1. Have a problem statement: What is wrong from a business perspective. Example: Password are unencrypted which dramatically increases risk of class-action law

1. Have a problem statement: What is wrong from a business perspective. Example: Password are unencrypted which dramatically increases risk of class-action lawsuits. 2. Have a list of corrective controls: Staff training, audits, technical controls 3. Cost statement: X control costs $Y. 4. Risk analysis: Problem reduced by 43%. 5. Summary statement: Execute this, it pays for itself. Bear in mind an executive summary is either superficial or its a lie. You need to have a real technical report behind the executive summary so that it isn't a lie.