Information Security Governance and Board Report Template (ISO/IEC 27014)

Governing body vs management roles, evaluate/direct/monitor/communicate processes, governance calendar, board KPIs and KRIs, board report format, escalation, NIS2/DORA duties

SGSI e ISO/IEC 27001CompletaISO/IEC 27014:2020 (new edition at FDIS); ISO/IEC 27001:2022 + Amd 1:2024 clauses 5, 9.1, 9.3 (cited only)information security governance 27014Actualizada 1 nov 2026

Abrir en el editorDescargar .md

Cómo usar: Use it when the ISMS reports to a board or owners, or when a regulation such as NIS2 or DORA makes the management body accountable for cybersecurity. Fill the governance model and the board indicators first, then agree the calendar. The main pitfall is sending the board an operational dashboard instead of a few indicators tied to risk appetite, with trends and clear decisions.

Vista previa

Information Security Governance Framework and Board Report: [Organization name]

Sets out how the governing body (board of directors, supervisory board, trustees or owners) evaluates, directs, monitors and communicates about information security, and gives a ready-to-use board report format with key indicators. Structure aligned with the governance processes described in ISO/IEC 27014:2020 (a new edition is at the final draft stage in 2026: check for publication) and with ISO/IEC 27001:2022 + Amd 1:2024 clause 5 (leadership), 9.1 and 9.3. Replace every [bracketed] value and every row marked Example.

Document control

Field	Value
Document ID	DOC-ISMS-104
Version	[1.0]
Status	[Draft / In review / Approved / Superseded]
Owner	[@ciso]
Approvers/reviewers	[@board-chair or audit and risk committee chair], [@ceo], [@company-secretary]
Last updated	YYYY-MM-DD
Classification	[Confidential: board and executive]
Standard and edition	ISO/IEC 27014:2020 (new edition at FDIS stage, 2026); ISO/IEC 27001:2022 + Amd 1:2024
Next scheduled review	YYYY-MM-DD
Governing body	[Board of directors / Supervisory board / Owners' meeting]
Board committee with delegated oversight	[Audit and risk committee / Technology committee / None]
Reporting frequency	[Quarterly to committee, twice yearly to full board]

Approvals

Role	Name	Decision	Date
CISO (author)	[@ciso]	[Prepared]	YYYY-MM-DD
Chief executive	[@ceo]	[Endorsed]	YYYY-MM-DD
Chair of the governing body or delegated committee	[@chair]	[Approved]	YYYY-MM-DD

Revision history

Version	Date	Author	Change
1.0	YYYY-MM-DD	[@ciso]	First issue
[x.y]	YYYY-MM-DD	[@author]	[Change summary]

1. Purpose and scope
2. Governance model: who governs, who manages
3. Governance outcomes
4. Governance processes
5. Governance calendar
6. Board indicators
7. Board report format
8. Escalation and decision thresholds
9. Regulatory expectations of the governing body
10. Size tiers
11. Records and evidence
12. References
Standard and licence note

1. Purpose and scope

This framework makes the governing body's role in information security explicit. It defines how the governing body:

evaluates the current and expected information security position against strategy, risk appetite and obligations;
directs management through strategy, appetite, policy, resources and priorities;
monitors whether management delivers and whether risk stays within appetite; and
communicates with stakeholders (shareholders, regulators, customers, staff) about security, and receives what they expect.

It covers [the whole organization / the group and all subsidiaries], including areas outside the certified ISMS scope (DOC-ISMS-002) where they carry information security risk, such as [OT environments, acquired entities not yet integrated, joint ventures].

Out of scope: day-to-day operation of controls, which belongs to management and the ISMS (DOC-ISMS-008), and the steering committee's operational decisions (DOC-ISMS-007).

ISO/IEC 27014:2020 is written for boards and executives, for the people who oversee an ISO/IEC 27001 ISMS, and for those who manage information security in parts of the organization that sit outside the ISMS. Its annexes discuss how an ISMS can relate to the wider governance structure; read them when the ISMS covers only part of the organization or when a group runs several ISMSs.

