Cybersecurity Board Report Template for Crypto Companies
Quick answer. A crypto company's board report should fit on one page: top risks with owners, trend metrics and decisions needed. Track open Criticals and Highs, time to fix, signer health, hot wallet exposure, incidents and vendor risk.
Video transcript
A crypto company's board report should fit on one page. Generic templates miss where your risk sits: signing keys, hot wallets and onchain vendors.
Some rules now put board oversight of cyber risk in writing. NYDFS wants a CISO report at least annually, SEC rules require describing board oversight, and NIST CSF 2.0 is voluntary. This is not legal advice.
Public companies also face a clock. Form 8-K disclosure is generally due four business days after an incident is found material, and that rule still stands.
The page has six parts: a headline, up to five top risks, six to eight metrics, incidents and near misses, material changes, and decisions needed.
Decisions are the point. Each ask needs options, a recommendation and a deadline, such as approving a lower hot wallet cap.
Then add the onchain numbers generic templates skip: open Criticals and Highs, time to remediate, signer health, hot wallet exposure, privileged roles and monitoring coverage. Show trends, not snapshots.
Signer health deserves its own line. Check who holds each key, on what device, and whether every signer can still be reached.
Quarterly, send the one page. Annually, deliver the full written report. As needed, report material issues promptly, and keep the packs and minutes.
Guardian's Cybersecurity Maturity Assessment scores your program against NIST CSF 2.0 from evidence. Read the full template, or talk to Guardian at guardian.security.
Boards are expected to oversee cyber risk, and some rules now say so in writing.
At a crypto company, much of that risk sits where a generic template never looks: signing keys, admin roles, hot wallets and onchain vendors.
This template keeps the report to one page. The detail goes in an appendix the board can ask for.
Where this article discusses regulation, it covers the technical and security side only. It is not legal advice; confirm how the rules apply to you with counsel.
What the Rules Expect
| Source | Applies to | What it asks for |
|---|---|---|
| NYDFS 23 NYCRR 500.4 | NYDFS covered entities | A CISO's written report to the board at least annually |
| SEC Regulation S-K Item 106 | SEC registrants | Describe board oversight and how the board is informed |
| SEC Form 8-K Item 1.05 | SEC registrants | Disclose, generally within four business days of finding an incident material |
| NIST CSF 2.0, Govern | Any organization, voluntarily or by mandate | Leadership accountable; results used to adjust strategy |
NYDFS Part 500
Section 500.4, amended effective November 1, 2023, has the CISO report in writing at least annually to the senior governing body. Where applicable, the report covers:
- Confidentiality of nonpublic information and the security of information systems.
- Cybersecurity policies and procedures.
- Material cybersecurity risks.
- How well the program works overall.
- Material cybersecurity events in the period.
- Plans to fix material gaps.
The CISO must also report material issues in a timely way. The board must understand cybersecurity well enough to oversee it, and regularly receive and review management's reports.
SEC rules
The SEC adopted its cybersecurity disclosure rules on July 26, 2023. Item 106 requires public companies to describe in the 10-K how the board oversees cyber risk and how it is kept informed.
Form 8-K Item 1.05 disclosure is generally due four business days after a company determines an incident is material.
In May 2025, SIFMA and four banking groups petitioned the SEC to rescind the 8-K incident item.
As of November 2026, we found no SEC action on it in the Federal Register or SEC press releases, so Item 1.05 stands.
NIST CSF 2.0
CSF 2.0 (February 26, 2024) is a framework, not a rule. NIST says it may be adopted voluntarily or through government mandates.
Its Govern function says leadership "is responsible and accountable for cybersecurity risk". Its Oversight category uses results "to inform, improve, and adjust the risk management strategy".
It also describes practitioners giving executives key performance and risk indicators.
The One-Page Template
- Headline: one sentence on posture and the direction since last quarter.
- Top risks: five at most, each with an owner, a trend and a treatment.
- Metrics: six to eight numbers, each against last quarter and a target.
- Incidents and near misses: what happened, the impact and what changed.
- Changes: new chains, products, vendors, key holders or rules.
- Decisions needed: each with options, a recommendation and a deadline.
