# Cybersecurity board briefing template

https://en.kinlevi.com/resources/security-board-briefing

## 1. Service and commitment

Which service, customer promise or essential operation is exposed? Name its critical dependency and the accountable business role.

[Complete this section]

## 2. What changed

Describe the new finding or change since the last review. Include when it was observed and why a decision is needed now.

[Complete this section]

## 3. Evidence and uncertainty

Separate verified facts, evidence sources, working hypotheses and unchecked assumptions. State what the available evidence cannot show.

[Complete this section]

## 4. Business consequence

Explain plausible customer, continuity and operational impacts. If using an estimate, record its assumptions and uncertainty.

[Complete this section]

## 5. Options and deferral

Compare feasible actions, delivery costs, residual exposure and staffing needs. Include the consequence of delaying the decision.

[Complete this section]

## 6. Decision requested

State the exact approval or tradeoff, who has authority to decide and when the decision is needed.

[Complete this section]

## 7. Owner and next action

Assign an accountable role, the next observable action and its deadline. Describe any resource or dependency blocking delivery.

[Complete this section]

## 8. Review trigger and success evidence

Specify what would change the choice, when it will be revisited and what evidence will demonstrate the intended result.

[Complete this section]

## Method and references

An original editorial worksheet informed by risk-governance references. It is not an official NIST or CISA template or a certification.

- [NIST Cybersecurity Framework 2.0](https://www.nist.gov/cyberframework)
- [NIST CSF 2.0 — Frequently Asked Questions](https://www.nist.gov/cyberframework/faqs)
- [CISA Cross-Sector Cybersecurity Performance Goals](https://www.cisa.gov/cybersecurity-performance-goals)