One-page board IT risk memo

Your board needs a vote

Boards ask about cyber risk and get a tool list, a vendor deck or “more investment is recommended”. None of these states what the board must approve. So the board approves the amount to clear the agenda, or defers it a quarter.

Put the vote on line one. Under it, give the exposure and the known and unknown costs. Then give real options, one recommendation, an owner, a due date and the proof of completion.

Part 1: Twelve rules for the memo

These apply to a nonprofit board, a partner group, a finance committee or an audit committee.

1. Open with the decision in one sentence. The board should know the ask before the first line ends. Everything below supports or tests it.
2. State the risk in the board’s units. Use days of lost operations, failed client duties, a regulator’s notice or a lost insurance position. “No tested restore” means nothing to a board. “If our files were encrypted on Friday, nobody knows whether we would run on Monday” means everything.
3. Keep known, unknown and modelled costs apart. A known cost has a quote, a date and a source. An unknown is real but not yet sized, and you say so. A modelled cost is your labelled estimate with its assumption.
4. Give two or three real options. Each must be one the board could choose. Boards spot two decoys and a favourite, and it costs you credibility next time.
5. Include the smaller option when it is credible. Often a fraction of the spend covers most of the exposure. Saying so is the fastest way to be believed later.
6. Attach a trigger to any “defer”. Write what must happen, by when, and who watches. “Defer to the FY27 budget, unless the March insurance renewal requires it” is a decision. “Revisit later” is not.
7. Say what happens if the board declines. Write one honest, costed line, not a threat. Pressure makes boards stop trusting the memo.
8. Name products only when the decision needs it. Describe the capability instead. Product names send the board to its laptops.
9. Give every number a date and a source. Write “Quote from [firm], [date]” or “Internal estimate based on [basis]”. Unsourced numbers get challenged, and the challenge eats the meeting.
10. Name the approver, due date and proof. Say who approves, when it is due and what proves completion. This is the part people skip, so the same item returns three quarters running.
11. Keep it to one page. Put detail in an optional appendix. If the page cannot stand alone, the thinking is unfinished.
12. Do not lead with fear. You can frighten a board once, and then it discounts everything. State the exposure accurately.

Write in the board’s units

Do not write	Write
We lack EDR coverage on 40% of endpoints	On about four in ten computers, we would not see an intrusion until someone noticed something wrong
MFA is not enforced for privileged accounts	Six accounts that can change anything are protected by a password alone
Our RTO is undefined	Nobody knows or has tested how long we would be unable to operate
We need to improve our security posture	We ask for a decision on one thing: [the thing]
Backups are not immutable	The account an attacker would take first can delete our backups

Part 2: The one-page template

Copy it, replace each bracketed field and keep it to one page. Delete the guidance in parentheses before it goes out.

IT RISK MEMO

Field	Entry
To	[Board, finance committee or partner group]
From	[Name, title]
Date	[Date]
Prepared with	[Staff, outside adviser or both, with any commercial interest the preparer holds]

DECISION REQUESTED

(One sentence: what the board approves, declines or chooses.)

RISK

(Two to four sentences on the business consequence. Say what would go wrong, to whom, and what it would cost in operations, duties or standing.)

Current evidence. (What we know and how, such as an assessment date, test result, incident, audit finding or insurer’s requirement. If none exists, say so.)

COST

Category	Amount	Basis
Known	$	(A quote, invoice or contract, with its source and date)
Known, internal	Hours	(Whose time, over what period)
Unknown		(What is real but unsized, and what sizing it would take)
Modelled	$	(Your estimate and its assumption)

OPTIONS

	Option	Cost	What it covers	What it leaves open
A
B
C	Defer	$0 now		(The trigger: what brings it back, when, and who watches)

RECOMMENDATION

(One option, and one or two sentences on why. If it is the smaller option, say why the larger one is not yet warranted and what would warrant it.)

IF DECLINED

(One sentence on what the organisation accepts by declining.)

APPROVAL

Field	Entry
Decision owner
Approval date
Implementation owner
Due date
Proof of completion	(The artefact that proves it: a test result, a configuration record, a signed contract or a completion report)
Reported back to the board on

Part 3: A worked example

The organisation is fictional. Its numbers are illustrations, not benchmarks.

IT RISK MEMO

Field	Entry
To	Finance Committee
From	J. Alvarez, Controller
Date	14 March 2026
Prepared with	IT staff and a flat-fee outside adviser, who earns no commission, margin or referral fee on any option

DECISION REQUESTED

Approve $18,500 to protect backup retention and set up a tested recovery procedure. Decline the IT provider’s $92,000 backup replacement until the recovery test in Option A shows it is needed.

