Boards are growing increasingly concerned with cybersecurity, and CISOs are responding by using metrics to help boards assess technology investments, guide the security budget and develop strategic priorities. In general, however, technical and business metrics focus on operational issues and neglect risk management, leaving the board without proper data to make important decisions. It is vital that the CISO delivers a program-focused message supporting the oversight of a comprehensive and multidisciplinary cybersecurity program. This discussion will explore how security leaders can communicate effectively with the board by developing measurements to weave security into the enterprise risk management process.