Tools & Resources / Boardroom briefing
Cyber Risk in the Boardroom: The UK’s New Governance Code Explained
A practical boardroom guide to risk, ownership and assurance.
Overview
In April 2025, the UK Government published the Cyber Governance Code of Practice—a landmark framework setting out the governance actions that boards and directors are responsible for when managing cyber security risks. Developed by DSIT and the NCSC in partnership with industry, the Code represents the clearest articulation yet of what “good” cyber governance looks like at board level. This guide explains the Code’s five principles, their associated actions, and how organisations can implement them.
Interactive / Self-assessment
Review your board’s cyber readiness.
Use the self-assessment to review your position against the Code’s five principles.
Cyber Governance / Board Readiness
Why This Code Matters
Cyber risk is now a material business risk for virtually all organisations. Yet governance of that risk has often lagged behind other areas of board oversight. The statistics from the Cyber Security Breaches Survey 2025 make the case clearly:
74%
of large businesses experienced a breach/attack (2025)
67%
of medium businesses experienced a breach/attack
27%
of businesses have a board member responsible for cyber (down from 38% in 2021)
64%
of high-income charities experienced a breach/attack
The Code addresses a fundamental gap: while cyber incidents can halt operations, damage customer trust, and drain millions from the bottom line, too few boards have clear ownership of cyber risk or understand their responsibilities.
Key Point
The UK Government regards the Cyber Governance Code of Practice together with Cyber Essentials certification as setting the minimum standard organisations should have in place to manage cyber risk.
Ministerial Call to Action (October 2025)
In October 2025, the government sent a joint letter to CEOs and chairs of leading UK companies signed by six senior figures including the Chancellor, the Secretary of State for Science, Innovation and Technology, and the NCSC CEO. The letter makes clear that cyber resilience is now a matter of economic and national security.
The Government’s Three Requests to Business Leaders
01
Use the Cyber Governance Code of Practice
Make cyber risk a board-level priority. Complete the free training. Plan and exercise how you would respond to a major incident.
02
Sign up to NCSC Early Warning
A free service that alerts you to potential cyber attacks on your network, giving invaluable time to detect and stop incidents before they escalate.
03
Require Cyber Essentials in your supply chain
The government already requires this of its suppliers. Leading businesses should embed the same standards across their supply chains.
The letter highlights a critical gap: while 90%+ of boards now recognise cyber security as a priority, this hasn’t translated into action. Only 14% of businesses assess the cyber risks posed by their immediate suppliers—despite supply chain attacks increasing significantly.
92%
less likely to claim on cyber insurance if Cyber Essentials certified
14%
of businesses assess supplier cyber risks
90%+
of boards recognise cyber as a priority—but action lags
“Cyber resilience is a critical enabler of economic growth, so getting this right will promote growth and foster a stable environment for investment and innovation.”
— Joint Ministerial Letter, October 2025
Who Should Use the Code?
The Code is designed for:
- Boards and directors of medium and large organisations (public and private sector)
- Non-executive directors seeking to understand their cyber oversight responsibilities
- Executive leadership responsible for enterprise risk management
The Code is not intended for those managing day-to-day cyber security operations—but it can be used to clarify to boards what their responsibilities are. Small organisations are encouraged to adopt the Code’s principles, with additional NCSC guidance available for SMEs.
The Five Principles
The Code is structured around five governance principles, each with specific actions. The recurring phrase “Gain assurance” is deliberate—boards must obtain and maintain confidence that controls are effective, typically through audits, reviews, or third-party validation.
A
A. Risk Management
A1
Gain assurance that the technology processes, information and services critical to the organisation’s objectives have been identified, prioritised and agreed.
A2
Agree senior ownership of cyber security risks and gain assurance that they are integrated into the organisation’s wider enterprise risk management and internal controls.
A3
Define and clearly communicate the organisation’s cyber security risk appetite and gain assurance that the organisation has an action plan to meet these risk expectations.
A4
Gain assurance that supplier risk is routinely assessed, proportionate to their level of risk, and that the organisation is resilient to cyber security risks from its supply chain and business partners.
A5
Gain assurance that risk assessments are conducted regularly and that risk mitigations account for recent, or expected, changes in the organisation, technology, regulations or wider threat landscape.
B
B. Strategy
B1
Gain assurance that the organisation has developed a cyber strategy and this is aligned with, and embedded within, the wider organisational strategy.
B2
Gain assurance that the cyber strategy aligns with the agreed cyber risk appetite (A3), meets relevant regulatory obligations, and accounts for current or expected changes (A5).
