Which of the following is MOST important to include in IT governance reporting to the board of directors?

The board of directors has ultimate oversight responsibility for the enterprise, making critical risks, especially those with potential strategic or material financial impact, paramount for their review. IT governance reporting must inform them of significant risks, their potential impact, and mitigation strategies to enable informed decision-making and fulfill their fiduciary duties.

Technology cost savings are important for operational efficiency, but they are typically a lower-level detail than critical risks for board-level governance reporting.

The general threat landscape is valuable information, but the board needs to understand the *specific critical risks* to the enterprise, not just the broader environment.

Security events are operational incidents; while significant events might be escalated, the focus for the board is on the *critical risks* that these events might highlight or represent, rather than a list of events themselves.