Boards of directors don’t care about the minute technical details of the security program. They want to see how key performance indicators are tracked and utilized.