B3
Gain assurance that resources are allocated effectively to manage the agreed cyber risks (A3 and A5).
B4
Gain assurance that the cyber strategy is being delivered effectively and is achieving the intended outcomes.
C
C. People
C1
Promote a cyber security culture that encourages positive behaviours and accountability across all levels. This should be aligned with the organisation’s strategy (B1).
C2
Gain assurance that there are clear policies that support a positive cyber security culture.
C3
Undertake training to improve your own cyber literacy and take responsibility for the security of the data and digital assets that you use.
C4
Gain assurance, using suitable metrics, that the organisation has an effective cyber security training, education and awareness programme.
D
D. Incident Planning, Response and Recovery
D1
Gain assurance that the organisation has a plan to respond to and recover from a cyber incident impacting business critical technology processes, information and services.
D2
Gain assurance that there is at least annual exercising of the plan involving relevant internal and external stakeholders and that lessons from the exercise are reflected in the incident plan (D1) and risk assessments (A5).
D3
In the event of an incident, take responsibility for individual regulatory obligations, such as reporting, and support the organisation in critical decision making and external communications.
D4
Gain assurance that a post incident review process is in place to incorporate lessons learned into future risk assessments (A5), response and recovery plans (D1) and exercising (D2).
E
E. Assurance and Oversight
E1
Establish a cyber governance structure which is embedded within the wider governance structure of the organisation. This should include clear definition of roles and responsibilities, including ownership of cyber at executive and non-executive director level.
E2
Require formal reporting on at least a quarterly basis, set suitable metrics to track, and agree tolerances for each. These should be aligned to the cyber strategy (B1) and based on the agreed cyber risk appetite (A3).
E3
Establish regular two-way dialogue with relevant senior executives, including but not limited to, the chief information security officer (or equivalent).
E4
Gain assurance that cyber security considerations (including the actions in this code) are integrated and consistent with existing internal and external audit and assurance mechanisms.
E5
Gain assurance that senior executives are aware of relevant regulatory obligations, as well as best practice contained within other Codes of Practice.
Regulatory Context
The Code aligns with broader regulatory direction in the UK and internationally:
| Regulation/Framework | Relevance |
|---|---|
| UK Cyber Security and Resilience Bill | Expected later in 2025. Will strengthen the regulatory framework for critical national infrastructure. The Code prepares organisations for these requirements. |
| NIS2 Directive (EU) | Places cyber security responsibility at board level with overlapping focus on risk, incident response, and accountability. UK organisations with EU operations should note alignment. |
| DORA (EU Financial Services) | Digital Operational Resilience Act requires financial services firms to have board-level accountability for ICT risk. Code principles align closely. |
| ISO 27001 / NIST CSF | DSIT has published mapping documents showing how the Code relates to these and other international standards. |
How CISOs Can Use the Code
Chief Information Security Officers play a critical role in bridging technical teams and the board. The Code provides CISOs with:
- A framework for board reporting – structure updates around the five principles rather than technical metrics
- Common language – frame discussions in governance terms that resonate with directors
- Clear expectations – reference specific actions when seeking board engagement or investment
- Regulatory alignment – demonstrate how cyber governance supports compliance obligations
Getting Started
For organisations beginning their cyber governance journey, the government’s October 2025 letter provides clear priorities:
- Board awareness — Ensure all board members have completed the Cyber Governance Training modules
- Gap assessment — Review current practices against each of the 22 actions in the Code
- Assign ownership — Identify executive and non-executive owners for cyber risk (Action E1)
- Define risk appetite — Articulate what risks the organisation will and won’t accept (Action A3)
- Establish reporting — Implement quarterly cyber reporting to the board (Action E2)
- Register for Early Warning — Sign up to the NCSC’s free Early Warning service to receive alerts about potential attacks on your network
- Test incident plans — Conduct annual exercises involving the board (Action D2)
- Address supply chain — Require Cyber Essentials certification from suppliers and implement the controls on your own systems
Key Takeaway
The Cyber Governance Code of Practice, reinforced by the October 2025 ministerial letter to UK business leaders, represents a step-change in how the government expects boards to engage with cyber risk. While currently voluntary, the Code sets out the governance standard that underpins forthcoming legislation and aligns with international regulatory direction. The government’s message is clear: 90%+ of boards recognise cyber as a priority, but recognition must now translate into action. Start with the Code, complete the training, register for Early Warning, and require Cyber Essentials across your supply chain. These actions, the government states, are based on learnings from previous attacks and will have an immediate positive impact on resilience.