What a cyber risk number actually looks like on a board pack

Most cyber risk reporting to boards fails for the same reason: it is written in the language of the control, not the language of the decision.

A board pack page that says the risk is high has transferred no information. A page that says the modelled annual loss is between ₹3.1 crore and ₹7.4 crore, and ₹2.2 crore of the upper end is regulatory penalty gives the board something to approve, defer or fund.

Four numbers, not one

A single loss figure is easy to argue with and impossible to defend. Break the estimate into four parts and each part can be interrogated separately:

• Direct cost — response, forensics, notification, credit monitoring, overtime.
• Regulatory penalty — the exposure a specific regulator can impose under a specific rule.
• Loss amount — business interruption, lost revenue, contractual credits.
• Past-incident benchmark — what comparable incidents actually cost, used as a sanity check rather than as the model.

When the four lines are shown together, the conversation moves from is this real to which line do we reduce first.

Show the range, not the point estimate

Any single number invites false precision. A range with an explicit upper percentile is more honest and more useful: it lets a CFO reserve against the upper end and manage to the middle.

State what changed

The most valuable column on the page is the change since last quarter, and the reason for it. A number that never moves is a number nobody maintains.

What should not be on the page

Scenario methodology, calibration choices and internal scoring logic belong in the appendix or the tool, not in the board summary. The board needs the decision, the exposure and the trend.

If your current pack cannot answer what does this cost, what changed, and what would reduce it on one page, the pack is the problem — not the board's appetite for detail.