UK Cyber Governance Code of Practice: Board Guide

Most boards accept that cyber risk is a principal business risk, yet few can show what they personally did to govern it before an incident. The UK Cyber Governance Code of Practice, published by the Department for Science, Innovation and Technology (DSIT) on 8 April 2025 with the National Cyber Security Centre (NCSC), sets out the actions directors are expected to take, grouped under five principles. This guide explains each principle and its 22 actions, what evidence a board should expect to see, how the Code relates to the NCSC Board Toolkit, Cyber Essentials, the Cyber Assessment Framework and the UK Corporate Governance Code, and how a security leader can implement it in practice. It is written for CISOs, company secretaries, risk and audit teams, and the non-executive directors they support.

Key takeaways

The Code is written for directors, not security teams. It lists what boards should confirm, agree, require and own; it deliberately does not tell practitioners how to run controls.
Five principles, 22 actions. Risk management (A1 to A5), strategy (B1 to B4), people (C1 to C4), incident planning, response and recovery (D1 to D4) and assurance and oversight (E1 to E5).
Two actions carry explicit frequencies. The incident plan must be exercised at least annually (D2) and the board should receive formal cyber reporting at least quarterly (E2).
It is guidance, not law, but it sets the yardstick. Regulators, auditors, insurers and courts are likely to ask whether a board took these actions, and listed companies must already declare on material controls under Provision 29 of the UK Corporate Governance Code 2024.
Evidence is the deliverable. For each action, the practical output is a board paper, minute, metric or test record that proves the action was taken.

What the Code is and who it applies to

The Code is a short government publication (a 10-page PDF plus a one-page summary) intended as the first point of reference for board members on cyber governance. DSIT ran a call for views on a draft between 23 January and 19 March 2024 and published the final Code in April 2025. At the time of writing the gov.uk page shows no revision since the April 2025 publication; check the publication page for a newer version before relying on action numbering.

Audience: boards and directors of medium and large public and private organisations. It is explicitly not aimed at the people who manage cyber security day to day, although they will do most of the work of providing evidence.
Smaller organisations: encouraged to follow the principles and to use the NCSC guidance written for smaller organisations.
Status: there is no statute that makes the Code mandatory and no certification against it. Its weight comes from being the government's stated expectation of boards, which makes it a natural reference point when directors' care, skill and diligence is questioned after an incident.
Relationship to other DSIT codes: organisations following the Software Security Code of Practice or the AI Cyber Security Code of Practice are told to follow this Code as well. Cyber Essentials is described as complementary, and the two together as a minimum standard.

The five principles and 22 actions

The wording below is paraphrased; use the gov.uk text when drafting board papers.

Action	What the board should do (paraphrased)	Evidence a board should expect
A1	Confirm the technology, information and services critical to objectives are identified, prioritised and agreed	Board-approved list of critical services and crown-jewel data, with owners
A2	Agree senior ownership of cyber risk and confirm it is integrated into enterprise risk management and internal controls	Named executive risk owner; cyber entries in the enterprise risk register
A3	Define and communicate cyber risk appetite and confirm a plan to meet it	Approved appetite statement with measurable tolerances
A4	Confirm supplier risk is assessed in proportion to risk and the organisation can withstand supply chain and partner risk	Supplier tiering, assessment coverage, concentration and exit plans
A5	Confirm risk assessments are regular and mitigations reflect changes in business, technology, regulation and threat	Assessment calendar; change-triggered reassessments
B1	Confirm a cyber strategy exists, aligned with and embedded in organisational strategy	Approved strategy linked to business plan
B2	Confirm the strategy fits risk appetite, regulatory obligations and anticipated change	Regulatory obligations register; strategy refresh record
B3	Confirm resources are allocated effectively to manage agreed risks	Budget and headcount tied to risk reduction
B4	Confirm the strategy is delivered and achieving outcomes	Roadmap tracking with outcome measures
C1	Promote a cyber security culture with positive behaviours and accountability at all levels	Culture indicators, leadership messages, consequence management
C2	Confirm clear policies support that culture	Policy set, approval dates, exceptions log
C3	Directors improve their own cyber literacy and take responsibility for the data and digital assets they use	Director training records; directors enrolled in MFA and device controls
C4	Confirm, using suitable metrics, an effective training, education and awareness programme	Completion and behaviour metrics, not attendance alone
D1	Confirm a plan exists to respond to and recover from incidents affecting critical technology, information and services	Incident response and recovery plans mapped to A1 services
D2	Confirm the plan is exercised at least annually with internal and external stakeholders, and lessons are fed back	Exercise report with actions and owners
D3	During an incident, take responsibility for regulatory obligations such as reporting, and support critical decisions and external communications	Pre-agreed decision rights, reporting matrix, board call tree
D4	Confirm a post-incident review process feeds lessons into risk, plans and exercises	Post-incident reviews with tracked actions
E1	Establish a cyber governance structure with clear roles, including executive and non-executive ownership	Terms of reference; named NED and executive owners
E2	Require formal reporting at least quarterly, with metrics and tolerances aligned to strategy and appetite	Quarterly board pack with tolerance breaches highlighted
E3	Maintain regular two-way dialogue with senior executives, including the CISO or equivalent	CISO attendance at board or committee; private sessions
E4	Confirm cyber is integrated with internal and external audit and assurance	Internal audit plan coverage; third-party assurance reports
E5	Confirm senior executives know relevant regulatory obligations and best practice in other codes	Obligations register reviewed by legal and compliance

