Home › Blog › Governance

The Cyber Governance Code of Practice: What It Asks Boards and Directors to Do

The Cyber Governance Code of Practice is the UK government's statement of what a board should do about cyber risk. It was launched by the Department for Science, Innovation and Technology on 8 April 2025, written with the National Cyber Security Centre (NCSC) and governance experts, and it sets out 22 actions for directors under five headings. It is voluntary, and it is not a technical checklist: it is about ownership, decisions and oversight. Awareness is still low. The government's own Cyber Security Breaches Survey 2025/2026 found only 16% of businesses had heard of it, even though 43% reported a breach or attack in the previous 12 months.

Why a governance code for cyber at all?

Most businesses now cannot pay staff, invoice customers or ship orders without their systems. The government's case for the Code is that directors often have little meaningful oversight of how those systems are protected, even though a ransomware attack or a data theft can stop trading and damage customer trust. Cyber risk is treated as a business risk, owned at board level, in the same way as financial or health and safety risk.

The survey numbers show the gap. In 2025/2026, 31% of UK businesses had a board member or trustee with explicit responsibility for cyber security. That rises to 52% of medium businesses and 68% of large ones, but it still leaves a third of large firms with no named owner at the top.

Who the Code is for

The Code is written for boards and directors of medium and large organisations, public and private. It is not meant for the IT or security team that runs controls day to day, although they can use it to show the board what it is responsible for. Small firms are not the target audience, but the government says they should still apply its principles, alongside the NCSC's small business guidance.

It sits at the top of a set of DSIT codes. Organisations following the Software Security Code of Practice or the AI Cyber Security Code of Practice are expected to follow the governance code too. And the government pairs it with Cyber Essentials, the certification for basic technical controls: together, it says, the two set the minimum standard an organisation should have.

The five principles and 22 actions

Almost every action begins "gain assurance that". That wording matters. The board is not asked to do the work itself, but to satisfy itself that the work is being done and is working.

A. Risk management (5 actions)

• Know which technology, processes, information and services are critical to the organisation, and agree their priority.
• Agree senior ownership of cyber risk and make sure it sits inside enterprise risk management and internal controls.
• Define and communicate the organisation's cyber risk appetite, with an action plan to meet it.
• Make sure suppliers and partners are assessed in proportion to their risk.
• Make sure risk assessments are regular and keep up with changes in the business, technology, regulation and threats.

B. Strategy (4 actions)

• A cyber strategy exists and is built into the wider organisational strategy.
• It matches the agreed risk appetite and regulatory obligations.
• Resources are allocated to manage the agreed risks.
• The strategy is being delivered and is achieving what it was meant to.

C. People (4 actions)

• Promote a security culture with positive behaviours and accountability at every level.
• Make sure clear policies support that culture.
• Directors train to improve their own cyber literacy and take responsibility for the data and devices they use.
• Check, with metrics, that staff training and awareness actually work.

The third action is the personal one. Board members are often the most targeted people in a business, through invoice fraud and impersonation, and the Code expects them to do the training too.

D. Incident planning, response and recovery (4 actions)

• There is a plan to respond to and recover from an incident affecting critical services.
• The plan is exercised at least once a year with internal and external stakeholders, and lessons are fed back.
• In an incident, directors take responsibility for regulatory obligations such as reporting, and support critical decisions and external communications.
• A post-incident review feeds lessons into risk assessments, plans and exercises.

E. Assurance and oversight (5 actions)

• A cyber governance structure with clear roles, including ownership at executive and non-executive level.
• Formal reporting at least quarterly, with agreed metrics and tolerances tied to the strategy and risk appetite.
• Regular two-way dialogue with senior executives, including the chief information security officer or equivalent.
• Cyber is covered by existing internal and external audit and assurance.
• Senior executives know their regulatory obligations and the best practice in other codes.

Where to start: a first-year plan for a board

1. Name the owner. Agree which executive owns cyber risk and which non-executive director oversees it. Minute the decision.
2. Ask for the list of critical services. If management cannot say which systems the business cannot run without, that is the first finding.
3. Set the risk appetite. Decide, in plain words, how much disruption or data loss the business could tolerate, so investment decisions have a yardstick.
4. Put cyber on the agenda every quarter with a short, consistent set of metrics rather than a technical report nobody reads.
5. Run an exercise. A tabletop exercise on a realistic scenario, such as ransomware on the finance system, tests the plan and the board's own role in it.
6. Do the training. The NCSC's free Cyber Governance Training and its Cyber Security Toolkit for Boards are part of the same package as the Code.
7. Check the supply chain. Ask how the riskiest suppliers are assessed, and whether Cyber Essentials is a contract requirement.

How it fits with the rest of governance

The Code does not create new legal duties, but it lines up with ones that already exist. Directors must promote the success of the company and exercise reasonable care, skill and diligence under the Companies Act 2006, which our guide to directors' duties sets out. Personal data breaches are reportable to the ICO within 72 hours under the UK GDPR, covered in UK GDPR explained. Listed companies applying the 2024 UK Corporate Governance Code must, for financial years beginning on or after 1 January 2026, declare whether their material internal controls have been effective, and for most businesses cyber controls are among them; see our UK Corporate Governance Code guide. For the wider board picture, read board of directors responsibilities.

The full text is on GOV.UK: Cyber Governance Code of Practice. The survey figures in this article come from the Cyber Security Breaches Survey 2025/2026, published on 30 April 2026. For more on governance and ethics, return to the E-Business Ethics homepage.