Write the risk register in the board's language. For example:
| Risk | Owner | Trend | Treatment | Board ask |
|---|---|---|---|---|
| Admin key compromise | CTO | Down | Upgrades moved behind a timelock | None |
| Hot wallet drain | Head of operations | Flat | Lower the hot wallet cap | Approve the new cap |
| Signer phishing | CISO | Up | Hardware keys, transaction checks | None |
| RPC provider outage | Infrastructure lead | Up | Add a second provider | Approve budget |
Decisions are the point. A report that asks for nothing teaches the board to stop reading.
Onchain Metrics That Matter
Pick numbers the board can watch move. Show each as a trend, not a snapshot.
| Metric | How to measure it | Why the board cares |
|---|---|---|
| Open Criticals and Highs | From audits, pentests and bounties, with age | Known paths to loss, still open |
| Time to remediate | Median days from report to verified fix | Whether the team closes risk |
| Signer health | Signers verified this quarter; threshold; any single-key path | A multisig is only as safe as its signers |
| Hot wallet exposure | Hot balance against the approved cap | What one compromise can take |
| Privileged roles | Keys that can upgrade, pause or mint; timelocks | Who can change the rules |
| Incidents and near misses | Count, severity, time to detect and contain | What happened, and what almost did |
| Vendor risk | Critical vendors reviewed, with exit plans | Custodians, RPCs, oracles, bridges and cloud |
| Monitoring coverage | Contracts, keys and domains watched around the clock | What nobody watches, nobody answers |
For remediation benchmarks, see our audit remediation timelines.
Signer health deserves its own line. Check who holds each key, on what device, and whether every signer can still be reached.
Quarterly vs Annual Reports
- Quarterly: the one page, to the board or its risk committee.
- Annual: the full written report, covering the six NYDFS topics where they apply.
- As needed: material issues, reported in a timely way, and the 8-K clock for public companies.
NYDFS sets an annual floor. A short quarterly update means the annual report holds no surprises.
Keep the packs and minutes. Item 106 asks public companies to describe how the board is informed, and those records show it.
Someone has to own the report. If you have no full-time CISO, see vCISO for crypto companies.
How Guardian Helps
Our Cybersecurity Maturity Assessment scores your program against NIST CSF 2.0 from evidence, not interviews.
It states the program for a board in the shape regulations ask for, such as the CISO's annual written report under NYDFS 500.4.
Managed Security covers the risks behind several of these metrics. Guardian maps every path to your funds and maintains that threat model in real time.
Our security operations team reviews every multisig transaction before it is signed. Monitoring runs around the clock, and a Guardian engineer responds when something fires.
Frequently Asked Questions
What should a security report to the board include?
A one-line headline, the top risks with owners and treatments, six to eight trend metrics, incidents and near misses, material changes, and the decisions the board must make. Put the detail in an appendix.
How often should the CISO report to the board?
For NYDFS covered entities, the CISO must report in writing to the senior governing body at least annually, and in a timely way on material issues. A one-page quarterly update between annual reports keeps the board current.
What security metrics should a crypto company show its board?
Open Criticals and Highs, time to remediate, signer health, hot wallet exposure against its cap, privileged roles and timelocks, incidents and near misses, vendor risk and monitoring coverage.
Does NIST CSF 2.0 require board reporting?
No. CSF 2.0 describes outcomes, not how to reach them, and may be adopted voluntarily. Its Govern function holds leadership accountable for cybersecurity risk and uses results to adjust strategy, which a regular board report supports.
Sources
- Cornell LII: 23 NYCRR 500.4, Cybersecurity governance (amended effective November 1, 2023)
- SEC: SEC Adopts Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies, press release 2023-139 (July 26, 2023)
- Cornell LII: 17 CFR 229.106, Item 106 Cybersecurity
- Mayer Brown, Free Writings & Perspectives: SIFMA and Other Industry Groups Petition SEC for Rescission of Cybersecurity Disclosure Requirement (June 8, 2025)
- SEC: File 4-856, Joint Petition for Rulemaking to Amend the SEC Cybersecurity Risk Management, Strategy, Governance and Incident Disclosure Rule (comments May to July 2025; accessed November 6, 2026)
- NIST: The NIST Cybersecurity Framework (CSF) 2.0, CSWP 29 (February 26, 2024)
- Guardian: Regulatory Compliance
- Guardian: Managed Security
Give your board numbers it can trust
Guardian watches the contracts, keys and signers behind your metrics around the clock, and states your program the way your board and regulators read it.