> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pharussecurity.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Board report

> The quarterly board report: one Oslo calendar quarter of vulnerability handling in ten sections, ready to print or save as PDF for the board pack.

<Info>
  **Plans:** Core and Plus, and the free trial. **Who:** every member.
</Info>

The board report shows, for one calendar quarter, that your vulnerability handling works: what Pharus monitored, what it found, how the team responded, whether reports to the authorities went in on time, and what is still open. Every figure comes from what Pharus recorded, so there is nothing to fill in. It is under **Reports → Board report**.

## Open a quarter

<Steps>
  <Step title="Open the report">
    Go to **Reports → Board report**. It opens on the last completed quarter. For a company created during the current quarter, it opens on this quarter so far.
  </Step>

  <Step title="Pick another quarter">
    Choose one under **Quarter**. The list runs from the current quarter back to the quarter the company was created in.
  </Step>
</Steps>

The current quarter is labelled "so far", for example "Q4 2026 so far", and the report says: "The quarter isn't over yet. Figures run up to when this report was generated."

## The period

A quarter runs in Oslo time from 00:00 on 1 January, 1 April, 1 July or 1 October to 00:00 on the first day of the next quarter. The header shows the company, the dates, when the report was generated and "Prepared with Pharus".

A few figures don't follow the quarter: the feed sync times, the phones on the rota and **Open items and risks** are as of the moment the report is generated, and the report says so.

## What it contains

| Section | What it shows |
| - | - |
| 1. Summary | A few headline sentences, and four figures: **Reports filed on time**, **Known exploited vulnerabilities**, **Incidents opened** and **Last drill**. |
| 2. Exposure | How many product families are covered by an SBOM, components monitored and SBOMs received, per family; when each vulnerability feed last synced. A family counts as covered when an SBOM was received in the quarter or was still current at its end. |
| 3. Detection | New matches, exploited matches (on CISA KEV, exploited in EUVD), and name-only matches flagged and confirmed, per product family. |
| 4. Response | Incidents opened and closed, by kind, source and close reason; determinations recorded; the median time from awareness to an approved determination; four-eyes approvals given and declined. |
| 5. Reporting on time | The CRA Art. 14 reports due in the quarter (early warning, notification, final report): filed, on time, late, overdue and not filed, and receipts recorded, with a table of the late and overdue ones. |
| 6. Coordinated vulnerability disclosure | Vulnerability reports received, how many were acknowledged within the business days your disclosure policy promises, late, not yet acknowledged and closed without a reply, and the median time to first response. |
| 7. Security advisories | CSAF advisories published in the quarter, with tracking ID, title, version and date. |
| 8. On-call readiness | Pages sent (test pages included), acknowledged, the median time to acknowledge, escalated to the next person, and not acknowledged before the chain ran out; who on the rota has no verified phone today. |
| 9. Drills | Drills started and completed, the last one completed, and whether the annual drill is done: one completed in the last 12 months. |
| 10. Open items and risks | As of now: open incidents and their next deadline, overdue reports to the authorities in any regime, product families without an SBOM for 30 days or more, vulnerability feeds not synced for 24 hours or more, and people on the rota without a verified phone. |

**On time** means submitted at or before the CRA Art. 14 deadline: 24 hours and 72 hours from awareness for the early warning and the notification; for the final report, 14 days after a fix is available (actively exploited vulnerability) or one month after the notification (severe incident). A report due in the quarter but not filed by its end counts as overdue.

Drills never count towards incidents, response or reporting. They appear only under **Drills**. See [Drills](/incidents/drills).

## Print or save it as PDF

<Steps>
  <Step title="Open the quarter">
    Open the quarter you want under **Quarter**.
  </Step>

  <Step title="Print">
    Select **Print or save as PDF**. Your browser's print dialog opens.
  </Step>

  <Step title="Save as PDF">
    To get a file for the board pack, choose "Save as PDF" as the destination in the print dialog.
  </Step>
</Steps>

The printout leaves out the app's navigation and the controls, so it shows only the report. The report is in the language you use Pharus in.

<Note>
  On Starter, **Reports → Board report** shows what the plan includes instead, and nothing of the report is computed. See [Plans](/plans).
</Note>

## Related

<CardGroup cols={2}>
  <Card title="Technical documentation" icon="folder-check" href="/reports/technical-file" />

  <Card title="Audit trail" icon="history" href="/reports/audit-trail" />

  <Card title="Reporting clocks" icon="alarm-clock" href="/incidents/clocks" />

  <Card title="Drills" icon="swords" href="/incidents/drills" />
</CardGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.