Kit · Leadership

Board communication kit

Under NIS2 the management body approves the risk-management measures and can be held liable for failing to. That changes the conversation: you are not asking for budget, you are asking them to make a decision they are already accountable for.

Audience: Management body
Cadence: Annual + post-incident
Frame: Decisions, not requests

All kits

The frame that works

A request for tooling invites a comparison against every other request for tooling. A statement of accepted risk invites a decision — and creates a record of who made it.

Both are the same conversation. Only one of them survives contact with a budget round, and only one of them protects the board by making the choice explicit and dated.

Reframing the ask

Instead of	Say
We need more analysts	At current staffing we cannot maintain triage targets outside working hours. The accepted risk is that an incident starting on Friday evening is first assessed on Monday.
We need a new platform	We currently have no visibility of these three environments. An incident originating there would be detected only if it moved into a monitored segment.
We need training budget	Two of our capabilities depend on one person. If they leave, our response time for that incident class goes from hours to days until we replace them.
The system owners are not remediating	These findings have been open past their due date. We are carrying the risk. Here is what accepting it means, and who is accepting it.

Preparing a management-body briefing

Every number needs a sentence saying whether it is good. A board that has to interpret your metrics will interpret them wrongly.

Per briefing

0/9

01Open with what changed in the exposure picture since the last briefing — not with activity volumes.
02State the three risks you are carrying, with who accepted each and when.
03Show the trend, not the point value. A single month's number tells them nothing.
04Say plainly what the SOC did not detect, and what you changed as a result.
05Present coverage as a percentage of the estate, and name what is outside it.
06Give the regulatory position in one line: obligations met, deadlines missed, filings due.
07Ask for exactly one decision, with the consequence of each option stated.
08Bring the evidence pack, but do not present from it — have it available for the question.
09Confirm the training obligation on the management body itself is being met.

The liability argument, used carefully

NIS2 makes management bodies approve the measures and holds them accountable for their implementation. Used as a threat, this makes you an adversary. Used as an offer — my job is to give you what you need to discharge that duty, and the evidence that you did — it makes you the person they call first.

Next kit

Team & competency kit

Roles and minimum qualifications per tier, the skills matrix, the training plan, and segregation of duties inside a small team.

Open Team & competency kit