Advanced level · Module 1: Security Governance and Risk Management · Lesson 4 of 4
Reporting Cyber Risk to Leadership
Explain cyber risk in terms leaders can act on.
In this lesson you will
- Summarise risk for non-technical leaders
- Propose decisions and investments
Key concepts
risk appetitebusiness languagekey risk indicatorsdecision requests
The lesson
Leaders need to know which risks threaten the mission, how they are changing and what decisions are needed — not technical detail.
Use business language: 'A ransomware attack could stop payroll and donor reporting for two weeks' rather than 'unpatched SMB services'.
Report a few key indicators — MFA coverage, patch levels, backup tests, incidents — and ask for specific decisions such as budget or policy approval.
Step by step
- Choose the top five risks.
- Describe each in business terms.
- Select key indicators.
- Draft decision requests.
Practice activity
Write a two-page cyber risk report for the case NGO's board.
Expected result: A clear report with risks, indicators and decision requests.
Check your understanding
-
What do leaders most need from a risk report?
Show answer
Which risks threaten the mission and what decisions are needed.
-
Give one key risk indicator.
Show answer
MFA coverage, patch levels, backup test results or incident counts.
Taught live by an instructor — online or in person. Free course lessons are for self-study and do not lead to a certificate — see registration options.