What a board-ready cyber control narrative actually contains.

The gap

Activity is not the same as assurance.

Security teams can produce a great deal of accurate data that still fails to answer the board’s question. Counts of alerts, scans and blocked events describe work. They do not explain which business exposure is changing, whether the intended control is performing or what decision is required.

A useful narrative joins three levels: the exposure the organisation cares about, the control behaviour that changes that exposure, and the evidence that shows how the control is performing now.

Structure

Use one repeatable control narrative.

Consistency makes reports easier to challenge and compare. For every material control theme, use the same small set of fields and resist the urge to replace explanation with another chart.

• Business exposure and the assets or services within scope.
• Control intent: the behaviour the control is expected to create.
• Current performance, with period, baseline and evidence source.
• Material exceptions, compensating controls and residual exposure.
• Named owner, next action and the decision required from leadership.

Provenance

Keep the evidence trail close to the claim.

A credible number names its source, period, population and owner. This makes the report auditable, but it also improves the conversation: leaders can distinguish a genuine change in exposure from a change in tooling, scope or measurement method.

Where evidence is incomplete, say so. A bounded statement with a clear improvement action is more useful than a precise-looking percentage whose denominator cannot be defended.