A useful starting point for a CISO board report is the decision sought. In our fictional sample, two Critical risks concern administrator access and recovery after ransomware. The proposed decisions concern engineering time and a recovery exercise window. The report explains why those requests remain open instead of leaving the reader with a count of red items.
Give the numbers a reporting date
The sample contains five active risks at 18 September 2026: two Critical, one High and two Moderate. One additional record is Closed. These are counts within a fictional register, not a measure of the entire organisation’s exposure. No earlier baseline is supplied, so the report makes no claim that exposure improved. That boundary prevents a snapshot from being presented as a trend.
Explain overdue work precisely
One action and one review are overdue in the example. They refer to different records. The AI information-exposure review is overdue even though its next action is not. Keeping those signals separate helps a board understand whether work is late or whether an assessment needs refreshing. A Moderate score does not make a pending information-handling decision disappear.
Retain the uncertainty
Successful backup jobs do not, by themselves, establish recovery time. Our sample therefore leaves recovery time unknown pending a timed restore exercise. Similarly, an Accepted status keeps a legacy-application risk active. The report points back to the controlled exception record for the actual approver, approval date and precise expiry. These qualifications give the board a more accurate basis for discussion.
Use the sample as a starting point
Download the free editable Word sample: https://payhip.com/b/7Yw4N
It includes the fictional summary, decision requests, follow-through and adaptation guidance. The separate £29 Excel kit adds the blank register, worked workbook and quick-start guide: https://payhip.com/b/b8dPV
The report has no live link to Excel; every adapted figure and decision needs checking against the organisation’s current records.