Reporting cybersecurity status to the supervisory board or managing directors (Geschäftsleiter) requires translating complex engineering data into clear risk governance terms. In Germany, this is driven by § 38 BSIG (transposing NIS2 Article 20), which establishes binding governance duties for executive leadership.

Primary Sources: BSI-Gesetz (BSIG) § 38 (gesetze-im-internet.de); Directive (EU) 2022/2555 (NIS2) Article 20 (EUR-Lex).

1. The Legal Framework: Executive Responsibilities under § 38 BSIG

Under § 38 of the reformed BSIG, executive management bodies of particularly important and important entities bear explicit statutory duties:

  • Billigungs- und Überwachungspflicht: Executive managers must formally approve the cybersecurity risk-management measures implemented pursuant to § 30 BSIG and actively oversee their operational implementation.
  • Fortbildungspflicht: Managing directors are required to regularly participate in cybersecurity training to maintain the technical competence necessary to recognize and assess cybersecurity risks.
  • Innenhaftung gegenüber der Einrichtung: Managing directors who culpably violate these duties are personally liable to the company for resulting damages (§ 38 Abs. 2 BSIG). The entity cannot waive or settle these claims in advance.

2. Suggested Executive Reporting Metrics Pack

While frameworks like Value-at-Risk (VaR) or specific KPI indices are not mandated by statute, CISOs typically structure board reporting around a balanced, five-metric indicator pack:

Metric 01

Cyber Risk Exposure (Suggested)

Financial risk estimates modeling potential operational disruption scenarios (ransomware, business interruption) against corporate cyber insurance coverage limits and balance sheet reserves.

Metric 02

Control Implementation & Remediation Status

Progress tracking against planned § 30 BSIG, DORA, or ISO 27001 implementation roadmaps, highlighting critical open remediation milestones and audit deadlines.

Metric 03

Incident Detection & Response Velocity

Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR), demonstrating the organization's technical capability to detect and contain intrusions before critical business impact occurs.

Metric 04

Critical Vendor & Supply Chain Posture

Percentage of Tier 1 and Tier 2 third-party ICT service providers adhering to contractual security requirements and verified certification standards.

Metric 05

Critical Asset Protection Coverage

Verification that multi-factor authentication, endpoint protection, and verified immutable backups are active across all revenue-critical production systems.

3. Distinguishing Tooling Simulations from Statutory Evidence

Modern posture management tools and dashboards provide indicative scores and drift alerts. However, executive management should understand that automated scoring operates as an internal simulation of technical configuration state. To satisfy § 38 BSIG oversight and legal audit defensibility, technical telemetry must be accompanied by formal organizational policies, documented management approvals, and verifiable training records.

4. Structuring the Executive Briefing

An effective 15-minute cybersecurity update to the board follows a disciplined three-part agenda:

  1. Industry Threat Context (3 Minutes): Significant threat trends and regulatory updates relevant to the enterprise's operating sector.
  2. Current Posture & Remediation Velocity (7 Minutes): Review of core governance metrics against quarterly targets, highlighting critical residual risks.
  3. Decisions & Resource Allocation (5 Minutes): Specific policy sign-offs, investment decisions, or resource allocations required from management.