What Your Board Actually Needs to See About Cyber Risk

In a boardroom in Mumbai, a Non-Executive Director reads a slide titled "Cybersecurity Posture: Q4 FY2025–26." It shows a traffic light — green for RBI, amber for SEBI CSCRF. No numbers. No trend lines. No evidence of what "green" means or how it was determined. The board approves the cyber risk review by consensus and moves to the next agenda item.

Three weeks later, the organisation's payment processing system is compromised in a credential stuffing attack. The board asks: why didn't we see this coming?

The honest answer: because the dashboard they were shown was designed to provide reassurance, not oversight.

The Board Oversight Gap in India's BFSI Sector

Most boards receive cybersecurity information in one of three inadequate forms. The first is the CISO narrative — a qualitative update that relies on technical jargon, offers no independent verification, and changes in presentation style each quarter based on the CISO's priorities. The second is the compliance checklist — a table of regulatory requirements with "Yes/No/Partial" columns that tells the board whether boxes have been ticked, not whether the organisation is actually secure. The third is the incident-only briefing — where the board only hears about cybersecurity when something goes wrong.

None of these formats satisfies what boards are now legally required to do: exercise meaningful oversight of cyber risk as an enterprise risk, with the same rigour applied to financial or operational risk.

What Effective Board Cybersecurity Oversight Actually Requires

When you strip away the technical complexity, boards need to answer five questions about their organisation's cybersecurity posture:

1. Are we compliant with our regulatory obligations? Which frameworks apply to us, what is our current posture against each, and what are the critical gaps? This needs to be expressed as a percentage or tier — not a narrative.

2. What is the financial exposure if something goes wrong? Not "cybersecurity is a high-impact, high-likelihood risk." How many rupees crore could a ransomware incident cost this organisation? What does our cyber insurance cover, and is it sufficient?

3. Are our most critical obligations being met? CERT-In 6-hour reporting, IRDAI annual VAPT, SEBI incident SLAs — is there evidence these are being met, not just asserted?

4. What has changed since the last board review? Trend lines matter. A framework posture of 74% is meaningless without knowing whether it was 68% last quarter or 81%.

5. What are the top three things that need the board's attention? Boards set appetite, allocate resources, and make decisions about risk acceptance. They need AI-prioritised action items, not a list of every open finding.

The Eight Widgets a Board Dashboard Must Display

Here is what translating these five questions into a board-grade dashboard actually looks like in the RiskSage Board Cybersecurity Dashboard:

Illustrative view of the RiskSage Board Cybersecurity Dashboard. All figures are computed live from the risk graph.

Widget 1: Regulatory Scorecard (Traffic-Light per Framework)

Each framework — RBI, SEBI CSCRF, IRDAI, DPDP, ISO 27001 — displays as a traffic light with a percentage posture score, a directional trend arrow, and the count of critical gaps. The board immediately knows where attention is required without reading a technical report.

Widget 2: Top 5 Risks in Board Language (₹ Crore)

This is the widget most organisations are missing. Risk is expressed not as "HIGH likelihood, HIGH impact" but in financial terms: "Ransomware — estimated ALE ₹18–47 crore. Current controls reduce exposure by 60%. Residual: ₹7–19 crore." This is drawn from the CRQ Engine's FAIR v3.0 Monte Carlo model, giving the board the financial grounding to make resource allocation decisions.

Widget 3: Incident SLA Performance

What percentage of cyber incidents in the past quarter were reported to each regulator within the mandated window? A bank with 100% CERT-In SLA adherence and 87% RBI SLA adherence has an actionable gap. A bank that has never tracked this metric has no idea whether it's compliant.

Widget 4: Attestation Calendar

Every upcoming regulatory deadline in a single timeline — IRDAI board attestation due date, SEBI quarterly review, RBI annual IS audit submission. The board can see at a glance what is due, what has been completed, and whether the organisation is on track.

Widget 5: Audit Findings Summary

Open findings from the internal audit programme, by severity, with management response SLA performance. Are management responses being provided on time? Are CRITICAL findings from the last cycle still open? This gives the board audit committee the oversight it is required to exercise.

Widget 6: Investment Summary (Budget vs Risk Reduction)

Security investments mapped to their projected risk reduction in ₹ crore. A ₹2 crore investment in MFA rollout that reduces identity-related ALE by ₹8 crore is a defensible board decision. An undifferentiated "cybersecurity budget: ₹12 crore" line item is not.

Widget 7: Maturity Roadmap (Quarter-Level)

Where is the organisation on the NIST CSF 2.0 maturity journey, and what is the planned trajectory? Which in-flight initiatives are expected to move which functions from Tier 2 to Tier 3? The board approved the security roadmap — the dashboard should show them whether delivery is on track.

Widget 8: Signed Board PDF Export

Every board review should produce a deterministically signed PDF — RSA-SHA256 signed, with a canonical JSON payload that can be verified independently. This is the evidence record for IRDAI board attestation submissions, SEBI audit queries, and any future regulatory inspection that asks to see board oversight documentation.

The Regulatory Reporting Table Every Board Should Be Reviewing

Obligation	Regulator	Deadline	Evidence Required	Status
Cyber Incident Reporting	CERT-In	6 hours from detection	Notification receipt + incident timeline	CRITICAL SLA
Annual IS Audit Submission	IRDAI	Within 90 days of FY end or 30 days of audit completion	Board meeting minutes + signed audit report	UPCOMING
Board Cyber Risk Review	RBI	Quarterly	Board resolution + dashboard snapshot	CURRENT
CSCRF Automated Dashboard	SEBI	Continuous	Dashboard audit trail	IN PROGRESS
Annual VAPT by CERT-In empanelled firm	IRDAI / RBI / SEBI	Annual	Assessment report + remediation evidence	COMPLIANT

Why Most Dashboard Implementations Fall Short

The most common failure mode is data source disconnect. A dashboard that pulls posture figures from a spreadsheet updated monthly by the GRC team is not a live dashboard — it's an automated summary of an analyst's work. The numbers are as good as the analyst's last update.

The second failure mode is metric selection bias. Dashboards tend to show what is easy to measure, not what matters. Patch coverage percentage is easy to measure. It does not answer whether the unpatched systems are the ones holding PII of 4 million policyholders.

The third failure mode is absence of financial context. A board that manages a ₹5,000 crore balance sheet requires financial quantification to make risk decisions. Presenting cyber risk in qualitative terms asks the board to exercise judgement without the information needed to do so.

The RiskSage Board Cybersecurity Dashboard addresses all three failures. Posture figures are computed live from the underlying risk graph — every control implementation, every evidence item, every open finding feeds the calculation in real time. The metrics are chosen to answer the five board questions, not to showcase what is easy to measure. And the CRQ Engine provides financial quantification in ₹ crore for every material risk.