2. Governance model: who governs, who manages

2.1 Bodies and roles

Body or role	Role in information security governance	Typical members	Meets
Governing body	Sets direction and risk appetite, approves the security strategy and major investments, holds executives to account	[Board of directors]	[Quarterly]
Delegated board committee	Detailed oversight on behalf of the board, receives the board report, challenges management, reports to the full board	[Audit and risk committee]	[Quarterly]
Chief executive and executive committee (top management in ISO/IEC 27001 terms)	Owns the ISMS, sets objectives within the board's direction, provides resources, runs management review (9.3)	[CEO, CFO, COO, CIO, CISO]	[Monthly]
ISMS steering committee (DOC-ISMS-007)	Operational oversight of the ISMS, risk treatment decisions within delegated authority	[CISO, ISMS manager, business owners]	[Monthly]
CISO or head of security	Accountable for the security programme, prepares board reports, has direct access to the committee chair	[@ciso]	[Continuous]
Internal audit (third line)	Independent assurance to the committee on the ISMS and controls	[Head of internal audit]	[Per plan]
External assurance	Certification audits, penetration tests, regulatory inspections	[CB, testers, regulators]	[Per cycle]

2.2 Governance flow

The diagram shows the four governance processes between the governing body and management, with independent assurance feeding the monitor step.

2.3 Separation of governance and management

Question	Governing body	Management
How much information security risk will we accept?	Decides (risk appetite, DOC-ISMS-015)	Proposes, applies and reports against it
Which controls do we implement?	Does not decide	Decides through risk treatment (DOC-ISMS-013) and the SoA (DOC-ISMS-011)
How much do we invest?	Approves envelope and major cases	Builds the business case (DOC-ISMS-029) and budget (DOC-ISMS-031)
Are we within appetite?	Judges, using reports and assurance	Measures and reports honestly, including bad news
Who is told when something goes wrong?	Approves disclosure stance, informed of major incidents	Runs response and notifications (DOC-ISMS-020)

3. Governance outcomes

ID	Outcome the governing body expects	Evidence the body looks at
GOV-OUT-01	Information security is managed across the whole organization, not only inside IT or inside the certified scope	Scope statement, coverage of subsidiaries and OT in the risk register
GOV-OUT-02	Decisions about information follow an explicit, risk-based approach within the approved appetite	Risk appetite statement, risks above appetite with decisions
GOV-OUT-03	Security is considered when the organization invests, acquires, outsources or launches	Security sign-off in investment and acquisition gates, supplier assessments
GOV-OUT-04	Legal, regulatory and contractual obligations are known and met	Legal register status, regulatory findings, contract breaches
GOV-OUT-05	A culture where people report problems and act securely	Training and phishing indicators, event reporting volume, survey results
GOV-OUT-06	Security performance supports current and future business objectives	KPI trend vs objectives (DOC-ISMS-024), roadmap delivery

Review the outcomes at least once a year in the evaluate step and when the business strategy changes.

4. Governance processes

4.1 Evaluate

The governing body considers the current information security position and how it is likely to change, given strategy, threats, obligations and planned business changes.

Element	Content
Inputs	Business strategy and plans, threat landscape summary (DOC-ISMS-045), risk assessment report (DOC-ISMS-017), internal audit opinion, certification status (DOC-ISMS-094), regulatory developments, stakeholder expectations (DOC-ISMS-003)
Activities	Annual strategy session on security; review whether risk appetite still fits strategy; review of major proposals (acquisitions, new markets, outsourcing) for security implications; consider climate-related issues where relevant (Amd 1:2024, clauses 4.1 and 4.2)
Outputs	Evaluation record with conclusions; proposed changes to appetite or strategy; questions for management
Frequency	[Annual strategy session; ad hoc for major proposals]
Responsible	[Governing body, supported by CISO and chief risk officer]

4.2 Direct

The governing body gives direction on what security must achieve and the boundaries management works within.

