How to Communicate Third-Party Risk to the Board

**Executive Summary:** This guidance advises security leaders on communicating third-party and supply-chain cyber risk to boards by framing risks in business terms, favoring continuous monitoring over point-in-time assessments, using simple visual risk indicators (e.g., traffic-light scoring), and presenting prioritized, actionable recommendations so boards can make informed strategic and resource allocation decisions.