Cybersecurity Board Communication: How to Engage with Impact

Communicating cybersecurity to the board is often seen as a nerve-wracking task. Yet, it doesn’t have to be. From my experience, the key to overcoming the fear lies in preparation, understanding your audience, and focusing on clear, impactful communication.

Understanding the Fear Factor

Fear of speaking to the board usually stems from the weight of responsibility tied to cybersecurity. Cyber risks are complex, and the stakes are incredibly high. As the Chief Information Security Officer (CISO), you’re accountable for these risks, and the boardroom, with its high-powered members, can feel intimidating. However, it’s essential to remember that the board is there to support you.

They rely on the information you provide to make informed decisions about the company’s future. In fact, over 90% of boards get their cybersecurity information directly from the management team, which highlights your role’s significance.

Here’s the thing: managing your fear starts with reframing the situation. The board isn’t just there to judge—they’re there to guide and support. They understand that cybersecurity is critical to the business, and they look to you as the expert. That’s a powerful position to be in.

Cybersecurity Board Communication

One of the most important steps in effectively communicating with the board is knowing your audience. Board members often come from diverse backgrounds, and not all will have a deep understanding of cybersecurity.

While many boards now include members with some cyber experience, you can’t assume that everyone will grasp the intricacies of what you’re presenting.

This is why tailoring your message is crucial. Your presentation should be accessible to everyone in the room, regardless of their technical background.

I recommend using visual aids to simplify complex ideas and avoiding jargon that might confuse or alienate those less familiar with cybersecurity. The goal is to educate and inform, not to overwhelm.

For example, instead of diving deep into the technical details of a recent data breach, you could focus on the impact it had on the business and what steps are being taken to prevent a recurrence.

Explain the risks in terms they can relate to, such as financial loss, reputational damage, or regulatory penalties. This approach not only makes your message more relatable but also helps the board understand why cybersecurity should be a top priority.

Here are five quick tips on how to avoid using jargon:

1. Know Your Audience: Tailor your language to the knowledge level of your audience. Use terms they’re familiar with instead of technical language.
2. Use Analogies: Replace complex terms with simple analogies or everyday examples that your audience can easily relate to.
3. Define Terms: If you must use a technical term, briefly define it in plain language to ensure everyone understands.
4. Simplify Your Language: Opt for common words instead of specialized terms. For example, say “easy to use” instead of “user-friendly interface.”
5. Test Your Message: Before presenting, explain your points to someone outside your field to see if they understand. If they don’t, revise your language accordingly.

Be Honest and Transparent

Honesty is critical when communicating cybersecurity risks with the board.

The board appreciates transparency, especially in an area as complex and evolving as cybersecurity. Cyber threats are not static; they change and evolve, making cybersecurity a continuous process rather than a one-time fix.

When speaking to the cybersecurity board, be upfront about the challenges your team faces. Discuss the current state of your organization’s cyber maturity, the effectiveness of your measures, and how resources are being allocated.

It’s important to convey that cybersecurity risk is not binary; it’s not something that can be completely eliminated. Instead, it’s about managing risk effectively, understanding its nuances, and preparing for the unexpected.

For instance, if your organization recently experienced a near-miss cyber incident, don’t shy away from discussing it.

Use it as a learning opportunity to show the board how quickly your team responded, what was done to mitigate the risk, and what steps are being taken to prevent future incidents. This level of transparency builds trust and shows that you’re in control, even when challenges arise.

Here are three tips on how to effectively convey that cybersecurity risk is not binary:

1. Use Real-World Examples: Illustrate with examples where risk was mitigated but not entirely eliminated, such as companies that faced breaches despite robust security measures, highlighting the importance of ongoing management.
2. Visualize the Spectrum: Create visuals or diagrams that show risk on a continuum, from low to high, rather than as an on/off switch. This helps illustrate that risk management involves degrees of control rather than total elimination.
3. Discuss Uncertainty: Emphasize that cybersecurity is about preparing for uncertainty. Explain that the goal is to reduce the impact of unforeseen events, not to achieve an unrealistic state of zero risk.