Element	Content
Inputs	Evaluation outputs, management proposals, budget proposal
Activities	Approve the security strategy and its objectives; approve the risk appetite statement (DOC-ISMS-015); endorse the top-level information security policy (DOC-ISMS-001) or delegate its approval to top management; approve the security budget envelope and major investments; set expectations for culture and accountability; assign responsibility to a named executive
Outputs	Board resolutions, approved appetite, approved strategy and budget, delegations of authority
Frequency	[Annual, plus when appetite or strategy changes]
Responsible	[Governing body; delegated committee recommends]

4.3 Monitor

The governing body checks whether management delivers what was directed and whether risk stays within appetite.

Element	Content
Inputs	Board report (section 7), KPIs and KRIs (section 6), internal audit reports, certification audit results, major incident reports, regulator correspondence
Activities	Review the board report; challenge trends and exceptions; track actions it set; receive independent assurance at least yearly; review major incidents and lessons learned (DOC-ISMS-022)
Outputs	Minutes with challenges and actions; follow-up requests; changes to direction when monitoring shows the need
Frequency	[Quarterly at committee; twice yearly at full board; immediately for major incidents]
Responsible	[Delegated committee, reporting to the full board]

4.4 Communicate

The governing body reports on information security to external stakeholders and makes sure it hears what they expect.

Element	Content
Inputs	Disclosure obligations (legal register DOC-ISMS-014), customer and regulator requests, incident status
Activities	Approve security statements in annual reports or regulatory filings; approve the disclosure approach for major incidents; agree what security information is published (trust centre, DOC-ISMS-116); receive feedback from regulators and key customers
Outputs	Approved disclosures, published statements, regulator responses
Frequency	[Annual reporting cycle; per incident]
Responsible	[Governing body; company secretary and general counsel support]

The 2013 edition of ISO/IEC 27014 listed a fifth process, assure (commissioning independent assurance). The 2020 edition keeps four processes: evaluate, direct, monitor and communicate. In this framework, independent assurance is still needed: it is an input to Monitor (section 4.3), provided by internal audit and external parties.

5. Governance calendar

Month (Example)	Governance activity	Process	Prepared by
January	Annual security strategy session and appetite review	Evaluate, Direct	CISO, CRO
February	Approve security budget envelope for the year	Direct	CFO, CISO
April	Q1 board report to committee	Monitor	CISO
May	Annual report security statement approved	Communicate	Company secretary
July	Q2 board report; internal audit annual opinion on the ISMS	Monitor	CISO, head of internal audit
September	Full board deep dive on one top risk	Evaluate, Monitor	Risk owner
October	Q3 board report; certification audit results	Monitor	CISO
December	Board training session on cyber risk	Direct (culture)	CISO, external trainer

6. Board indicators

KPIs measure delivery and control performance; KRIs signal exposure against risk appetite.

ID	Indicator	Type	Definition	Tolerance (Example)	Source	Owner
BKI-01	Risks above appetite	KRI	Count of Critical risks plus High risks without an approved treatment or acceptance	0 Critical; at most 2 High	Risk register DOC-ISMS-016	CISO
BKI-02	High risk treatments on track	KPI	High and Critical risk treatment actions on schedule / all such actions	at least 85%	Risk treatment plan DOC-ISMS-013	Risk owners
BKI-03	Major incidents	KRI	Incidents classified High or Critical in the period, with business impact	0 Critical	Incident register DOC-ISMS-021	CISO
BKI-04	Critical vulnerability remediation within target	KPI	Critical vulnerabilities fixed within target time / critical vulnerabilities due	at least 95%	Vulnerability tracker DOC-ISMS-072	CIO
BKI-05	Phishing-resistant or multi-factor authentication coverage	KPI	Accounts with MFA / all accounts in scope	at least 98%	Identity provider report	CIO
BKI-06	Restore tests passed	KPI	Successful restore tests of critical systems / tests performed	100%	Backup and restore test log DOC-ISMS-071	CIO
BKI-07	Critical suppliers assessed	KPI	Critical suppliers with a current assessment / all critical suppliers	at least 90%	Supplier register DOC-ISMS-066	Procurement
BKI-08	Security training completion	KPI	Staff who completed required training / staff in scope	at least 95%	Training matrix DOC-ISMS-026	HR
BKI-09	Open major or overdue audit findings	KRI	Major nonconformities open plus findings past due date	0 major; at most 3 overdue	Audit findings register DOC-ISMS-086	ISMS manager
BKI-10	Regulatory or contractual breaches	KRI	Confirmed breaches of security obligations in the period	0	Legal register DOC-ISMS-014	General counsel
BKI-11	Security budget delivery	KPI	Actual spend / planned spend year to date, with variance explanation	90% to 105% of plan	Budget plan DOC-ISMS-031	CFO

