---
title: "FAIRCON18 Video: A Master Class on Reporting Cyber Risk to the Board"
description: With cybersecurity now top of mind for corporate boards, this advice from Omar Khawaja, CISO at Highmark Health on infosecurity risk reporting comes just in time.
---

[The FAIR Institute Blog ](https://www.fairinstitute.org/blog)

# [FAIRCON18 Video: A Master Class on Reporting Cyber Risk to the Board](https://www.fairinstitute.org/blog/faircon18-video-a-master-class-on-reporting-cyber-risk-to-the-board)

 Written by [Jeff B. Copeland](https://www.fairinstitute.org/blog/author/jeff-b-copeland) | Dec 5, 2018 1:29:00 PM

[Case Study: Reporting to the Board: What Got You Here, Won't Get You There](https://link.fairinstitute.org/discussion/317/reporting-to-the-board-what-got-you-here-wont-get-you-there-omar-khawaja#latest),  a  presentation by [Omar Khawaja, CISO at Highmark Health](https://www.fairinstitute.org/blog/meet-a-member-omar-khawaja-introducing-fair-to-highmark-health) at the recent [2018 FAIR Conference](https://www.fairinstitute.org/blog/topic/fair-conference-2018) at Carnegie Mellon University was a master class in communicating risk to the board and the business. Omar was this year’s winner of the FAIR Institute’s [Business Innovator Award](https://www.fairinstitute.org/blog/2018-fair-awards-honor-risk-management-leaders-jason-ha-of-pwc-jack-freund-of-tiaa-and-omar-khawaja-of-highmark-health) for his ambitious and creative introduction of FAIR to Highmark.

Watch the [Reporting to the Board](https://link.fairinstitute.org/discussion/317/reporting-to-the-board-what-got-you-here-wont-get-you-there-omar-khawaja#latest) video – a (free) FAIR Institute membership is required ([join now](https://www.fairinstitute.org/get-involved)).

With cybersecurity now top of mind for corporate boards, Omar’s advice is just in time.  Among the tips you’ll hear discussed in this video:

- Boards trust the word of the National Association of Corporate Directors, so peg your reporting to the five principles of the [NACD Director's Handbook on Cyber-Risk Oversight](https://www.nacdonline.org/insights/publications.cfm?ItemNumber=10687) (which are about taking an enterprise level view of infosecurity).
- Have the confidence to answer “I don’t know” to board questions – but always follow up.
- Don’t spout a lot of cybersecurity metrics. “The point is to make them feel like it’s being managed… All they need to know ‘Is it getting better or worse?’.” Omar shows a chart with upward trends, including for staff training. “The next question becomes ‘How do we know that’s enough?’” He suggests making a comparison to benchmarks such as the FAIR Maturity Survey, which Jack Jones presented in his [keynote conference address](https://www.fairinstitute.org/blog/video-jack-jones-faircon18-keynote-too-often-we-fall-back-on-easy-answers).
- “Align your reporting to your organization’s maturity and culture.”
- Join at least one board yourself, to see how things look from the other side of a boardroom.

Watch the video [Case Study: Reporting to the Board: What Got You Here, Won't Get You There](https://link.fairinstitute.org/discussion/317/reporting-to-the-board-what-got-you-here-wont-get-you-there-omar-khawaja#latest) (FAIR Institute membership required. [Join now](https://www.fairinstitute.org/get-involved).)

Omar also appeared on the FAIR Conference panel [Bridging the Gap Between the CISO and the CIRO](https://www.fairinstitute.org/blog/video-faircon18-panel-explains-how-to-bridge-the-gap-between-ciso-and-cro), with Dennis Cronin, the CRO at Highmark, for more discussion of reporting cyber risk analytics to the board.

**Related: **

[Jack Jones and James Lam on NACD Blog: “Get the Right Cybersecurity Reports”](https://www.fairinstitute.org/blog/jack-jones-and-james-lam-on-nacd-blog-get-the-right-cybersecurity-reports)

[More from the 2018 FAIR Conference ](https://www.fairinstitute.org/blog/topic/fair-conference-2018)

[View full post](https://www.fairinstitute.org/blog/faircon18-video-a-master-class-on-reporting-cyber-risk-to-the-board)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Jeff B. Copeland"
  },
  "dateModified" : "2018-12-05T13:44:01.162Z",
  "datePublished" : "2018-12-05T13:29:00Z",
  "headline" : "FAIRCON18 Video: A Master Class on Reporting Cyber Risk to the Board",
  "image" : {
    "@type" : "ImageObject",
    "height" : 400,
    "url" : "https://cdn2.hubspot.net/hubfs/1616664/Omar%20Khawaja%20Highmark%20Health%20FAIRCON%202018.jpg",
    "width" : 600
  },
  "mainEntityOfPage" : "https://www.fairinstitute.org/blog/faircon18-video-a-master-class-on-reporting-cyber-risk-to-the-board",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60,
      "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
      "width" : 60
    },
    "name" : "FAIR Institute Blog"
  }
}
```