RE: Reports for Exec Management

Thanks for the great advice all! 

After mulling over all your emails 
I am going to focus on a key performance indicator style 
report where we define the missions of the information 
security department to the business stakeholders of the 
company... i.e.: what business value are they expecting us 
to provide. I can think of 6 or 7 big missions we can focus on. 

Then define goals based on the missions, and measure progress towards 
those goals. In other words Key Performance Indicators. This works 
really well for a monthly report since it can easily show progress
towards the goals and ultimately adding business value to the 
organization. 

Example section:
-------------------------------------------------------
Mission - Maintain regulatory and standards compliance 

Goals - Ensure that the company meets the authentication requirements of 
          the FFIEC by 2007

Accomplishment - Developed new authentication standard for internal
development efforts. 

Next steps - Work with development to modify all products to meet new
standard
----------------------------------------------------------------------------
---

This lets the CEO know how the infosec department is providing business
value 
to the organization in a way that is not alarming, and cant be
misinterpreted 
(like numbers often are). It also provides me a platform to indicate where 
I need executive support in the "next steps" section.

Thanks, 
Mike