Question

An information security manager currently sends the same monthly report—containing detailed patch counts, firewall rule changes, and antivirus signature updates—to both the IT operations team and the executive management committee. Executives have complained the report is not useful for their decisions. What is the MOST effective way for the security manager to improve the reporting?

Accepted Answer

Tailor the report content so executives receive business-oriented metrics tied to risk and objectives, while operational teams retain technical detail

Answer

Reduce the frequency of the executive report from monthly to quarterly to lower the volume of information

Answer

Add more technical detail and raw log data so executives can independently verify the security posture

Answer

Replace all narrative content with a single aggregated risk score for every audience