Speak the board's language

Exam

CISM

What it means

Reporting to senior management or the board should be in business terms: risk against appetite, trends, and decisions needed. Technical detail belongs elsewhere.

The trap answer looks like

Detailed vulnerability lists, firewall statistics or tool names.

The winning answer looks like

Risk against appetite, trends, business impact and the decisions needed.

Worked example

The board asks whether the organization is secure.

✅ Explain the risk posture relative to appetite and the key risks being managed

Nobody is perfectly secure. The board needs to know whether risk is where it wants it.