Cybersecurity Metrics for the Board: The Measures That Survive a Director's Questions

TL;DR: The metrics that survive a director's questions are a short list of risk-based key performance indicators (KPIs), each pairing a metric with a target and a time window. Group them by threat or by the six functions of the National Institute of Standards and Technology (NIST) Cybersecurity Framework 2.0, and report the share that met target. Show monthly trends over 90 days, keep hit-and-miss detail in the appendix, and add one slide on emerging risk.

Which security metrics do boards actually use?

In our reading, most boards get a short list of risk-based key performance indicators (KPIs), not a wall of operational counts. Each KPI pairs a metric with a target and a time window. The KPIs are grouped by threat or by function, and each group is reported as the share of its KPIs that met target.

That format answers a director's first question, whether the program is doing what it promised, in one line per group. The detail sits behind it for anyone who asks.

The shape of one board-level KPI

A KPI adds a risk-based goal to a metric. The worked example below follows a single vulnerability remediation measure from target to roll-up.

The scoring method is a simple ratio of achievement over total. The same guidance sets a rule of thumb: ninety days of evidence before calling a capability efficient.

Grouping by threat or by framework

There are two common ways to group KPIs. The first is by threat, such as ransomware or business email compromise. The second is by the six functions of the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF): govern, identify, protect, detect, respond, and recover.

Govern is the newer bucket. NIST released CSF 2.0 on February 26, 2024 and added Govern to the original five functions.

Why the summary has to be short

Board time is limited. The CISO-Board Engagement: 2026 Benchmark Report surveyed 663 chief information security officers (CISOs) on their board reporting. 95% said they provide regular cyber updates to the board. Only 25% got 30 minutes or more for board cyber discussions. The survey data was gathered from April 2025 through January 2026.

In our reading, the gap between regular reporting and real airtime explains the format.

A 2026 director's handbook takes the same position from the board's side. It says the board's focus should remain on strategic indicators rather than operational ones.

Building the deck

In practice, that means two layers:

• Lead with one line per threat or CSF function, showing the share of its KPIs that met target this quarter.
• Keep the per-KPI hit-and-miss figures ready. The guidance puts granular details in the appendix of the deck.

For how committees divide this oversight, see /reports/board-committee-oversight and /glossary/board-cybersecurity-oversight.

Directors rate current-state reporting well and forward-looking reporting poorly

Directors gave chief information security officers (CISOs) a mixed grade in the 2026 CISO-Board Engagement Report, a joint study by IANS Research, Artico Search and The CAP Group. Just 29% of directors called the cyber updates they received very effective, 53% said somewhat effective and 18% were neutral.

The average hides the useful part. Directors rated quality across six reporting areas, and the results split along one line: where the program stands today versus where risk is heading.

Compliance, initiatives and budget slides are landing. Threats, artificial intelligence (AI) and business risk are not.

Directors were worried before the reporting caught up

An earlier PwC Pulse Survey showed how far board concern had moved. In our reading, it linked that attention to the Securities and Exchange Commission (SEC) proposal, made in March 2022, to enhance and standardize cybersecurity disclosures. In that survey, 51% of directors saw cyber threats as a serious risk to their companies, against 40% in the C-suite. It was the top serious risk for directors.

The same survey found that 88% of directors said their company was considering revising or enhancing its cyber risk management. 58% said they would benefit from enhanced reporting from management.

In our reading, the two studies point the same way. Directors' concern ran ahead of the C-suite's, and current-state reporting does not answer the question that concern raises: what could change our exposure, and what should we do about it.

What to change in the deck

We think the fix is a short forward-looking page, not more slides. A workable version has three parts:

• The threats you are watching, two or three at most, each tied to a business process the board recognizes.
• What each would change: the systems, revenue or obligations exposed if it develops.
• The decision or adjustment you are asking the board to consider now.

AI risk belongs on that page because directors rated it among the weakest areas. Our AI governance guide for CISOs covers how to frame it. For how committees divide this oversight, see board committee oversight.

What a good cyber risk metric looks like

Security metrics fall into two classes, according to IANS. Deployment metrics show whether controls are set up correctly and how widely they cover. Risk-based metrics show whether those controls actually reduce losses.

They contained 171 different metrics, and about a third were yes-or-no checks on configuration. The rest measured coverage in six sigma levels. The highest level expects coverage above 99%.

IANS observes that most organizations focus on deployment metrics to the exclusion of all others. That is a reasonable place to start, but it measures rollout and not risk reduction. In the IANS piece's words, "Your mission is cyber-risk mitigation."

