Before a quarterly meeting, the CISO must brief the municipal audit committee on top cyber risks, treatment status, and trend indicators. Which activity is required?

Risk reporting packages identified risks, owners, treatments, thresholds, and key risk indicators into a form governance stakeholders can use. Before a quarterly municipal audit committee meeting, the CISO must present current cyber risk posture clearly—what is elevated, what treatments are underway, and which trends matter—so oversight can steer resources and challenge gaps. Transparent reporting is a core security-program management activity, not optional decoration. Deleting the risk register so members are not alarmed destroys the evidence base for oversight and is a governance failure. Concealing risk to manage emotions violates the purpose of an audit committee briefing. Replacing risk metrics with only help-desk ticket counts substitutes operational volume for risk posture. Ticket counts may inform service load but do not communicate residual cyber risk, treatment status, or threshold breaches on critical systems. Presenting only successful phishing-click rates with no context on critical systems offers a narrow awareness metric without tying it to business impact, asset criticality, or overall residual risk. Isolated vanity metrics mislead governance. Exam caveat: Governance briefings require risk reporting that conveys posture, ownership, treatment, and trends. Suppressing registers or swapping in unrelated operational tallies fails the oversight objective. Operational check: Produce a committee-ready risk report from the live register, highlight top municipal risks with owners and KRIs, note threshold breaches, and retain the report for audit evidence of oversight.