4.4.3. Program Communications and Reporting
💡 First Principle: The support and budget a security program needs during a crisis are actually earned in the months before the crisis, through consistent, credible reporting that gives leadership a genuine picture of risk posture and program maturity over time.
A security leader who only speaks up during an incident is negotiating for resources at the worst possible moment, under duress, with no track record to draw on. Regular reporting — outcome-based metrics (4.2.2), risk posture updates that tie back to the governance structures from Phase 2, and program maturity progress — builds the credibility and executive relationship that make a crisis-time resource request far more likely to succeed, because leadership already trusts the numbers and the person presenting them.
⚠️ Exam Trap: Communication is sometimes assumed to matter only during an active incident. The correct answer recognizes that consistent reporting before a crisis builds the support and budget a program needs, and is a core, ongoing operational responsibility rather than a reactive one.
Reflection Question: Your CISO has never presented to the board except once, immediately following a major breach. What disadvantage does this put the CISO at during that presentation, compared to a CISO with a quarterly reporting history?
