How do I report network security to the board without jargon?
Describe outcomes and decisions, not technology. Instead of “we saw C2C2: command and control. The channel an attacker's software uses to receive instructions from the attacker's server. beaconing from a host in VLAN 20”, say “one accounting PC kept contacting an unknown server every five minutes; we isolated it on Tuesday, found malware, cleaned it and changed the passwords it held”. For each item, give what happened, what it could have cost, what you did and what you need from the board: a decision, a budget or nothing. Keep a standing page with the same few metrics each quarter, so changes are visible at a glance. End with what you still cannot see and what closing that gap would take. NetSenX writes each alert in plain language, which you can reuse, and its PDF reports, from the Starter plan, can go into the board pack as an annex.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.
Read next
Related questions
- What cyber security evidence do investors ask a small company for?
- Is network monitoring expected in investor due diligence?
- Can a 30-person company show investors it monitors for intrusions?
- How should we answer a customer who asks whether we have had a security incident?
- Is it better to disclose past security incidents to customers?
Terms used here
- C2 (command and control)
- The channel an attacker's software uses to receive instructions from the attacker's server.