RISK

If ransomware encrypted our files and accounting, we do not know how long billing, payments and client work would stop. No restore has been tested. The same admin credentials an attacker would take first can reach our backups, so one event could delete them.

Our three largest client contracts measure service in business days. A recovery of more than five business days would put those commitments at risk.

Current evidence. Backup jobs report success nightly, but no full restore has been run or timed in 26 months of records.

On 27 February 2026, our IT provider confirmed two facts. Backup storage lacks deletion protection, and its console uses the production directory credentials.

COST

Category	Amount	Basis
Known	$4,800 a year	Immutable retention add-on to the current backup subscription, quoted by the provider on 27 February 2026
Known	$13,700 once	Fixed-fee recovery test and written procedure, quoted by the adviser on 6 March 2026
Known, internal	About 40 hours	IT and finance staff over four weeks
Unknown		The cost of fixes if the test fails, which the test exists to size
Modelled	$60,000 to $140,000	A five-day outage, from FY25 average daily billing and 60% recovery of delayed billing. It is an internal estimate, not a likelihood

OPTIONS

	Option	Cost	What it covers	What it leaves open
A	Turn on protected retention, run and time a full recovery test, and write down the procedure and real recovery time	$18,500 and 40 internal hours	A hijacked account can no longer delete backups, and we learn our real recovery time	Detection, and the two end-of-life servers noted separately
B	Option A, plus the provider’s proposed backup platform	$92,000 in year one, then $34,000 a year	Everything in A, on newer infrastructure	It replaces a system not yet shown to be inadequate, and the provider disclosed its margin when asked
C	Defer both	$0 now	Nothing	Trigger. The 1 July 2026 insurance renewal asks whether backups are deletion-protected and a restore was tested within a year. Today we would answer no to both. The Controller confirms the questions by 1 May 2026 and returns this memo if deferring stops being defensible

RECOMMENDATION

Option A. Our backups are deletable and untested, and A fixes both for a fifth of B’s cost.

The test may show we cannot recover within five business days on the current platform. If so, this memo returns in Q3 with that evidence and recommends B.

IF DECLINED

We accept that a hijacked admin account can delete our backups and that our recovery time is unknown. We answer no to two questions on the July renewal.

APPROVAL

Field	Entry
Decision owner	Finance Committee
Approval date	14 March 2026
Implementation owner	J. Alvarez, Controller
Due date	15 May 2026
Proof of completion	A signed test result with the date, systems restored and time taken. A console record showing the retention lock and who may change it
Reported back to the board on	The June quarterly meeting

Part 4: Five questions to prepare for

Before the meeting, write a sourced answer beside each. Label unknowns as unknown.

1. “How likely is this?” Give a probability only if you can defend it. Otherwise, say whether the control exists, whether it was tested and what failure would cost. Boards accept “I cannot give a probability, and here is why it still needs a decision.”
2. “What are our peers doing?” Security spend benchmarks are often quoted and rarely well sourced. Use one only with its publisher, date, peer set and denominator. Otherwise, say none is available and answer on your own facts.
3. “Didn’t we already pay for this?” Often yes, and saying so helps. “We licensed it in 2023 and never fully deployed it” turns new spend into finishing a job.
4. “Can our IT provider just do this?” Sometimes. Get it in writing, and disclose whether they earn anything on it. The “prepared with” line at the top handles this without an argument.
5. “What if we do nothing?” That is Option C and the “if declined” line, already written.

Part 5: Four memos that fail

• It explains instead of asking. Two pages of background and no decision line, so nothing is decided.
• It gives one option. A lone recommendation reads as a demand, and boards resist demands. Give a real choice.
• A modelled number sits in the known column. A “$4.9 million average breach cost” is a global average with no bearing on a 60-person organisation in Westchester. Once a board spots it, the whole page becomes suspect.
• It has no proof of completion. The item is approved and funded but never checked. It returns two years later with a bigger number, so fill in the field.

File the vote and proof together

This template is general guidance on governance reporting. It is not legal, financial or insurance advice, and it does not set what your board or regulators require.

Have counsel review any memo touching a regulatory or contractual duty.

Use it freely and rename the fields.

The order matters most. Put the decision first and evidence under it, with costs split by certainty. Then give real options including a smaller one, one recommendation, and a named person with a date.

SBK earns no commission or referral fee, so it has no stake in which option your board picks. We will help you write up one live decision if that is useful. Call (718) 407-4169.