7. Board report format

Information Security Board Report, [period]: DOC-ISMS-104-[YYYY-Qn]

7.1 Executive summary

Write three to five sentences: overall position against appetite, direction of travel, the most important change since the last report, and the decisions requested.

Example (Quillmere Health Systems, 320 staff, Q3): Information security risk is slightly above appetite: one Critical risk (unsupported scheduling database at the colocation suite) and two High risks without approved treatment. ISO/IEC 27001 Stage 2 is planned for month 10 of the programme; the Stage 1 audit raised two areas of concern, both closed. We ask the committee to approve an additional USD 180,000 to replace the unsupported database this financial year and to note the planned 27701 extension next year.

7.2 Risk position against appetite

Band	Count this quarter	Last quarter	Above appetite
Critical (17-25, in practice 20 and 25)	1 (Example)	1	1
High (10-16)	6 (Example)	8	2
Medium (5-9)	9 (Example)	9	0
Low (1-4)	6 (Example)	5	0
Total	22	23	3

Bands follow the risk methodology (DOC-ISMS-010): likelihood 1 to 5 x impact 1 to 5; Low 1-4, Medium 5-9, High 10-16, Critical 17 to 25 (in practice 20 and 25). Critical risks cannot be accepted without treatment except by documented top management decision; High risks need top management acceptance with a treatment decision.

7.3 Top risks

Risk ID	Risk (business language)	Score	Trend	Treatment and date	Owner
RISK-014 (Example)	Patient scheduling outage or data exposure through the unsupported database at the colocation suite	20 (L4 x I5)	Stable	Replace database, decision requested today; target Q1	CIO
RISK-006 (Example)	Ransomware on clinical scheduling service	15 (L3 x I5)	Improving	EDR rollout 90% complete, immutable backups live	CISO
RISK-019 (Example)	Hospital customer data exposed through a critical supplier	12 (L3 x I4)	New	Supplier reassessment due next month	Procurement

7.4 Indicators

ID	Indicator	Q4 last year	Q1	Q2	Q3	Tolerance	Status
BKI-01	Risks above appetite	5	4	4	3	0 Critical, at most 2 High	Outside
BKI-02	High risk treatments on track	70%	75%	78%	80% (8 of 10)	at least 85%	Outside
BKI-04	Critical vulnerabilities fixed in target	85%	88%	90%	92% (46 of 50)	at least 95%	Outside
BKI-05	MFA coverage	90%	94%	96%	97%	at least 98%	Near
BKI-07	Critical suppliers assessed	60%	70%	85%	90% (18 of 20)	at least 90%	Within
BKI-08	Training completion	88%	90%	92%	94% (301 of 320)	at least 95%	Near
BKI-11	Budget delivery (year to date)	98%	92%	95%	96% (USD 1,080,000 of USD 1,125,000 planned to date; full-year plan USD 1,500,000)	90% to 105%	Within

All figures are Example values. Use local currency in your report.

7.5 Incidents and events

Example: 14 incidents in Q3: 11 Low, 2 Medium, 1 High (credential phishing that reached one finance mailbox, contained within 2 hours, no data loss, no notification required after legal assessment). Lessons learned: enforce phishing-resistant MFA for finance roles, due Q4.

