Which Technology KPIs Should Boards See? A Guide to Board-Level IT Reporting
Boards should see a small set of technology KPIs covering cyber resilience, service reliability, major project delivery, technology spend and value, key risks and vendor dependency. The best board reports fit on one or two pages, show trends against agreed targets and highlight the decisions directors need to make.
Written and reviewed by The Technology Office ยท Independent technology advisory
Key takeaways
- Board technology reporting should answer four questions: are we secure, are we reliable, are we delivering, and are we getting value?
- Ten to fifteen KPIs is enough for most boards, each with a target, a trend and a named executive owner.
- Lead indicators such as MFA coverage, patch timeliness and backup restore tests are more useful than counts of blocked attacks.
- Good reports are short, consistent quarter to quarter, written in plain English and end with the decisions required.
The short answer
Boards should see a small, stable set of technology KPIs that answer four questions: are we secure, are we reliable, are we delivering, and are we getting value for money? Ten to fifteen measures across cyber resilience, service reliability, project delivery, spend, risk and vendors is enough for most organisations. Each should show a target, a trend and an owner, and the report should end with the decisions directors need to make.
Why do most board technology reports miss the mark?
Common problems are easy to recognise. The report is long and technical. It changes format every quarter, so trends are invisible. It counts activity, such as tickets closed or attacks blocked, rather than outcomes. And it rarely tells directors what is being asked of them.
Directors are not looking for an operations report. They need enough to exercise oversight: to understand material risk, challenge management and approve the right investments. Our article on board technology risk explains why that oversight matters.
What are the core technology KPIs for boards?
Group KPIs under six headings and choose the few that matter most to your business.
| Area | Example KPI | Why the board cares | Example target |
|---|---|---|---|
| Cyber resilience | MFA coverage across users and admin accounts | Single most effective control against account compromise | 100% of users and admins |
| Cyber resilience | Critical patches applied within target timeframe | Unpatched systems are a common entry point | Within the timeframe set in policy |
| Cyber resilience | Last successful full restore test of critical systems | Proves recovery is possible, not assumed | Tested within the last quarter |
| Cyber resilience | Essential Eight maturity, current against target | Benchmarks posture against a recognised framework | Agreed target maturity level |
| Reliability | Availability of critical systems | Outages stop revenue and service | Agreed service level |
| Reliability | Major incidents and time to restore | Shows operational resilience | Trending down |
| Delivery | Major project status: schedule, budget and benefits | Large projects carry capital and execution risk | All green or with approved recovery plans |
| Value | Technology spend against budget | Financial control | Within agreed tolerance |
| Value | Run versus change spend ratio | Shows capacity to invest in improvement | Agreed ratio for the strategy |
| Risk | Top technology risks, rating and trend | Directs attention to material exposure | No overdue treatments on High risks |
| Risk | Overdue audit or risk actions | Measures follow-through | Zero overdue High items |
| Vendors | Critical vendor service performance and contract renewals | Dependency and concentration risk | Within service levels; renewals planned ahead |
| People | Key-person dependency and critical vacancies | Capability risk | Coverage for every critical role |
Targets above are illustrative. Set your own based on risk appetite and strategy.
Lead or lag indicators?
Lag indicators, such as incidents and outages, tell you what has already happened. Lead indicators, such as MFA coverage, patch timeliness and restore testing, tell you how likely problems are. Boards need both, but lead indicators are where directors can intervene before harm occurs.
Be wary of vanity metrics. "Two million threats blocked" sounds reassuring but tells a director nothing about whether the organisation is protected. Ask instead what percentage of critical controls are in place and tested.
What does a one-page board dashboard look like?
A practical layout:
- Headline summary (three to five sentences). Overall status, what changed since last quarter and the key message.
- KPI table. Each measure with target, current value, previous value and a status colour.
- Top five technology risks. Rating, trend arrow, owner and next action.
- Major projects. One line each: status, budget, schedule, key issue.
- Incidents. Any significant incidents, impact and lessons learned.
- Decisions and approvals required. Specific, with a recommendation.
Write in plain English. Replace "EDR coverage at 87%" with "Security monitoring software is installed on 87% of laptops; the remainder will be covered by the end of the month."
How should cyber security be reported?
Cyber deserves its own short section because directors face growing expectations and exposure. Include posture against a framework such as the Essential Eight, key control coverage, incident trends, results of any independent testing, and readiness for obligations such as data breach notification and ransomware payment reporting. Our guide to cyber security governance for boards covers what directors should ask.
How do you introduce KPIs without overloading management?
- Start with what you can measure reliably. A smaller set of trustworthy data beats a large set of estimates.
- Agree definitions. Write down exactly how each measure is calculated so it is consistent over time.
- Set targets with the board. Targets reflect risk appetite, so directors should endorse them.
- Automate collection where possible. Many measures can be pulled from existing security, service desk and finance tools.
- Keep the format stable. Change KPIs deliberately, once a year, not every quarter.
- Link to the risk register. KPIs should show whether treatments for top risks are working. See our IT risk register template.
What questions should directors ask?
- Which measures are moving the wrong way, and why?
- Are any High risks without a funded treatment plan?
- When did we last prove we can recover our critical systems?
- What are we depending on our vendors for, and how would we know if they were failing?
- What decision do you need from us this quarter?
Better board reporting with The Technology Office
The Technology Office specialises in translating technology into board language. We are independent and vendor-neutral, so our reporting gives directors an unfiltered view, including of risks that sit with incumbent providers. We bring CIO-level experience in front of boards and design KPI sets that are right-sized to the organisation, not borrowed from a large enterprise.
We can design your dashboard and definitions, prepare the quarterly report as your fractional CIO, or provide an independent board technology risk review to test whether what directors see reflects reality. We work with boards of organisations of any size and industry across Australia.
Frequently asked questions
What IT metrics should be reported to the board?
A concise set covering cyber security posture, system availability and incidents, major project status, technology spend against budget, top technology risks and critical vendor performance, each shown against a target with a trend.
How often should boards receive technology reports?
Quarterly is typical, with immediate escalation for major incidents. Boards overseeing large transformation programs or heightened cyber risk may want monthly updates on those specific areas.
What cyber security KPIs should a board track?
Useful board-level cyber measures include MFA coverage, patching within target timeframes, backup restore test results, Essential Eight maturity against target, phishing simulation trends, and the number and severity of incidents.
Who should prepare the board technology report?
The CIO or senior technology leader, reviewed by the CEO or relevant executive. Where there is no CIO, a fractional CIO or independent adviser can prepare it so directors get an unfiltered, business-focused view.
How long should a board technology report be?
One to two pages for the dashboard and commentary, with detailed appendices available if needed. Directors should be able to see status, trends and required decisions within a few minutes.
Mentioned services
These service and regional NSW pages expand on the topics covered in this article.
Need help applying this?
Bring in senior technology leadership without the full-time overhead.
The Technology Office works with Sydney and regional NSW businesses on embedded CIO support, Head of IT leadership, governance, vendor management, cost optimisation, crisis stabilisation, and no-cost technology reviews as a lighter first step.