Bring cyber risk into the board's decisions

Set ownership and business context

The Cyber Governance Code of Practice, launched on 8 April 2025, addresses risk management, strategy, people, incident response and assurance. It asks boards and directors to govern cyber risk as part of the organisation's wider management. It does not make technology specialists responsible for every business decision affected by security.

Start by identifying which services, information and systems support your objectives and who is accountable for their risks. Bring cyber considerations into decisions about new services, acquisitions, outsourcing and significant changes. The NCSC board toolkit provides practical support for applying the Code.

Ask questions that lead to decisions

A board pack should explain exposure and choices in language its readers can assess. Technical measures can help, but a count without a denominator, trend or business consequence is easy to misread. Ask what is affected, how reliable the evidence is and what decision is required.

• Which critical service is most exposed, and what would disruption mean for people relying on it?
• Which safeguards are operating, and where do we have exceptions or incomplete evidence?
• What dependency could defeat the recovery plan, including a supplier or shared platform?
• Which improvement needs approval, what would it cost and what exposure would remain?

Require evidence of progress

The Code recommends at least quarterly formal cyber reporting and at least annual exercising of incident plans. Treat these as the Code's recommendations, then consider whether your risk and any sector obligations require a different or additional cadence. An urgent issue should not wait for a scheduled meeting.

For each material action, record an accountable owner, due date and expected evidence. Keep delivery and effectiveness separate: buying a tool, publishing a policy or completing training does not by itself show that the intended risk has reduced. Ask how the organisation will check the outcome and who will challenge the conclusion.

Make oversight a continuing conversation

Review material changes, near misses and incidents alongside routine indicators. Invite the responsible specialist to explain uncertainty and trade-offs, and give them a route to escalate concerns. Record the board's decisions, assumptions, accepted exceptions and follow-up questions so that the next meeting can test what changed.

A practical first meeting can focus on one critical service, its dependencies, its recovery evidence and the three most consequential unresolved actions. This is an editorial starting point for discussion, not an assurance opinion or a claim of compliance with a named framework.