While practitioners and researchers agree on the necessity of effective cybersecurity board communication and reporting (Cason & Scholtz, 2025; Rothrock et al., 2018), there is a lack of tangible, meaningful metrics and models that CISOs can use to communicate cybersecurity topics to their Board of Directors (Modi et al., 2023). The available guidance on cybersecurity reporting predominantly targets technical audiences, is framed in a language boards do not understand (Modi et al., 2023; Opdenbusch et al., 2025), or remains limited to highly abstract and generic recommendations (Renaud et al., 2019; Zukis, 2016). The thesis seeks to close this gap in research by providing insights into cybersecurity concerns for the board of directors to consider, and on how to inform the board and support effective board decision-making.