In order to effectively operationalize your risk quantification practices, the enterprise leadership must be able to understand and map those cyber risk metrics to the outcomes that they're looking to achieve (otherwise why accept the risk). For technical leaders, like a CISO, having the processes in place to facilitate the delivery of that risk data in such a way that its understandable to business leaders is critical – C-suite members and the board need this information in the digital age and it is often the breakdown of communication that stops them from getting it.
With data breaches capturing headlines weekly, CEO's are growing more and more concerned with the states of their cyber posture. However, this is a whole new classification of risk for CEO's and BoD's that leaves them searching for answers in ways that will fit into their current methodologies of managing risk. With cyber-focused KRI's that are constructed by the CISO in tandem with the strategy put out by the CEO, this helps the CEO understand the risks associated with the strategy – and either accept or reject that level of risk.