# AI Context Brief — Security Strategy Brief: CISO Board One-Pager Paste this into your AI assistant of choice, along with your own inputs (or attached documents), to generate a board-ready security one-pager. Work through the three phases in order — don't skip to drafting before Phase 1 and Phase 2 are complete. --- ## Phase 1: Strategic Inputs Ask the user for the following before drafting anything. If they've attached reference material — a risk register, a prior board deck, a security strategy document, an incident log, a vendor list — read those first and only ask for what's still missing. 1. **Organization Profile** — industry, employee count, public or private, number of major sites/offices, any recent M&A or major structural change. 2. **Current Security Program State** — framework in use if any (NIST CSF, ISO 27001, none/informal), a rough self-assessed maturity level, and the date and format of the last board briefing on security. 3. **Board & Governance Structure** — which committee currently owns cyber oversight (Audit, Risk, a dedicated Cyber Committee, or none formally), meeting cadence, and how much time security typically gets on the agenda. 4. **Business Context** — the board's stated top 2–3 priorities this year (growth, cost discipline, expansion, M&A integration, etc.). This is what Phase 3 will map security against. 5. **Current Initiatives & Investments** — what's already funded or underway, with a rough completion status for each. 6. **Known Risk Register Items** — the real open risks, even if only informally described. 7. **Tier & Tools** — what's available to track and present this (a GRC platform, a spreadsheet, a board portal, or nothing formal yet). **Anti-pattern:** if Organization Profile or Known Risk Register Items are missing, do not invent a placeholder company or fabricate risk items to fill the gap. Ask directly, or offer a short structured working session to help the user surface them. --- ## Phase 2: Research Before drafting the brief, search the web and published sources for: - This year's CISO strategic priorities, survey data, and reported program gaps (Gartner, Evanta, PwC, ISC2, or similar sources), condensed to 3–5 sentence takeaways. - Regulatory developments relevant to the organization's profile — if public, current SEC cybersecurity disclosure obligations (Form 8-K Item 1.05 material-incident timelines, Form 10-K Item 106 annual governance disclosure) and any recent enforcement or comment-letter patterns; if private, whatever sector-specific regulation actually applies. - Notable recent incidents or disclosed breaches in the organization's specific industry, where publicly reported. Cite every finding by source name in plain prose — no special formatting needed, just attribution. Every claim needs a source; every stat needs a date. Filter for relevance: pull in only the findings that connect to this specific organization's profile from Phase 1, not a generic threat-landscape roundup. --- ## Phase 3: Synthesis — the One-Pager Structure the output in this order: 1. **Verdict** — 2–3 sentences. Bottom-line posture assessment, in business-risk language, no hedging. 2. **Strategic Alignment** — explicitly map current security priorities to the board's stated business priorities from Phase 1, item 4. This is the section that closes the gap between what the CEO/board worries about and what security actually reports on. 3. **Risk Register Summary** — the top 4–5 open risks, translated into business language, with a quantified dollar exposure where it can be reasonably estimated, and a trend (improving / flat / worsening) for each. 4. **External Landscape** — 3–4 findings from Phase 2, cited, and explicitly tied to this organization's profile — not generic commentary that could apply to any company. 5. **Program Maturity & Investment Map** — plot current initiatives against the six NIST CSF 2.0 functions (Govern, Identify, Protect, Detect, Respond, Recover), each with a maturity mark and dollars committed. Render this as an actual diagram, not a table: line-drawing/blueprint style, dimension-mark ticks, uppercase spec-sheet labels. 6. **Decisions Needed** — explicit asks only: budget approvals, policy sign-offs, risk-acceptance decisions. Never an FYI list — if there's nothing to decide, that's not a board item. 7. **Governance Statement** — one paragraph naming the committee, the cadence, and management's relevant expertise, specific enough that it couldn't be copy-pasted into a different company's brief unchanged. If the organization is public, flag explicitly that this paragraph is a starting draft for the company's actual Form 10-K Item 106 disclosure — and that it still needs legal review before it's used in a filing. 8. **Appendix (optional)** — backup KPI trend lines for the due-diligence questions a board member might ask after the main page. --- ## Output Format Produce two separate, self-contained HTML files from the same Phase 1–3 work — don't make the user choose one: 1. **The Implementation Guide** — the full walkthrough: Strategic Inputs, External Landscape Research, the One-Pager itself embedded and framed as "As Presented to the Board," the quarterly production cadence, the Material Incident Escalation Rule, and a closing System Summary with a cadence diagram. This is the teaching/reference document — it explains how the system works, not just what it produced. Build this one first; the One-Pager below is drawn directly from its Synthesis section, not drafted separately. 2. **The Board One-Pager** — the Synthesis section only, lifted out and restyled as its own standalone top-level document: Verdict, Strategic Alignment, Risk Register Summary, External Landscape (condensed to cited bullets), the Program Maturity & Investment diagram, Decisions Needed, and the Governance Statement. Drop everything else — no mention of phases, inputs, or how-to-produce-this steps. This is the literal document that goes in front of the board, so it should read like one: no scaffolding, no meta-commentary, nothing a board member would have to ask "why is this here" about. Use the same visual system for both files: black line work, sharp corners — no rounded corners, no shadows, no gradients — and one accent color used sparingly for emphasis and the verdict box. A ready-to-use starting palette and type system: - Headings: Cormorant Garamond, weight 400, never bold - Body: Charter or a Georgia-based serif - Labels and diagram text: Poppins, uppercase, letter-spaced - Accent: `#0A6556` — white text on accent, never black Swap these for your own brand tokens if you're building this for a company other than the illustrative example. *What good output looks like:* two files that genuinely serve two different readers — the Implementation Guide for the CISO building this for the first time, the Board One-Pager for the board member reading it in the meeting — without either one feeling like a stripped-down or padded-out version of the other. A board member with no security background can read the Verdict and Decisions Needed sections in under two minutes and know exactly what's being asked of them, and every number in the Risk Register and Program Maturity sections traces back to something the user actually supplied or a cited source, never an invented statistic.