Every slide specified to build-ready detail: exact titles, layouts, fill-in skeletons, a worked example, speaker notes, and the trap on each slide.
Part of the CISO Interview Template Pack · cisoprep.com
Rebuild this in Google Slides or PowerPoint: 16:9, one idea per slide, your numbers in the [brackets]. Ten core slides plus a five-slide appendix. Ten minutes presented, rehearsed down to eight, because you will be interrupted.
About the example. Every filled example uses Meridian Health, an illustrative mid-cap healthcare SaaS company invented for this template. It does not exist; every number is made up. Do not copy its numbers; copy its specificity. The setup: patient scheduling and billing SaaS for hospital systems, HIPAA-regulated, pursuing HITRUST, one disclosed incident two years ago, new CISO at their second audit committee meeting.
On-slide title: Security Posture and Priorities: [Quarter, Year]
Layout: No charts. Three bands: posture sentence in large type, three risk rows (name, status color, trend arrow), the ask in a box at the bottom.
Skeleton:
Example (Meridian Health, illustrative):
Speaker notes: "This slide is the whole story; the next nine are the reasoning. Posture, the three risks I manage you through, and the one decision I need."
Trap: A posture sentence that cannot be falsified ("we continue to mature our program"). If it would survive a breach unedited, it says nothing, and skimming directors read only this slide.
On-slide title: What Security Protects at [Company]
Layout: Three columns, one per revenue or value stream: how the money is made, the systems and data it depends on, what a bad security year does to it. No security terminology anywhere.
Skeleton:
Example (Meridian Health, illustrative):
Speaker notes: "Before threats, here is what I believe security exists to protect here, in your terms. If this slide is wrong, I want to know now." Then pause and genuinely invite correction.
Trap: Filling it with your world instead of theirs. A maturity wheel or the word "NIST" on slide 2 says you serve a methodology. This is the credibility slide; it works only if a director could have written it.
On-slide title: The Three Risks That Matter Most, and Why
Layout: Three boxes: risk name in plain English, business impact in one sentence tied to a slide-2 stream, likelihood in words, why it made the top three. One footer line on what you excluded.
Skeleton:
Example (Meridian Health, illustrative):
Speaker notes: "Fiduciary duty attaches to material risk, so your oversight attaches to this slide. These are three of forty-plus on the register (appendix 3); my job is the ranking."
Trap: Listing more than four risks. Five is a catalog, not a judgment. The exclusion footer is what proves ranking happened.
On-slide title: Where We Stand Against Those Risks
Layout: A three-row table, one row per slide-3 risk. Columns: in place, not in place, residual risk in business terms. One color chip per row; at least one row should not be green.
Skeleton:
Example (Meridian Health, illustrative):
Speaker notes: "I want to be precise about deployed versus proven. Two rows contain gaps, and I would rather you hear them from me with a plan than from an auditor without one."
Trap: A wall of green. Boards distrust all-green posture slides and audit chairs hunt for the contradiction with the audit trail. Honesty here is what makes slides 5 through 9 believable.
On-slide title: Since We Last Met: Better, Worse, New
Layout: Three labeled rows: one improvement, one degradation, one new item. Each: what changed, why, what you are doing about it. Resist adding a fourth improvement.
Skeleton:
Example (Meridian Health, illustrative):
Speaker notes: "You see us four times a year, so trajectory matters more than any snapshot. One better, one worse, one new, and I will report the degradation before anyone else finds it."
Trap: Reporting only improvements. Nobody's quarter contains only improvements and directors know it; a self-reported degradation with a dated fix builds more trust than ten green arrows.
On-slide title: When It Happens: Detection, Response, Recovery
Layout: One horizontal timeline (detect → contain → recover) with current numbers under each phase, each labeled tested or estimated. Small box: date and scope of the last real exercise, plus the weakest link.
Skeleton:
Example (Meridian Health, illustrative):
Speaker notes: "The question you actually carry is not whether an incident happens but whether we handle it well. Here is what is tested versus asserted; the estimated number is why the recovery exercise is on the next slide."
Trap: Presenting untested numbers as capabilities. "We can recover in 24 hours" is an assertion until you have done it, and being caught inflating one number poisons the rest of the deck.
On-slide title: The Next Four Quarters, Mapped to Risk
Layout: A table, not a Gantt chart. Maximum six rows: initiative, which slide-3 risk it reduces, what "done" changes, quarter, status.
Skeleton:
Example (Meridian Health, illustrative):
Speaker notes: "Every row maps to a risk you have already seen; rows that did not were cut. The first row needs your decision today, which is the next slide."
