# Exercise: Developing Stakeholder-Specific Reports

To create more effective stakeholder-specific security reporting, use this template to map information needs:

1.Identify your key stakeholders (board, CEO, CFO, CIO, business unit leaders, etc.)

2.For each stakeholder, document: 

- Primary security-related responsibilities
- Decisions they make that are influenced by security
- Questions they typically ask about security
- Their preferred communication style and level of technical understanding
- Existing business reviews or reporting cycles where security could be integrated

With this stakeholder mapping complete, develop tailored report templates for each major audience:

- Executive Summary: 1-2 page highlight of key metrics, significant changes, and required decisions
- Board Report: 5-7 page comprehensive review of security posture, risk trends, and program maturity
- Business Unit Report: 3-4 page assessment of unit-specific security risks and mitigation status
- Technical Summary: Detailed metrics and findings for security and IT leadership

Evaluate the effectiveness of your reporting by collecting feedback after each reporting cycle:

1. Were the metrics clear and understandable?
2. Did the information drive specific decisions or actions?
3. Was the level of detail appropriate for the audience?
4. What additional information would be valuable in future reports?
5. What information provided minimal value and could be eliminated?

This continuous feedback loop ensures that security reporting evolves to meet stakeholder needs and maximize its business impact.

***

(c)[Kayne McGladrey](https://kaynemcgladrey.com/) - [Get the full book "Cyber Risk is a Myth"](https://www.routledge.com/Cyber-Risk-is-a-Myth-A-Business-Approach-to-Integrated-Risk-Management/McGladrey/p/book/9781041249054)