Most companies do not survive their first decade, let alone their second century. Statistics say that about 50% of all small businesses wrap up within the first five years, usually for the reasons you’d expect: cash flow problems, a shrinking market, poor management and competition that outperforms them. Cybersecurity breaches are the newest line item on that list, often acting as a catalyst for insolvency.
A UK haulage company, KNP Logistics Group had weathered all of these older risks for 158 years, running a fleet of roughly 500 trucks nationwide.
However, that stellar track record ended in a matter of days in June 2025, when a single weak password gave the Akira ransomware group a way into the Northamptonshire-based firm’s systems. The attackers didn’t need to orchestrate a complex phishing scheme or an unpatched software flaw. A weak password an employee had chosen, and hackers were able to guess because there was no multi-factor authentication on the account, was all it took.
They then encrypted the data within hours and wiped out local backups too, so there was no fallback copy to recover from.
Deprived of its logistical and accounting data, KNP was unable to fulfill its contractual obligations, ensure timely deliveries, or manage its financial flows.
Next, the attackers demanded a £5 million ransom, which obviously the company could not afford to pay. After several months of fruitless attempts to recover the data, KNP declared bankruptcy, leaving approximately 700 employees without jobs.
All throughout that period, the board did not have any live decision points during the attack and were only apprised of the full story after the company was unable to function anymore.
KNP’s board of directors wasn’t scheduled for its next quarterly briefing for months, and it was too late by the time Akira had already infiltrated the network and crippled it beyond repair. A reporting cycle meant to review the numbers from the previous quarter simply doesn’t account for problems that manifest themselves before the next set of financial reports is due.
This article explains what a board pack is, the usual contents, the rationale for why cybersecurity and broader security reporting require a different approach to reporting, the elements that constitute effective reporting and the considerations for ensuring there is continuity between reporting cycles.
What Is a Board Pack?
A board pack is a set of papers given to directors before a meeting, including the agenda, minutes, financial statements, reports on risks, and other paperwork related to the decisions under consideration during the meeting cycle.
The content of these packs varies depending on the meeting’s nature and usually has different levels of detail. Take an annual meeting for example. The pack is usually much thicker than what you’d see for a regular quarterly one. And a meeting called after an incident looks different again. It has less formal minutes and more specifics on what actually went wrong.
However, regardless of the meeting’s nature, the pack’s purpose is to give directors enough information to allow them to ask specific questions and make decisions at the meeting rather than prepare for it.
What Is Included in a Board Pack?
A standard pack typically covers:
- Agenda
- Minutes from previous meetings
- CEO or executive summary
- Financial statements
- Risk and compliance reports
- Committee reports
- Plans or proposals
- Key Performance Indicators (KPIs) and dashboards
- Supporting documents
Quantity does not equal quality when it comes to governance. According to Diligent Institute’s 2026 GC Risk Index, only 21% of the legal leaders felt highly confident that their board is receiving an appropriate level of risk information. Much of the difference stems from the fragmentation issue, where in certain organisations, the risk and regulatory alignment functions report completely separately to each other, creating more difficulty in presenting a consolidated view to the board.
With cybersecurity risk, the challenge of getting the right information mix is even more pressing, since the opportunity cost of getting it wrong is far greater and more immediately apparent than with most other risk factors.
How Is a Board Pack for Cyber Risk and Security Posture Reporting Different?
A cyber risk and security posture board pack has the same basic structure as that of a general risk pack, but the information inside it is more time-sensitive and more exposed, which is exactly why it requires more care and caution in how it’s handled.
Pace
Board reporting has always been dictated by the slowest of speeds, and financial statements are a prime example. Nothing changes between the day it is written and the day the board reviews a financial statement of the quarter that just ended.
A security vulnerability is not a financial statement in that it cannot pause just because it was disclosed on a Tuesday and the next available report is on the following Monday. The Log4j vulnerability disclosure in December 2021 saw many organisations reporting on exposure to the flaw at their next board meeting, when attackers worldwide had already been testing and successfully exploiting the vulnerability for several days. An attacker who doesn’t use the board calendar will always have an advantage over a pack that only follows the beat of the board.
Translation
A CVSS (Common Vulnerability Scoring System) score of 9.8 or a reference to a specific MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) technique would give a clear understanding of the situation. It, however, will be hardly intelligible to a director until someone breaks it down for them into a statement about exposure, cost, and probability.
When you say,”we have an unpatched critical vulnerability in our customer database”, the board understands it loud and clear. But when you phrase it like “we have a CVSS 9.8 SQL injection vulnerability in the CRM layer”, they will be unable to comprehend the scale of the attack buried under all that technical jargon, even though both statements describe the same problem.
Confidentiality
The information contained in any details about a vulnerability or a security breach is sensitive in nature because if it leaks outside the boardroom, the information itself can turn out to be a target list for the hacker.
A package containing the exact list of systems with unaddressed weaknesses or specifics on the firewall design would provide an intruder with a detailed scenario of the most probable ways of intrusion, and for this reason, this kind of data requires a higher level of protection than a regular financial report.
