Board Cybersecurity Metrics That Mean Something

Why counts fail in the boardroom

"We remediated 14,200 vulnerabilities this quarter" sounds like progress. A director cannot tell whether it is good news. The number has three problems:

1. No denominator. It goes up when scanning coverage improves, whether or not risk goes down.
2. No threshold. Nobody has said what number would be too high.
3. No decision. Nothing the board could do would change it next quarter.

NIST's measurement guide, SP 800-55 Volume 1, separates four kinds of measures:

• Implementation measures: is the control deployed?
• Effectiveness measures: does it achieve its purpose?
• Efficiency measures: how quickly do controls give feedback and get issues fixed?
• Impact measures: what does security mean for the organization's mission and finances?

Most board packs are full of implementation measures. Directors need effectiveness, efficiency and impact.

Expectations of boards have also become clearer:

• NIST CSF 2.0. The Cybersecurity Framework 2.0 added a Govern function covering risk strategy, risk appetite, roles and oversight.
• CISA CPG 2.0. CISA's Cybersecurity Performance Goals 2.0, released December 2025, added governance goals focused on executive accountability.
• NACD-ISA handbook. The 2026 NACD-ISA Director's Handbook on Cyber-Risk Oversight makes measurement and reporting one of its six principles. It stresses reporting that is aligned to the business and expressed in financial terms where possible.
• SEC rules for public companies. The SEC's 2023 cybersecurity rule requires annual disclosure of how the board oversees cyber risk (Regulation S-K Item 106). It also requires a Form 8-K filing within four business days of determining that an incident is material. Industry groups have petitioned to rescind the 8-K requirement. As of October 2026, the SEC had not proposed a change, and both requirements remain in force.

A test for any board metric

Before a measure goes in the board pack, check that it has:

• A link to risk. It relates to a scenario the board cares about, such as ransomware halting operations, theft of regulated data or loss of a critical supplier.
• A target and a tolerance. Thresholds for green, amber and red are defined in advance and approved, not chosen after the fact.
• A trend. At least four quarters, so direction is visible.
• An owner. A named executive answers for it.
• A decision it supports. If it moves into red, the board knows what it would be asked to approve or accept.

A decision-grade metric set

These nine measures fit on one page. Change them to suit your risk profile, but keep the discipline: few measures, defined thresholds, clear owners.

1. Exposure window on known-exploited vulnerabilities

The share of internet-facing and critical systems carrying a vulnerability listed in CISA's Known Exploited Vulnerabilities catalog, and the median days to fix them. KEV narrows thousands of findings to the ones attackers are known to use. Exploit-probability scores such as FIRST EPSS and NIST's proposed LEV metric can help rank the rest. Decision it supports: resourcing for patching, and accepting risk on systems that cannot be patched.

2. Coverage of foundational controls

The percentage of in-scope assets with each of these in place:

• Endpoint detection.
• Phishing-resistant MFA for privileged and remote access.
• Centralized logging.
• Supported, patchable operating systems.

The figure is only meaningful if asset-inventory completeness is reported alongside it. Decision: funding for coverage gaps, and timelines for retiring legacy systems.

3. Tested recovery time versus business need

For the five to ten systems the business cannot run without: the most recent tested restore time against the recovery-time objective the business set, and the date of the last successful test from protected (immutable or offline) backups. Decision: investment in resilience, or a formal acceptance of a longer outage.

4. Time to contain

Median time from detection to containment, from real incidents and from exercises. Report the trend and the number of exercises held. Decision: staffing, managed detection services, and how often to exercise.

5. Privileged access

The number of standing privileged accounts, and the share of administrative access granted just-in-time. Fewer standing privileges means a smaller impact when an account is compromised. Decision: priority of identity projects.

6. Third-party and managed-service-provider risk

The share of critical vendors assessed within policy, and the number with direct access to your network or privileged access. CPG 2.0 added a goal specifically on managed-service-provider risk. Decision: contract terms, concentration risk and alternative suppliers.

7. Open risk acceptances and exceptions

Count, age, and the number past their expiry date. This measure shows whether risk decisions are being made deliberately or by default. Decision: renew, fund remediation, or escalate.

8. Top loss scenarios

The three to five scenarios that matter most, each with an estimated range of loss and how it has changed since the last report. Examples include ransomware stopping operations for a week, or a breach of customer data. The range can come from structured expert estimates or from a quantitative method such as FAIR, the model behind The Open Group's risk taxonomy and risk-analysis standards. Ranges are more honest than single figures. Decision: insurance limits, risk appetite and investment priorities.

9. Program delivery against risk retired

Status of funded security initiatives, and which scenario or metric each is expected to improve. Decision: whether to continue, re-scope or stop each initiative.

Mapping to NIST CSF 2.0

Presenting it

• One page, with a short narrative: what changed, why, and what you are asking for.
• Thresholds defined in advance and approved by the board or its committee. Amber should mean something specific, not "we are a bit worried."
• Four to six quarters of trend per metric. Directors judge direction better than single readings.
• A "decisions requested" section at the top. If there are none, say so.
• Supporting detail in an appendix, including definitions, data sources and known gaps in the data. SP 800-55 Volume 2 covers documenting measures and data quality.

Moving over in two reporting cycles

Cycle 1

• Agree the top loss scenarios with the executive team.
• Choose six to nine measures and write a definition for each: formula, data source, owner and frequency.
• Gather a baseline. Where data is missing, report the gap rather than an estimate.
• Propose thresholds for discussion.

Cycle 2

• Get thresholds approved at committee.
• Present the first trend points and the decisions requested.
• Retire the old activity counts, or move them to an appendix.
• Set a review each year so metrics change as the risk profile changes.

Getting help

If your board pack is full of activity counts and you want measures your directors can act on, tell us what decisions your board faces. We will reply with a short scope and a timeline, or tell you plainly if we are not the right fit.

This article is general information, not legal advice. Public companies should confirm disclosure obligations with counsel.

Sources

1. NIST Cybersecurity Framework 2.0 (CSWP 29)
2. NIST SP 800-55 Vol. 1, Identifying and Selecting Measures
3. NIST SP 800-55 Vol. 2, Developing a Measurement Program
4. NACD-ISA Director's Handbook on Cyber-Risk Oversight, 5th ed. (2026)
5. SEC final rule, Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure (Release 33-11216)
6. SEC, joint petition to rescind Form 8-K Item 1.05 (File 4-856)
7. CISA Cross-Sector Cybersecurity Performance Goals 2.0 (Dec 2025)
8. CISA Known Exploited Vulnerabilities Catalog
9. FIRST Exploit Prediction Scoring System (EPSS)
10. NIST CSWP 41, Likely Exploited Vulnerabilities

Facts and regulatory status checked as of October 24, 2026. This article is general information, not legal advice.

All insights