The Pre-Read That Gets Read: The Two-Page Cyber Briefing

The board pack goes out a week before the meeting: eighty pages, of which the cyber section is twelve. By the meeting, most directors have read the agenda and the first two pages of everything. The cyber discussion runs on whatever the presenter says out loud.

This is fixable, and the fix is not louder advocacy for reading the pack. It is a cyber briefing engineered for reality: two pages that a director can absorb in six minutes, containing exactly what they need for the meeting's decisions.

Everything else - the metrics appendix, the program detail - can exist. It just cannot be the pre-read.

Key takeaways

• Two pages, six minutes, decisions first.

• Page one: the risk picture and what moved. Page two: what you need from the board.

• Write for the sixth-smartest person on the topic in the room - that is most of them.

• Move detail to an appendix; never delete it, just stop leading with it.

• Measure success by the quality of questions, not the thickness of the pack.

Step 1: Open with the three risks that matter now

Page one starts with the current top exposures in business language: the risk, why it is at this level, and what is being done. Three items, not twelve. A director who reads nothing else knows the shape of the world.

Resist ranking by technical severity. Rank by what would make a director say 'we should talk about that one first.'

Step 2: Show movement, not state

Directors see the pack four times a year; what they cannot reconstruct is direction. For each item from last quarter: better, worse, or stuck, and one line on why.

This fictional example shows the movement table. It is an illustration, not a real report.

Item	Last quarter	This quarter	Why
Phishing-driven account takeovers	Rising	Falling	New authentication rolled out to all staff
Vendor exception backlog	23 open	19 open	Two resolved, one new
Recovery test results	Untested	One passed, one finding	First full test completed

Step 3: Make the ask explicit

Page two is the reason the meeting exists: the decisions and input you need. Approve this risk acceptance. Note this incident and the changes it drove. Advise on this trade-off. Each ask gets its own short paragraph with the options and your recommendation.

Briefings that bury the ask get meetings that produce nothing. A director should finish page two knowing exactly what will be discussed and what their vote or view is needed on.

Step 4: Write it for the sixth-smartest reader

Every board has a spread of technical fluency. Write for the middle: spell out acronyms once, use business nouns, and test each sentence by asking whether it survives being read on a phone in an airport.

The test reader matters. Before the pack goes out, have one non-technical person read the two pages and tell you what they think the meeting is about. If they cannot, the briefing is not done.

Step 5: Move the detail, do not delete it

The appendix carries the metrics, the compliance mappings, and the program detail for directors who want depth - and some do. Link to it, reference it, keep it current.

NIST's framework asks governance communication to support decisions. Two pages that get read support decisions; twelve that do not support only the archive.

The related discussion of board-level cyber risk conversations is worth your time alongside this one.

Frequently asked questions

Will directors think two pages means the topic is lightweight?

The opposite, if the pages are good. Density signals effort but brevity signals command. The appendix exists for anyone who wants to verify the depth.

What about regulators or auditors who expect the detail?

They get the appendix and the full program documents - those audiences have different needs and different channels. The pre-read serves the meeting.

How do we handle a quarter where nothing much changed?

Say so on page one, in one line, with the two things you are watching. A quiet quarter reported honestly builds the credibility that matters in a loud one.

A Defensible Next Step

Cut your next cyber pre-read to two pages: top three risks with movement, and the explicit asks. Watch what happens to the quality of the meeting. Book a Decision-Clarity Call if you want the template.