Which of the following is MOST important to include in information security program reporting to the board of directors?

The correct answer is C. Technology risk. The board of directors focuses on strategic decision-making and risk management, so the most important aspect of security program reporting is technology risk and its potential impact on business objectives. This helps the board understand cybersecurity threats, regulatory…

Submitted by thandi_sa· Apr 18, 2026Information Security Governance

Question

Options

AMetrics
BCost savings
CTechnology risk
DDetailed security incidents

How the community answered

(28 responses)

A
7% (2)
B
4% (1)
C
79% (22)
D
11% (3)

Explanation

The board of directors focuses on strategic decision-making and risk management, so the most important aspect of security program reporting is technology risk and its potential impact on business objectives. This helps the board understand cybersecurity threats, regulatory concerns, and investment needs at a high level. While metrics, cost savings, and incident details are useful, they are tactical rather than strategic and do not provide the broad risk perspective that boards

Topics

#Board reporting#Information security governance#Risk communication#Enterprise risk management

Community Discussion

No community discussion yet for this question.

Full CISM Practice