Four questions every board technology report should answer.

Most technology reports to the board fail in one of two ways. Either they're a wall of operational metrics (ticket counts, uptime percentages, patch compliance) that no director can act on, or they're a vague "all systems normal" that leaves the board unable to exercise any oversight at all.

Boards oversee. They don't manage. A technology report should be built around what oversight actually requires, and that comes down to four questions.

1. Are we protected?

Not "what tools do we run." Directors need trajectory and honesty:

• Is security posture improving, stable, or declining, and on what basis?
• Were there incidents this quarter? Write "none" when there were none. Never omit the line. An absent line reads as something hidden.
• Where does cyber insurance stand: renewal position, open conditions?
• Which top risk moved, in which direction, and what's being done?

2. Are investments delivering?

This is where credibility is built or lost. Report against the plan the board or leadership actually approved:

• Milestones delivered versus the approved roadmap, with a variance note
• Spend versus budget, with the driver of any variance
• One quantified value headline: savings captured, hours returned, or capability delivered

Accountability to a prior commitment is what separates a report from a status update.

3. What needs your attention?

The only section that asks the board to do something: investment approvals above management authority, risk acceptance decisions, policy adoption.

If nothing needs action, say so explicitly: "No board action required this quarter." Don't delete the section. Its consistent presence teaches the board where to look when it matters.

4. What's ahead?

Next quarter's priorities in three bullets, plus any emerging issue the board is likely to hear about externally: a regulatory change, an AI development, an incident in your sector. Frame it before they ask. A director who reads about a sector breach in the news and already has your one-paragraph view is a director who trusts your reporting.

The format rules

• Two pages. Detail goes in appendices available on request: risk register, decision log, detailed roadmap.
• In the board packet five or more days early. Directors should arrive with questions, not first impressions.
• No unexpanded acronyms. If a director has to ask what EDR means, the report has failed its audience.
• Same structure every quarter. Consistency makes change visible.

Why it matters

The board's real question behind every technology report is simple: do we have this under control? A report that answers the four oversight questions, honestly and the same way every quarter, answers that question before anyone has to ask it out loud.

If your current report can't be mapped to these four questions, that's not a formatting problem. It usually means nobody owns the answers.