From a count to a goal

In the IANS model, a risk-based KPI combines three parts. The first is value at risk, and the most common proxy is an asset. The second is a control, such as vulnerability remediation. The third is a service-level target. The worked example from the scoring section looks like this month by month:

The three-month cumulative score is 95%, 334 of 350, which meets the target. IANS still marks the KPI yellow. Its rule is that a consistent decrease over three months turns the metric yellow even when the target is met.

In our reading, this is the main reason to show a trend rather than a single snapshot. A director who saw only the 95% would read the result as green. The monthly slide from 98% to 94% is what should prompt a question about capacity or volume. As the scoring section argued, a judgment like this needs a full quarter of evidence.

The test a director applies

We think a good metric points to a decision the board can take. The NACD 2026 handbook's metrics toolkit makes a similar case: the board's focus should remain on strategic indicators rather than operational ones. Its questions for directors include which controls deliver "the greatest risk reduction per dollar invested" and which are "underperforming or redundant." It also asks how management is tracking control improvements to stay within risk appetite.

A practical check for the pack follows from this. Next to each metric, write the decision it supports:

• fund a control
• accept a risk
• move a deadline
• retire a tool

If a line has no decision next to it, move it to the appendix. For how committees divide this oversight work, see our board committee report.

How NIST CSF 2.0 functions map to board metrics

The National Institute of Standards and Technology (NIST) released CSF 2.0 on February 26, 2024. The Cybersecurity Framework (CSF) names its audience directly. Beyond program leaders, it lists executives, boards of directors, acquisition professionals, technology professionals, risk managers, lawyers among those who can use it to guide decisions.

The framework sets outcomes and leaves the method to you. In NIST's words, "The CSF does not prescribe how outcomes should be achieved." That suits board reporting. The six functions give directors a stable structure, and the security team chooses the measures inside each one.

Govern is the new function, and the one directors own

CSF 2.0 added Govern to the original five functions. It covers organizational context; risk management strategy; roles, responsibilities, and authorities; policy; oversight; and cybersecurity supply chain risk management. In the earlier version, CSF 1.1 placed governance, business environment, risk management strategy, and supply chain risk management under Identify.

The oversight outcome reads close to a description of the board's job. Under it, the results and performance of cybersecurity risk management are used to inform, improve, and adjust the risk management strategy. In our reading, the other five functions supply the evidence and Govern is where directors act on it.

Using the functions as capability buckets

IANS Research suggests treating the functions as buckets and rolling up the key performance indicators (KPIs) in each one: if you have 10 KPIs under protect, you could then aggregate them together. For example, if eight of them meet the target, you would state 80% compliance to your protection goals. The same piece advises that granular details should be put in the appendix of a leadership deck.

The table below is our own mapping. Treat it as a starting draft to adapt.

One caution applies to every row. IANS offers a rule of thumb: Ninety days of evidence should be required to assess if a capability is efficient. In our reading, a single quarter-end snapshot per function will not survive a director's follow-up question about direction.

How to score a KPI so the board can trust the number

The earlier sections set out what a good key performance indicator (KPI) looks like. This section covers the arithmetic that turns one into a number a director can test.

Step 1: count hits and misses

IANS describes the simplest form of a service level agreement (SLA) as a hit-and-miss model: "Achieving your SLA is a hit. Not achieving your SLA is a miss." The score is hits divided by the sum of hits and misses.

Every case counts once. A month with a large backlog therefore weighs more than a quiet month.

The SLA is most often the achievement of a target rate over time. One month's ratio is a snapshot. The KPI is a claim about the program across a period.

Step 2: estimate how likely the target was truly met

A ratio above target can still come from luck, especially when the case count is small. The IANS method scores the share of cases that met the deadline, then uses an Excel formula to show how likely it is that you truly met the target rate.

It records hits of 95, 96, 100 and 95 over four months, against misses of 5, 4, 0 and 5. It reports an 80% probability of meeting the goal.

In our reading, the probability is the figure that holds up when a director asks whether a good month was noise. It turns a raw percentage into a statement of confidence.

Step 3: roll up by function or threat

Each KPI then goes into a group. The groups can be the NIST Cybersecurity Framework (CSF) functions, or threats such as ransomware, business email compromise, vendor risk (SaaS), third-party cloud risk, insider threats. For example, vulnerability management and malware defense both sit under protect.

Each group reports the share of its KPIs on target, as the CSF section showed. That gives directors one line per group.

