Two key program milestones are behind schedule and a critical control has failed testing. The information security manager is concerned that reporting this will damage confidence in the program. What should the manager do?

Reporting exists to enable management decisions. A failed critical control means residual risk may exceed what management believes it to be, and delayed milestones may affect the business plans that depend on them. Reporting both transparently, with the resulting risk impact, the cause and a remediation plan with dates and owners, lets management decide whether to accept the interim risk, add resources or change priorities. Transparent reporting also protects the credibility of the program over time. Waiting until remediation is complete hides an exposure during exactly the period when management might want to act, and presenting it later as resolved misrepresents the history. Reporting only the milestones treats the control failure as an operational detail, but a failure of a critical control is a material change in risk that senior management needs to see. Briefing the chief information officer verbally while omitting the issues from the written report leaves no record, excludes other decision makers and looks like concealment if discovered. Exam caveat: the manner of reporting should be measured and factual, not alarmist. Operational check: confirm the report states the control, the risk it treats, the interim compensating measures, the remediation owner and the target date.