What your board will see
The quarterly report a Heights engagement produces for a board: posture, movement, decisions requested and roadmap status, in the language boards use for every other risk they govern.
The format
Reporting framed around decisions
Technical reporting counts things: vulnerabilities, patches, alerts. A board cannot govern with counts. Board reporting answers the questions directors actually hold: where do we stand, what changed, what do you need from us, and is the plan on track.
The format below is the structure every Heights engagement reports in, quarter after quarter, so the board sees movement rather than snapshots. The content shown is illustrative.
The sample
A quarter's report, illustrated
Illustrative content in Heights' reporting format. A client's report carries their program, their risks and their decisions; no client information appears below.
Quarterly Security Report to the Board
1. Where the program stands
The security program is operating against the roadmap the board adopted. Two of the three risks rated highest at the start of the year now have their controls in place and verified; the third is in progress and on schedule. One new obligation arrived this quarter through a customer contract and has been assessed and absorbed into the plan.
2. What changed this quarter
- Multi-factor authentication now covers all remote and administrative access; the exception list is empty.
- The incident response plan was tested with the executive team; two escalation gaps found in the exercise have been corrected.
- A key provider's contract was renewed with security obligations and evidence requirements now stated in the agreement.
3. Decisions requested of the board
- Approve the risk treatment recommended for the legacy platform: isolation and monitoring for eighteen months rather than immediate replacement, with the residual risk formally accepted and reviewed quarterly.
- Confirm the notification posture for the new state privacy obligation, so counsel and the program work to one position.
4. Risk register movement
| Risk, in business terms | Owner | Direction |
|---|---|---|
| A ransomware event interrupting operations beyond the recovery objective | Chief Operating Officer | Reduced |
| A customer audit the organization cannot evidence its commitments for | General Counsel | Reduced |
| A provider failure exposing data the organization is accountable for | Chief Financial Officer | Unchanged, treatment in progress |
5. Roadmap status
Phase two of three closes this quarter, one item carried forward with cause recorded. Phase three begins next quarter within the approved budget envelope. The full register, evidence and history stand behind every line above and are available to any director on request.
Reporting like this, for your board
The format is the engagement's standing output. What goes in it is your program.
Schedule a Confidential Consultation What the First Conversation Covers