Confidential — Board Materials

Security Strategy Brief

Prepared for the Audit Committee — Q3 Board Meeting · Illustrative sample data

✅ Verdict Fundamentals are improving — MFA and asset-inventory work are on track — but two gaps sit directly under this year's stated business priorities. The acquisition is integrating faster than the identity and incident-response work meant to secure it, and a single outage at the claims-processing vendor would be a revenue event, not just a technology one. Two decisions below would close both gaps before they compound.

Strategic Alignment

The board's three stated priorities this year map directly onto this quarter's security gaps. The identity and incident-response items below are integration risk, not abstract cyber risk. The detection gap in field offices is exactly what regional expansion will widen before it narrows. And extending EDR coverage is a cheaper path to closing that gap than adding headcount to compensate for it manually — which speaks directly to the board's cost-discipline priority.

Risk Register Summary

Risk	Business Impact	Est. Exposure	Trend
Acquired-entity identity gap	Employees in the acquired unit still authenticate outside the parent directory, widening the attack surface during integration.	$2M–$4M in incident response and business disruption if compromised	Worsening
Field-office system patching	Building and access-control systems across ~40 field offices aren't on a defined patch schedule.	Limited per site; meaningful in aggregate	Flat
Claims-platform vendor concentration	No contracted failover for the platform the business depends on; two unplanned outages in six months.	Est. $150K per day of downtime, based on the two prior events	Worsening
Untested incident response plan	The IR plan has never been exercised against a scenario involving the acquired entity's systems or staff.	Extended detection-to-containment time in the entity most likely to be targeted during integration	Flat

External Landscape

AI is now the top strategic priority for security leaders nationally, and it isn't in this organization's current plan (Gartner, 2026).
Regulators are rejecting boilerplate board-oversight language in annual filings — the Governance Statement below is written to hold up against that scrutiny (SEC guidance, 2026).
Newly acquired entities and distributed field offices are the two most commonly cited sources of visibility gaps in hybrid organizations this year — both are already on this organization's own register (Industry surveys, 2026).

Program Maturity & Investment Map

Decisions Needed

Approve ~$410K to extend EDR coverage from headquarters to all field offices — the single largest lever on the Detect gap above.
Approve funding for claims-platform failover, or formally accept the risk — the current state is a default, not a decision.
Approve a joint tabletop exercise testing the incident response plan against the acquired entity before the next board meeting.
Approve promoting cybersecurity to a standing quarterly board item — the two items above can't be tracked responsibly on an annual cadence.

Governance Statement

Cybersecurity oversight currently sits with the Audit Committee without dedicated charter language. This brief recommends formalizing that assignment and moving to a standing quarterly agenda item, reported by the CISO with a direct escalation path to the Audit Committee chair for anything meeting the material-incident threshold.

This paragraph is a working draft for the company's Form 10-K Item 106 disclosure and is pending legal review before use in a filing.