Question

A newly appointed information security manager presents monthly reports to the board consisting of the number of blocked malware events, patched vulnerabilities, and firewall rule changes. Board members repeatedly ask why the security program deserves continued funding and how it supports strategic objectives. Which change to the reporting approach would BEST address the board's concern?

Accepted Answer

Report on how security initiatives reduce enterprise risk to acceptable levels and enable business objectives, expressed in business terms

Answer

Increase the frequency of the existing technical reports from monthly to weekly to demonstrate ongoing activity

Answer

Add detailed logs and raw event counts from security tools so the board can independently verify operational effectiveness

Answer

Benchmark the number of security incidents against industry peers to show the organization performs better than competitors