Principle by principle: what good looks like in practice

A: Risk management

The anchor action is A1. Everything else (appetite, supplier assessment, incident plans, metrics) depends on an agreed list of what matters most. Express critical services in business terms (order-to-cash, payroll, clinical systems, plant control) and map each to its supporting systems, data, suppliers and identities. A3 needs appetite statements that can be measured, for example "no critical service unavailable for more than 24 hours" or "no internet-facing critical vulnerability open beyond 14 days", not "low appetite for cyber risk". See the Cyber Risk Appetite Statement Template and the Risk Register Template.

A4 is where many boards are weakest. The Cyber Security Breaches Survey 2025 found only 32% of medium and 45% of large businesses had reviewed cyber risks from immediate suppliers. Boards should see supplier tiering, assessment coverage for the critical tier and the plan if a key supplier is lost. See the Third-Party Risk Management Guide.

B: Strategy

A cyber strategy that the board cannot connect to the business plan fails B1. A practical test: every major strategic initiative (acquisition, cloud migration, AI deployment, new market) should have a cyber line in its business case. B3 asks whether resources match risk, so budget papers should show which risks each investment reduces and by how much, ideally with quantified ranges. See the Cyber Risk Quantification Guide.

C: People

C3 is the action most often skipped because it applies to directors themselves. Directors are high-value targets: they should complete cyber governance training (the NCSC's free online Cyber Governance Training has five modules of around 20 minutes, one per principle), use phishing-resistant MFA, and follow the same device and data handling rules as staff. C4 asks for metrics, so report behaviour (reporting rates for suspicious email, repeat clickers, time to report) rather than completion percentages alone. See the Security Awareness and Human Risk Management Guide.

D: Incident planning, response and recovery

D1 and D2 together require a plan that covers the A1 critical services and is exercised at least annually with internal and external stakeholders, such as key suppliers, insurers, legal counsel and communications advisers. D3 is unusual: it places responsibility for regulatory obligations and critical decisions during an incident with the board. That means decision rights must be agreed in advance: who authorises taking systems offline, engaging with a ransom demand, notifying the ICO within 72 hours under UK GDPR Article 33, or issuing market announcements. See the Tabletop Exercise Guide and the Crisis Management Guide.

E: Assurance and oversight

E1 asks for both executive and non-executive ownership, so name a non-executive director (often the audit or risk committee chair) alongside the accountable executive. E2 sets the reporting floor at quarterly, with metrics and tolerances, which means the board pack must show when a measure is outside tolerance and what is being done. E3 asks for two-way dialogue with the CISO: a direct line to the board or a committee, not only reports relayed through the CIO. E4 ties cyber into internal and external audit, the natural route to the Provision 29 declaration for listed companies. See the Board Cyber Risk Reporting Guide and the Security Governance Committee Charter Template.

How the Code fits with other UK frameworks

Instrument	Owner	Status	Relationship to the Code
Cyber Security Toolkit for Boards	NCSC	Guidance (v3.0, reviewed 8 April 2025)	Reorganised around the five principles; explains how to implement each action, including a page on regulations and directors' duties
Cyber Governance Training	NCSC with DSIT	Free online modules	One module per principle; supports action C3
Cyber Essentials	Government-backed, NCSC	Government-backed certification scheme	Described as complementary; technical baseline beneath the governance layer. See the Cyber Essentials Guide
Cyber Assessment Framework (CAF)	NCSC	Assessment framework used by NIS regulators	Not referenced in the Code; CAF objective A (managing security risk) gives operators of essential services detailed outcomes that evidence actions A and E. See the NCSC CAF Guide
UK Corporate Governance Code 2024	Financial Reporting Council	Comply or explain for companies that report against it; applies to financial years from 1 January 2025	Provision 29 (financial years from 1 January 2026) requires a declaration on the effectiveness of material internal controls; for many companies cyber controls will be material
Software Security and AI Cyber Security Codes of Practice	DSIT	Voluntary codes	Organisations following them should also follow the Governance Code
UK GDPR and NIS Regulations 2018	ICO and sector regulators	Law	Create the reporting obligations the board owns under D3 and must understand under E5. See the UK Cyber Security and Resilience Bill Guide for proposed changes

