Should the board get cyber security reports from IT or from outside?
Both, for different purposes. Internal reports from IT or the security owner give the regular picture: metrics, open issues and decisions needed. An independent view, from an auditor, a penetration test or an outside adviser, checks every year or two that the internal picture is accurate. Relying only on internal reports means the people responsible mark their own homework; relying only on outside reports leaves long gaps between snapshots. Ask both to use the same few metrics, so their findings can be compared. Where possible, let the board see raw evidence as well, such as an alert report, not only slides. NetSenX reports come from your own network traffic, so they can support either kind of review, but they cover only what its sensors watch.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.