Five Questions Before the Dashboard: Rethinking Cyber Papers for UK Boards
Cyber reporting to UK boards has become more polished, not necessarily more useful. Directors now receive heat maps, trend lines and reassuring green tiles. Yet a paper can be visually complete and still leave the board unable to answer the only question that matters: what decision are we being asked to take? A blue-hat review starts from that sceptical position. It asks whether the board pack helps directors exercise their duties, or merely demonstrates that the security team has been busy.
The comfort problem in board reporting
Many cyber papers are designed for assurance rather than action. They describe activity: alerts triaged, patches applied, training completed, phishing simulations run. Those numbers have a place in operational reviews. At board level, they can create a false sense of control. A green dashboard is not a security control. It is a representation of selected data, often produced by the same function that owns the risk.
UK directors operate in a crowded accountability environment. Company law duties, UK GDPR, sector rules from the FCA and PRA, and NCSC guidance for boards all point in the same direction: cyber risk should be governed like other material business risk. That means reporting should connect security posture to the services customers rely on, to legal obligations, and to the choices only the board can make.
At BlueHat Group, we see the same pattern in many board packs. The security team has worked hard to produce the document. The board has little room to challenge it. The result is a ritual of acceptance rather than a record of governance.
Five questions for any cyber paper
1. What decision does this paper ask us to make? A board paper should state the decision plainly: approve funding, accept residual risk, defer a project, or note a change in posture. If the answer is simply noted, ask why the board is seeing it at all.
2. Which business services and regulatory obligations are exposed, and for how long? Directors need impact tolerances, not just severity ratings. A vulnerability on a billing platform matters differently from the same vulnerability on a marketing site. The paper should name the service, the obligation and the maximum tolerable disruption.
3. What evidence supports the rating? A red, amber or green rating without evidence is an opinion. Ask for the test result, the audit finding, the incident review or the control sample. Self-assessment has its place, but it should not be the only input.
4. What risk have we chosen to accept, and who owns it? Boards govern risk acceptance, not risk elimination. The paper should show where the organisation has decided not to fix something, who accepted that position, and when it will be reviewed. An unowned risk is an unmanaged risk.
5. How would we know if the control failed before a customer or regulator did? This question tests detection and escalation. A control that fails silently is not a control. Directors should expect a named failure signal, a threshold and a route to the board.
Spotting vanity metrics
Vanity metrics are those that look precise but do not change a decision. Common examples include the number of phishing emails blocked, the percentage of devices with an agent installed, the volume of alerts closed, and the number of staff who completed awareness training. None is worthless operationally. None tells a director whether a material business service is more resilient than it was last quarter.
More decision-useful measures include: the tested time to restore a tier-one service; the number of high-risk exceptions past their agreed remediation date; the percentage of critical suppliers with tested incident notification routes; evidence of a completed restore from immutable backups; and the number of material weaknesses with a named executive owner. These measures are harder to produce. That is part of their value.
A one-page template
The following structure can replace a longer pack. It should be completed by the accountable executive and challenged in the meeting.
| Section | What directors need | Evidence expected |
|---|---|---|
| Business outcome | The service or product at risk | Service owner and impact tolerance |
| Regulatory obligation | UK GDPR, sector rule or contractual duty | Mapping to the obligation |
| Current posture | A single rating with direction of travel | Test result or control evidence, not self-assessment alone |
| Decision required | Approve, reject, defer or fund | Options and trade-offs |
| Risk acceptance | Residual risk and owner | Named executive and review date |
| Failure signal | How we will know early | Metric, threshold and escalation route |
This template is deliberately austere. It removes the narrative comfort that often fills board packs. It forces the author to state the decision, the evidence and the owner. It also gives the board a clear basis for challenge.
Making the paper accountable
The board should not ask for more data by default. It should ask for better evidence and clearer choices. A cyber paper that cannot be reduced to a decision is not a governance document; it is a comfort document. UK directors are entitled to reporting that respects their time and their duties. The test is not whether the pack looks complete. The test is whether it helps the board govern.