Emphasize Metrics That Matter

When communicating with the board, it’s crucial to focus on metrics that matter most to them. Avoid getting bogged down in technical details¹ that don’t directly impact the business. Instead, highlight metrics that show how your cybersecurity efforts align with the company’s broader goals.

Key metrics like “mean time to visibility” and “mean time to response” are excellent indicators of how quickly your team can detect and respond to threats.

These metrics are critical because they directly relate to minimizing damage from cyber incidents. The faster you can detect and respond to a threat, the less impact it will have on the organization.

Moreover, it’s essential to frame these metrics in a way that resonates with the board. For example, instead of just saying, “We reduced our mean time to response by 20%,” explain what that reduction means in terms of reduced risk, potential cost savings, or enhanced protection of company assets. This approach makes your metrics more tangible and demonstrates the value your team brings to the table.

Remember, cybersecurity is a team sport. It requires collaboration across departments, and this should be reflected in your communication. Emphasize the collective effort required to maintain a robust cybersecurity posture and how each department plays a role in protecting the organization.

Managing the Evolving Role of the CISO

The role of the CISO² has evolved significantly in recent years (2016 – 2024). No longer just a technical expert, the CISO is now a key player in shaping the organization’s overall risk management strategy. This shift means that you need to be as comfortable discussing business outcomes as you are talking about firewalls and encryption.

Take ownership of this expanded role by engaging the board in strategic discussions about how cybersecurity aligns with the company’s broader goals.

Be bold in your recommendations and confident in your expertise³. The boardroom is your opportunity to drive meaningful change, and it’s essential to seize that moment.

For example, if you believe the organization needs to invest in new cybersecurity technology, don’t just present it as a technical need. Instead, within your cybersecurity board communication, frame it as a strategic investment that will protect the company’s assets, enhance customer trust, and support long-term business growth. This approach not only makes your case more compelling but also positions you as a forward-thinking leader who understands the business’s needs.

Breathe and Take Control

Lastly, don’t forget to breathe. Literally. Before stepping into the boardroom, take a few deep breaths from your belly and exhale slowly. This simple act can help calm your nerves and give you the focus you need to deliver your message with clarity and confidence.

I recommend that you also take a moment to remind yourself why you’re there. You’re the expert, and the board looks to you for guidance. Embrace that role, and let your confidence shine through.

Here are five tips for calming your nerves before presenting to the board:

1. Practice Deep Breathing: Before your presentation, take several slow, deep breaths from your belly. Focus on each inhale and exhale, which helps reduce anxiety and brings a sense of calm.
2. Visualize Success: Spend a minute imagining yourself confidently delivering your message. Visualization can boost your self-assurance and set a positive tone for your presentation.
3. Ground Yourself: Stand or sit with your feet firmly on the ground. This simple act of grounding can help stabilize your emotions and keep you centered.
4. Positive Affirmations: Remind yourself of your expertise and why you’re there. Repeat affirmations like, “I am prepared,” or “I am the expert,” to reinforce your confidence.
5. Focus on the Message, Not the Audience: Shift your focus from how the board perceives you to the importance of your message. This helps reduce pressure and keeps you centered on delivering valuable insights.

Seize the Opportunity

Communicating cybersecurity to the board doesn’t have to be a daunting task. By preparing thoroughly, understanding your audience, being honest and transparent, and focusing on the right metrics, you can turn what might seem like a challenging situation into an opportunity to lead and inform.

Remember, the board sees you as the expert in cybersecurity. They’re counting on you to provide the insights they need to protect the organization and make informed decisions. So, seize the opportunity, speak with confidence, and let your expertise guide the way.

1. https://www.sans.org/blog/a-visual-summary-of-sans-cybersecurity-leadership-summit-2021/ ↩︎
2. https://nzism.gcsb.govt.nz/ism-document/pdf/Section/12280#:~:text=The%20CISO%20SHOULD%20be%20responsible%20for%20establishing%20mechanisms%20and%20programs,3.2. ↩︎
3. https://nationalcioreview.com/wp-content/uploads/2024/06/pfpt-us-wp-voice-of-the-CISO-report.pdf ↩︎