7.6 Compliance and assurance

Item	Status (Example)
ISO/IEC 27001 certification	Stage 1 completed; Stage 2 scheduled for month 10
Internal audit	ISMS audit completed; 0 major, 2 minor findings open, on schedule
Regulatory	No open findings; data protection authority enquiry closed
Customer audits	3 hospital audits completed; 1 observation

7.7 Programme and investment

Report delivery of the security roadmap (DOC-ISMS-030): milestones achieved, slipped and why, and spend against budget.

7.8 Decisions requested

ID	Decision	Options	Recommendation	Impact if deferred
BRD-DEC-001 (Example)	Fund replacement of the unsupported scheduling database	A: replace this year (USD 180,000); B: accept risk to next year; C: compensating controls only (USD 40,000)	A	Critical risk remains above appetite for another 12 months
BRD-DEC-002	[Decision]	[Options]	[Recommendation]	[Impact]

7.9 Appendices

Indicator definitions (section 6), full risk register extract, internal audit summary, incident list, glossary of terms for non-specialists.

8. Escalation and decision thresholds

Event	Escalate to	Timing	Channel
Critical incident with customer, safety or regulatory impact	Committee chair and CEO; full board briefing	[Within 24 hours of classification]	Phone, then written brief
Personal data breach likely to require regulator notification	CEO, general counsel, committee chair	[Without delay, to meet legal deadlines]	Incident bridge, written brief
New Critical risk or a risk exceeding appetite with no treatment	Delegated committee	[Next meeting, or within 10 working days if Critical]	Written paper
Certification suspended or major nonconformity raised	CEO and committee chair	[Within 5 working days]	Written brief
Regulator inspection or enforcement notice	Full board	[Next meeting, chair informed immediately]	Written paper

9. Regulatory expectations of the governing body

Several regimes now place responsibility for cybersecurity on the management body itself. Examples:

Regime	What it expects of the management body (summary)	Where to record evidence
NIS2, Directive (EU) 2022/2555, Article 20	Management bodies of essential and important entities approve the cybersecurity risk-management measures, oversee their implementation, can be held liable for infringements under national law, and follow training to be able to identify and assess risks	Board resolutions, training records for directors
DORA, Regulation (EU) 2022/2554, Article 5	The management body of a financial entity defines, approves, oversees and is responsible for the ICT risk management framework and keeps its own ICT risk knowledge up to date	Board minutes, ICT risk framework approval (`compliance/dora-ict-risk-management-framework`)
US public company cybersecurity disclosure rule (SEC, adopted 2023)	Annual disclosure describing board oversight of cybersecurity risk and management's role; current reporting of material incidents	Annual report text approved under section 4.4
NIST Cybersecurity Framework 2.0 (CSWP 29, February 2024), Govern function	Voluntary framework that places organizational context, risk strategy, roles, policy and oversight in a Govern function	Mapping in `compliance/nist-csf`

Check national transpositions for NIS2 and the current text of each regime. This section is a documentation format, not legal advice.

10. Size tiers

Aspect	Small: Quillmere Analytics Ltd (46 staff)	Medium: Quillmere Health Systems (320 staff)	Large: Quillmere Group (2,400 staff, 6 sites)
Governing body	Founders and investor board	Board with an audit and risk committee	Group board, audit and risk committee, subsidiary boards
Who reports	ISMS manager (0.5 FTE, Head of Engineering Operations) with the CTO	Full-time ISMS manager with a 3-person security team, reporting through the CIO; CISO role combined	CISO with a 14-person security office, direct line to committee chair
Report	One page in the quarterly board pack: top 3 risks, 5 indicators, certification status, decisions	Format in section 7, quarterly to committee	Section 7 plus site and subsidiary annex, OT risk section, integrated with ISO 9001 and ISO 22301 reporting
Indicators	BKI-01, 03, 05, 08, plus customer security questionnaire wins	BKI-01 to BKI-11	BKI-01 to BKI-11 per site, aggregated, plus OT-specific KRIs
Assurance	External penetration test and certification audit	Internal audit (outsourced) plus certification audit	Internal audit function, certification audits, regulatory inspections
Board training	Annual briefing by the ISMS manager	Annual session with an external trainer	Annual programme, induction for new directors, regulatory training where required