Regulatory Specificity
Cyber obligations tend to have a framework that falls outside general risk and governance management. For instance, financial institutions operating in the UAE are subjected to the National Electronic Security Authority (NESA) requirements and the Central Bank of the UAE (CBUAE) cybersecurity expectations, whereas the companies listed in the US have to follow the regulations stipulated by the Securities and Exchange Commission (SEC) and report any significant incidents within four business days. In other words, a generic risk pack will not suffice by itself to address the requirements specific to each and every regulator.
Multiple Authors
A cyber update usually comes from the CISO (Chief Information Security Officer), IT operations, legal, and compliance, and if left to its own devices, these four departments will provide four different stories.
The CISO will talk about threats and incidents, IT will report on patch status, legal will brief on exposure to breach notification, and compliance will cover audit findings. No one ties it all together to decipher the true context and create a cohesive picture of the current state of the organisation’s cyber hygiene.
What Makes Up an Effective Board Pack for Cyber Risk and Security Posture Reporting?
The five elements listed below cover what to include in each section and why it’s there. A lot of it comes back to normal board-paper habits: keep it short, keep the language plain, be clear about what you’re asking the board to decide.
The only difference is that a security update can change completely from one board meeting to the next, so each section below highlights where that change might occur and how frequently it is likely to occur.
1. Scope
A scorecard reflecting 94% of critical patches applied, says nothing about the potential impact on the business of the remaining 6% not applied. Every metric in the pack must have an accompanying business consequence attached to it: potential revenue losses, penalties associated with non-compliance, reputational damage to specific customers/markets.
Add outside context as well. For example, you can mention a breach announcement from a competitor, or a security threat alert specific to your industry. When the CISO doesn’t talk in abstracts during his presentation, the board too doesn’t evaluate the company’s cybersecurity posture in a vacuum. Rather than simply saying “this and this have been done”, if there is an approach to mitigating a particular risk, also provide one or more alternatives, along with a qualitative and quantitative assessment of the residual risks and associated costs.
2. Distribution Timed to the Threat, Not the Calendar
Normal distribution cycles of seven to fourteen days work well for routine patches, but they are ineffective when there is a critical vulnerability discovered just three days prior to the board meeting.
Establish criteria that when met would allow for immediate action (e.g., vulnerability with critical severity, confirmed active exploitation, successful breach of the environment,.) and an out of cycle briefing. The distribution should be done via a secure portal with restricted access based on a need-to-know basis and state only the changes since the last cycle. You don’t have to distribute the full history of each release.
3. Communication Calibrated for a Non-Technical Audience
Cap each topic at five pages, so the report writer is forced to narrow the scope down to the three or four points a director strictly needs to know. Instead of providing CVSS scores and technical-specific severity ratings, translate the potential threats to risk categories based on their likelihood and impact on the business.
In addition to that, describe the situation, its ramifications, and the required response or the degree of involvement for the executive board. If the report has points that apply to several domains, consider using a standard color-coded system (red-amber-green) across network, endpoints, cloud, and third-party vendors. This way, it will become easy for the directors to follow the context of a specific action item and assess the organisation’s posture quickly in relation to it without getting lost in details and technical specifications.
4. A Workflow That Produces One Coherent Report
When the CISO’s incident summary and the compliance team’s regulatory update follow separate formats, the onus falls on the board to reconcile these differences.
Have a standard format for the input from IT, information security, and compliance, so that no one has to make sense of conflicting information at the meeting. Set firm deadlines for submitting components to the packet, and for who takes responsibility for what (especially if there are still unknowns days before the presentation).
Moreover, embed reminders for the submitter about areas of particular interest to the board, like current and future threats, controls, remediation timelines, and requests for personnel or budget. If the company operates across multiple entities or regions, keep the same format so that the board reviewing all of them can easily compare and contrast the information from each.
5. Expert Input Mapped to Regulatory Obligation
No one else in the reporting chain can provide the depth that a CISO or external security advisor does, but this depth must be framed in the right context.
Make sure the information provided is filtered through those regulatory frameworks the company has set for itself, which means the board can see its compliance position at a glance. It should have sufficient technical detail to be genuinely informative but not so detailed as to overwhelm or distract the directors. The results of audits and assurance checks, penetration tests, and any security-related third-party reviews must also be given due emphasis and placed in their own category, because these will be the most effective stimulus to board action whenever there is a finding.
We Close the Gap Between Reporting and Practice
A cyber risk and security posture pack does not earn its value by the amount of technical detail it contains. Rather, it becomes valuable when a director can read it once and make a decision immediately.
Paragon Consulting Partners specialises in working with management teams and report authors who need external help in getting the board pack for cyber risk and security posture reporting
to the point where it ticks all the boxes for brevity and clarity. After all, the very reason for preparing this document is that the board can make decisions on their own without having to ask someone else to interpret it.
Our deliverables include but are not limited to:
- Assessing board packs in relation to the five components discussed and identifying specific areas of improvement
- Training CISOs, IT managers, and compliance officials to craft reports in a manner that avoids technical jargon and focuses on business matters
- Creating templates that encourage collaboration and standardised reporting, as opposed to discrete contributions from different authors
- Designing report production calendars that define submission windows for regular briefings on cybersecurity and technology matters
- Aligning reporting obligations with the relevant regulatory frameworks for a given organisation
- Conducting board-level presentations or table top exercises that help report authors identify weaknesses in their message or delivery