Trap: The wish list: initiatives justified by "maturity" or "best practice" rather than a named risk. The mapping column is the whole slide, and it is your budget defense in cost-cutting season.
On-slide title: How We Compare
Layout: One simple bar or dot chart: your framework score against sector benchmark, by domain. One honest sentence below on where you lag.
Skeleton:
Example (Meridian Health, illustrative):
Speaker notes: "You would ask anyway, so here it is with structure: above peers in three domains, behind in two, and the roadmap targets those two. Full assessment in appendix 2."
Trap: Waiting to be asked. Directors calibrate across the other boards they sit on; answering preemptively reads as senior, and "it's hard to compare" reads as evasion regardless of how true it is.
On-slide title: The Decision I Need Today
Layout: One box, large type: the ask in one sentence, what it buys in risk terms, the consequence of declining, stated without drama. If there is no ask, the slide exists and says so.
Skeleton:
Example (Meridian Health, illustrative):
Speaker notes: "I am asking for $1.8M against a specific gap, not for general support. If the answer is no, I want the residual risk formally acknowledged." Then stop talking.
Trap: The vague ask ("continued investment in our security journey"). Boards make decisions; give them one. The consequence-of-no line converts your request into their decision.
On-slide title: Where We Stand, What I Need, What Do You Need From Me
Layout: Three lines of text, nothing else: posture sentence from slide 1, ask from slide 9, one question directed at the board.
Skeleton:
Example (Meridian Health, illustrative):
Speaker notes: "That is the ten minutes; the rest of the time is yours." The closing question converts the session from performance review to working relationship, and it feeds next quarter's delta slide.
Trap: Introducing anything new. A new fact on slide 10 is a fact you failed to place earlier, and it eats the discussion time that is the point of the meeting.
Build these, reference them ("the detail is in appendix 3"), never walk through them. Navigating your own appendix cold under questioning proves the summary sits on real substance.
One discipline for the whole deck: board materials are discoverable. After an incident, plaintiffs' lawyers and regulators read old decks. Write every slide for a hostile reader: accurate, no overpromises, risk acknowledged in writing with a plan attached.
The prompt is some variant of "present your security strategy for our company," to a panel simulating the board. Same deck, compressed, with three changes.
Compression. Eight slides for a 20-minute slot. Merge slide 4 into slide 3 (each risk box gains a "where I believe you stand" line). Drop slide 5: no prior meeting, no delta. Drop slide 8 unless you have a genuinely defensible public benchmark for their sector. The appendix shrinks to two slides: your assumptions register and your first-90-days validation plan, which is what panels dig into.
Sourcing. Slide 2 comes from the 10-K or S-1 risk factors, earnings calls, and product docs. Slide 3 is your prioritized read of public information. Slide 9 becomes the year-one ask, with honest error bars.
The caveat, delivered once, up front, immediately after slide 1. Use this language verbatim or close to it:
"Everything in this deck is built on public information: your filings, your job postings, your disclosed history. In my first 30 days I would validate these assumptions directly, and I would expect at least one of my three priorities to change. What I'm presenting is my current read and the reasoning behind it, not a finding."
Then never caveat again; one structural caveat reads as senior, a caveat per slide reads as hedging. You are scored on prioritization and business fluency, not coverage: three risks with sharp reasoning beat twelve with none. Expect the planted "are we secure?" question; the answer shape is "no organization is immune: here is what you appear resilient against, here is what would hurt, here is what I would do about the second list."
One to two weeks out, get 30 minutes with the audit chair; your CFO or general counsel brokers it if the relationship is new. The chair hates surprises more than bad news, will often set up your ask in the meeting itself, and will tell you what other directors are sensitive about.
The email, adapted to your names and dates:
Subject: 30 minutes before the [October] audit committee meeting
[Name], ahead of the [date] meeting I'd like 30 minutes to walk you through the security materials before they go out with the board package. Two things I want you to see before the room does: a gap in our vendor reassessment cycle that I'm reporting along with the fix, and a $1.8M ask on privileged access that I'd value your read on before I bring it to the committee. Happy to work around your calendar; [CFO name] can vouch that I keep these short.
In the session: walk the deck in ten minutes, spend the time on the degradation and the ask, close with "what is the committee not asking me that it should be?" Final materials go through the corporate secretary a week ahead; assume every director has skimmed them, and never read slides verbatim to people who have.
Meridian Health is a fictional company created for this template. All figures attached to it are invented for illustration.