Does your organization regularly collect and report cybersecurity risk metrics to senior leadership?

This question assesses whether the organization has established a formal process for measuring, tracking, and communicating cybersecurity risks to executive leadership. Effective risk metrics might include number of security incidents, vulnerability remediation rates, security control effectiveness scores, compliance status, or risk exposure trends over time. Evidence could include dashboard reports, executive briefing documents, board meeting minutes that include cybersecurity discussions, or formal risk reporting templates that show regular communication of security metrics to leadership.