What cyber metrics should a board see every quarter?
A few numbers the board can check and compare over time, not a long technical report. Useful ones are: open incidents and how long they have been open; serious alerts and how quickly someone looked at them; which sites, segments and devices are monitored and which are not; the date of the last successful restore test of backups; the share of accounts protected by multi-factor authentication (MFA); overdue critical patches; and incidents reported to authorities, with deadlines met or missed. Each number should have an owner and a one-line comment on what changed. NetSenX supplies the network part: alert and incident counts, deadline tracking for NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies. incident reports and the list of monitored segments. Backup tests, MFA and patching figures come from other systems.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.
Read next
Related questions
- Is a single cyber risk score meaningful for a small company?
- How do I report network security to the board without jargon?
- What cyber security evidence do investors ask a small company for?
- Is network monitoring expected in investor due diligence?
- Can a 30-person company show investors it monitors for intrusions?
Terms used here
- NIS2 (the EU's second Network and Information Security directive)
- The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies.