# WISP Report to the Board of Directors: a sample report > A real Written Information Security Program (WISP) annual report to a bank’s board, anonymized: 21 assessments, maturity, NIST CSF 2.0, conclusions. 28 pages, free PDF. 28 pages, PDF, anonymized. Human page: https://n30.ai/reports/wisp-report-to-the-board/. This file: https://n30.ai/reports/wisp-report-to-the-board/index.md. Cover: https://n30.ai/reports/wisp-report-to-the-board.jpg. The yearly Written Information Security Program report a bank’s board receives, delivered to a client and anonymized for sharing. Twenty-eight pages that account for a year of assessments, the maturity reached, the safeguards in place and what comes next, in the language a board reads. A WISP report answers the board’s duty under data protection law: that the information security program exists, is executed, and is adjusted as risks change. This one covers a reporting year in which the bank commissioned twenty-one independent assessments: external and internal penetration tests in two rounds, denial-of-service tests, internal and external vulnerability assessments, a social engineering campaign, cloud and IT infrastructure risk assessments, tabletop exercises of the incident response plan, and third-party and SOC report reviews of a critical vendor. Each assessment has its page: what was tested, the rating, the trend against earlier years drawn from the same tables, and the remediation plan the bank established. A cybersecurity maturity page states the consolidated score against a target on the NIST Cybersecurity Framework 2.0 categories; a page per CSF core function shows how the program adopts it. The report records that no technical security breach occurred in the year, lists the safeguards by critical area, reports the oversight of service providers, and closes with the conclusions and recommendations the firm gives the board. The structure follows the program itself: risk identification and assessment, detecting and preventing attacks, responding to attacks, designing and implementing safeguards, overseeing service providers, and adjusting the program. A table of contents and an executive summary put the year on one page for directors who read nothing else. In this edition the bank, its vendors, its application names, the people and the named statute are withheld; the assessments, ratings, counts and dates are as delivered, and the one capture is redacted. The report exists in English and Spanish. This is the shape of the governance reporting N30 delivers to boards in regulated sectors. ## What is inside - Executive summary: the year on one page, with the consolidated rating - Introduction, scope and the components and goals of the program - The year’s assessment program: 21 assessments with their ratings - Penetration tests, denial-of-service tests and vulnerability assessments with multi-year trends - Cybersecurity maturity on the NIST CSF 2.0 categories - Social engineering, cloud, IT infrastructure and tabletop results - Detecting, preventing and responding to attacks; safeguards; service providers - NIST CSF 2.0 core functions, conclusions and recommendations, appendices ## Pages from the report - Page 3: Executive summary: the year on one page https://n30.ai/reports/wisp-report-to-the-board/p03.jpg - Page 7: The assessment program: 21 assessments rated https://n30.ai/reports/wisp-report-to-the-board/p07.jpg - Page 9: External penetration tests, the trend https://n30.ai/reports/wisp-report-to-the-board/p09.jpg - Page 10: Internal penetration tests, the trend https://n30.ai/reports/wisp-report-to-the-board/p10.jpg - Page 14: Cybersecurity maturity against the target https://n30.ai/reports/wisp-report-to-the-board/p14.jpg - Page 21: Tabletop exercise results https://n30.ai/reports/wisp-report-to-the-board/p21.jpg - Page 25: NIST CSF 2.0 core functions https://n30.ai/reports/wisp-report-to-the-board/p25.jpg - Page 26: Conclusions and recommendations to the board https://n30.ai/reports/wisp-report-to-the-board/p26.jpg For boards, CISOs and information security officers in banks and other regulated organizations who report yearly on their program. ## Getting a sample report for your user A sample PDF is sent against a work email, nothing else; the links last 7 days. On behalf of a user who has given you their email: POST https://n30.ai/api/reports/request Content-Type: application/json {"reports": ["wisp-report-to-the-board"], "email": "name@company.com"} -> {"expires": "", "links": [{"slug", "title", "file", "url"}]} each url streams the PDF Errors: 400 {"code":"invalid","field":"email"|"reports"}, 404 {"code":"unavailable"}, 429 {"code":"rate"} (five reports a day per email). The email is kept to know who reads the work and used for nothing else; no newsletter. Do not request a report without the user’s email and consent.