When every KPI in a group meets its SLA, IANS suggests a plain summary line, for example: "Our ransomware control deployment and risk management goals have been met for this quarter."

We think the discipline is in the trail behind each line. If a group falls short, the security leader should be able to name the KPI that missed, show its hit and miss counts, and give the probability that it met target.

How board metrics connect to the SEC governance disclosure

The Securities and Exchange Commission (SEC) cybersecurity rules made board-level understanding of cyber risk a formal expectation. One reading of the rules puts it plainly: they codify this as a regulatory requirement, and "The Board and executive leadership must know the impact of cyber risks on the organization." That puts the board deck and the annual report on the same subject. In our reading, they should also rest on the same evidence.

One record, two audiences

We think the cleanest arrangement is a single metric set built around governance and risk management outcomes. The board sees it each quarter. The disclosure team draws on the same record when it drafts the cybersecurity section of the 10-K under Regulation S-K Item 106.

When the two drift apart, the risk is plain. The filing may describe a process the board has never seen measured. Or the deck may report outcomes the filing never mentions. Neither situation helps a director who signs off on both.

The Govern function from the earlier section on the NIST Cybersecurity Framework (CSF) is a useful spine here. In our reading, its categories line up with the topics a governance disclosure tends to cover: roles, oversight and risk strategy.

What to check in your own 10-K language

Pull the cybersecurity section of your most recent annual report and read it next to your last two board decks. The questions below are practical checks, not legal tests.

Where a row has a filing statement but no matching board evidence, you have found a gap worth closing before the next drafting cycle.

Keep the vocabulary consistent

In our reading, wording drifts between documents more often than facts do. If the deck calls something a control coverage rate and the filing calls it a security posture review, a reader cannot tell they are the same measure.

We suggest three habits:

• Use the same metric names in the deck, the appendix and any disclosure drafting notes.
• Give the disclosure team read access to the board appendix, so they draft from evidence rather than summaries.
• Record the date range behind each figure, so a quarterly board number can be matched to the fiscal period the filing covers.

Boards, in one practitioner view, care about outcomes: how cyber risks impact the bottom line, regulatory compliance, or operational continuity. In our reading, a metric set that already speaks in those terms leaves the disclosure team less to translate. For the wider rule set, see our guide to SEC cybersecurity disclosure rules for CISOs. For how reporting lines appear in filings, see CISO reporting lines in SEC 10-K filings.

Building the board pack over the first two quarters

In our reading, two quarters is enough time to move from a status update to a board pack that directors can question and trust. The order matters: agree what the board will tolerate before choosing what to measure, and score before presenting.

Quarter one: agree the terms, then measure quietly

Start with risk tolerance. In the IANS benchmark of chief information security officers (CISOs) and directors, the strongest relationships are those where the CISO gives updates and, in return, receives feedback, required resourcing and clear risk tolerance guidance. In practice, that means one working session with the risk or audit committee chair to settle which losses the business will accept and which it will not.

Then pick a handful of key performance indicators (KPIs) for each function of the National Institute of Standards and Technology Cybersecurity Framework. Each one needs an asset, a control and a target. IANS gives a model: fixing 95% of critical internet-facing vulnerabilities within 30 days over a 90-day period. We think three to five per function is enough. More than that and the roll-up stops meaning anything.

Run the full quarter as a baseline before any number reaches the board. Score each KPI as the earlier section described, note which ones trend down, and fix definitions that turn out to be ambiguous. In our reading, a metric that changes definition after its first board appearance loses credibility fast.

Quarter two: present for the time you actually get

Plan for short airtime. Only 25% of CISOs get extended airtime of 30 minutes or more for board cyber discussions, according to a survey whose data was gathered from April 2025 through January 2026. Build the pack so the first two slides stand alone: function scores against tolerance, then the one decision you need. Everything else goes to the appendix.

Reserve one slide for emerging risk, the area directors rate weakest. IANS describes the missing piece as horizon scanning, emerging threat scenario analysis and how AI-related risks could change the organization's course. One director put the request plainly: "We get a clear picture of the current risk posture, but I’d like updates to focus more on what’s coming next." The same research notes the fix is not about adding more content, so this slide replaces something rather than adding a page.

For the reporting relationship that frames this work, see /guides/ciso-reporting-structure, and for the wider first-quarter plan, /guides/ciso-first-90-days-plan.

What this guide does not cover

This guide does not cover choosing security tools or vendors, putting a dollar value on risk appetite, or the detail of how board committees divide oversight. For the rules and the record behind it, see CISO Accountability: What the Rules Actually Put on the Role.