight in the time available. A vulnerability list by system is operational detail that the board cannot act on and that obscures the overall risk picture. A walkthrough of architecture and tools describes how security is built, which is a management and technical concern rather than a governance one. Counts of blocked attacks, patches and training sessions are activity measures; they show effort, not whether risk is within appetite or whether the program is achieving its objectives. Exam caveat: detail is not wrong in itself; it belongs in management and operational reports, and can be available as an appendix if asked for. Operational check: confirm each item in the board pack links to a business objective or risk, states the trend, and makes clear whether a board decision is required.