Exposure by business activity
Risk projected on what creates value: which activities are exposed, how far beyond appetite, and what depends on them.
KEY CAPABILITY · BOARD-READY REPORTING
The posture your board can decide on.
The Cyber Cockpit reads the whole platform from the board’s chair: exposure by business activity, indicators against appetite, and the decisions waiting for an owner. Verified data, no slide assembly, every number one click from its evidence.
Critical activities within appetite
5 / 7
Decisions pending
3
Evidence verified
92 %
Exposure by business function
E-commerce
Logistics
Payments
Customer service
HR
Decisions pending
- MFA on the supplier portal Fund
E-commerce · Logistics CIO Q4
- Residual risk on Click & Collect Accept
Logistics COO until Q1
- Legacy ERP patching, derogation Defer
Payments CFO 60 days
Exposure reads by business function against the appetite the board approved; each pending decision carries the activities at stake, an owner and a deadline. In the product, every line opens on the records behind it.
KEY CAPABILITIES
What the board reads, and what it decides.
Indicators against appetite
KRIs with thresholds the board approved, read as within, watch or breach, so the conversation starts from the gap.
Decisions pending, with an owner
Accept, fund, defer or transfer: each arbitration framed with its business impact, its cost, its owner and its deadline.
The board pack, from live data
Posture, trend, exposure and open decisions exported from the platform state, not rebuilt in slides the night before.
Drill-down to the evidence
Every figure opens: from a board-level indicator down to the control, the evidence item or the vendor answer behind it.
One picture, several altitudes
The CISO, risk, operations and the board read the same verified state. Alignment stops being a reconciliation meeting.
THE SURFACES BENEATH
Four maps feed the reporting.
01
Control Atlas
Every control, its frameworks, owners, verification state and evidence, in one navigable atlas.
02
Organization Map
Entities, subsidiaries, teams and responsibilities mapped to their risks and controls.
03
Value Chain Map
Business activities, the systems that carry them and the third parties they depend on.
04
Cyber Knowledge
Policies, standards and doctrine as living knowledge, the corpus Ernest reasons over.
THE ARBITRATION
A board decides between options, not between dashboards.
Most cyber reporting ends with a posture. Board-Ready Reporting ends with a choice: accept a residual risk, fund a control, defer a remediation under a derogation, transfer through insurance or a supplier. Each option carries the activities at stake, the cost and the owner, and the decision is recorded where the audit will look.
cockpit - decisions pending
$ decisions --pending --horizon Q4
3 arbitrations · 2 activities beyond appetite · 1 derogation expiring
fund: MFA on supplier portal · impact: e-commerce, logistics
accept: residual risk on click & collect until Q1 · owner: COO
board pack ready · evidence trail complete
FAQ
Board-Ready Reporting, in practice
Is this a separate module to license?
No. Board-Ready Reporting is the Cyber Cockpit, the transversal layer of the platform: its views light up with the modules you activate and deepen as more of your governance lives in Mindlapse.
What does the board actually see?
Exposure by business activity, indicators against the appetite it approved, the trend since last quarter, and the decisions waiting for it, each with impact, cost, owner and deadline. Nothing it cannot open.
How are decisions recorded?
Accept, fund, defer or transfer: the decision, its rationale and its owner are written to the record and tracked to verified closure in GRCOps, so the next board and the next audit find a trail, not a slide.
Where does the data come from?
From the shared platform graph: risks, controls, evidence, entities and third parties contributed by the modules, verified by Ernest, never re-keyed by hand.
GLOSSARY
Terms to know
SEE THE WHOLE BOARD
Bring the question your board asked last quarter.
A live session: how the platform would answer it, with what evidence, and which decision it would put on the table.