11. Records and evidence

Record	Proves	Owner	Location	Retention
Board and committee minutes with security items	Evaluate, direct and monitor took place; ISO/IEC 27001 clause 5.1 leadership	Company secretary	[Board portal]	[Per corporate records law; example: 10 years]
Board resolutions approving appetite, strategy, budget	Direction given	Company secretary	[Board portal]	[Permanent or per law]
Board reports (DOC-ISMS-104-period)	Monitoring inputs	CISO	[Document management system]	[Example: 6 years]
Director training records	Competence of the governing body (for example NIS2 Article 20)	Company secretary	[HR or board portal]	[Term of office + 6 years]
Escalation briefs for major incidents	Timely escalation under section 8	CISO	[Incident repository]	[Example: 6 years]
Approved external disclosures	Communicate process	General counsel	[Legal repository]	[Per law]
Internal audit opinions to the committee	Independent assurance	Head of internal audit	[Audit repository]	[Example: 6 years]

Set the retention periods in the documented information register (isms/isms-documented-information-register) and map evidence owners in isms/control-evidence-matrix.

12. References

Reference	Edition and status	Use
ISO/IEC 27014:2020, governance of information security	Current; new edition at FDIS stage in 2026 (https://www.iso.org/standard/74046.html)	Governance processes and relationship with the ISMS
ISO/IEC 27001:2022 + Amd 1:2024	Current (https://www.iso.org/standard/82875.html, Amd 1: https://www.iso.org/standard/88435.html)	Clauses 4.1, 4.2, 5.1, 9.1, 9.3
ISO/IEC 38500:2024, governance of IT for the organization	Current (cited without link)	Governance of IT principles, complementary
ISO 37000:2021, governance of organizations	Current (cited without link)	General governance guidance
NIST Cybersecurity Framework 2.0, NIST CSWP 29	February 2024 (https://doi.org/10.6028/NIST.CSWP.29)	Govern function
Directive (EU) 2022/2555 (NIS2)	OJ L 333, 27.12.2022 (https://eur-lex.europa.eu/eli/dir/2022/2555/oj)	Article 20 governance
Regulation (EU) 2022/2554 (DORA)	OJ L 333, 27.12.2022 (https://eur-lex.europa.eu/eli/reg/2022/2554/oj)	Article 5 governance and organization
Related templates	`isms/isms-steering-committee-charter`, `isms/isms-roles-raci`, `isms/isms-risk-appetite-criteria`, `isms/isms-measurement-programme`, `isms/isms-performance-report`, `isms/isms-annual-calendar`, `compliance/management-review`, `compliance/nist-csf`, `compliance/nis2-security-measures`, `compliance/dora-ict-risk-management-framework`, `business/board-pack`, `security/security-metrics-report`, `isms/control-evidence-matrix`	Linked documents

Standard and licence note

Structure aligned with ISO/IEC 27014:2020 (governance processes: evaluate, direct, monitor, communicate) and ISO/IEC 27001:2022 + Amd 1:2024 (clauses 5, 9.1 and 9.3). The outcomes, indicators, report format and examples are original and reproduce no text, tables or definitions from ISO or IEC standards. Regulatory summaries are short paraphrases; read the official texts. Check the current editions before use: a new edition of ISO/IEC 27014 was at the final draft (FDIS) stage in 2026. Official ISO text, purchase or licensed access: https://www.iso.org/standard/74046.html and https://www.iso.org/standard/82875.html. This is a documentation format, not legal advice.

Template licence: MIT.

Plantillas relacionadas

SGSI e ISO/IEC 27001