Implementing the Code: a phased approach

Baseline (month 1): run a gap assessment of the 22 actions, scoring each as evidenced, partly evidenced or not evidenced. The table above is a ready-made template. Agree an executive sponsor and the board committee that will oversee the work.
Foundations (months 1 to 3): agree the A1 list of critical services, name the A2 risk owner, draft the A3 appetite statement and the E1 governance structure. These four unlock the rest.
Director enablement (months 2 to 4): enrol directors in the NCSC Cyber Governance Training, run a board briefing on the threat to your sector, and bring directors' own accounts and devices under the same controls as staff (C3).
Reporting (months 3 to 6): design the quarterly board pack (E2) with 8 to 12 metrics tied to appetite tolerances. Pilot it with the audit or risk committee for one quarter before the full board, and keep the previous format available until the committee signs off.
Exercise (months 4 to 9): hold a board-level tabletop on a scenario affecting an A1 service, involving at least one external party, and record decisions, gaps and actions (D2, D4).
Assurance (months 6 to 12): add cyber governance to the internal audit plan (E4), ask the auditor to test a sample of actions against evidence, and agree how cyber feeds any Provision 29 declaration.
Annual review: refresh the gap assessment, appetite and strategy, and minute the board's conclusion. If a new process proves unworkable, revert to the previous one for that action, record why, and set a date to try again.

Decision guidance: scaling the Code

Large or listed organisations: use a dedicated risk or technology committee with a named NED, align E2 reporting to the Provision 29 controls framework, and commission independent assurance of the cyber programme every two to three years.
Medium organisations: fold cyber into the audit and risk committee, use a lighter quarterly dashboard, and rely on Cyber Essentials Plus plus targeted internal audit for E4.
Organisations without a full-time CISO: E3 still needs a senior security voice; a virtual CISO can provide it. See the vCISO Guide.
Regulated operators (NIS, DORA, financial services): map Code actions to existing regulatory evidence first to avoid duplicate work; the Code's value is the board-level framing, not new controls.
Groups and subsidiaries: decide whether each subsidiary board adopts the Code or relies on group governance, and record that decision; supplier risk (A4) and incident decision rights (D3) are the actions most often lost between levels.

Measuring whether governance is working

The Code asks for metrics under C4 and E2. Useful board-level measures include:

Coverage of critical services: percentage of A1 services with a current risk assessment, tested recovery plan and named owner.
Tolerance breaches: number of appetite tolerances breached in the quarter and median days to return within tolerance.
Supplier assurance: percentage of critical-tier suppliers assessed in the last 12 months.
Recovery capability: achieved versus target recovery time in the latest restore test for each critical service.
Exercise follow-through: percentage of exercise and post-incident actions closed by their due date.
Director readiness: percentage of directors who completed governance training in the last 12 months and are enrolled in phishing-resistant MFA.

Benchmark context: the Cyber Security Breaches Survey 2025 reported that 66% of large and 51% of medium businesses had a board member or trustee with explicit cyber responsibility, and that 75% of large and 53% of medium businesses had a formal incident response plan.

Framework mapping

Code principle	NIST CSF 2.0	NIST SP 800-53 Rev. 5	ISO/IEC 27001:2022 Annex A
A: Risk management	ID.AM-05, GV.RM-01, GV.RM-02, ID.RA-05, GV.SC-07	PM-9, RA-3, SR-6	5.9, 5.19, 5.21
B: Strategy	GV.OC-03, GV.RR-03, GV.OV-01, GV.OV-02	PM-1, PM-2	5.1, 5.31
C: People	GV.RR-01, GV.RR-04, GV.PO-01, PR.AT-01	AT-2	5.1, 5.4, 6.3
D: Incident planning, response and recovery	ID.IM-04, RS.MA-01, RS.CO-02, RC.RP-01, ID.IM-02	IR-4, IR-6, IR-8	5.24, 5.26, 5.27, 5.30
E: Assurance and oversight	GV.RR-02, GV.OV-03, ID.IM-01	CA-2, PM-14	5.2, 5.35

Common failure patterns

Treating the Code as a security team checklist: the CISO fills in a spreadsheet and the board never discusses it. The actions are written for the board; minutes should show directors challenging and deciding.
Appetite without tolerances: a qualitative "low appetite" statement cannot drive E2 reporting or resource decisions. Every appetite line needs a measurable threshold.
Plans that have never met reality: recovery plans that were not exercised against critical services fail when production stops. The Jaguar Land Rover cyberattack halted production from 1 September 2025 for more than five weeks, and the company was reported to have no cyber insurance, which illustrates why D1, D2 and financial resilience belong on the board agenda.
Supplier blind spots: supplier assessment limited to onboarding questionnaires, with no view of which suppliers hold privileged access or could stop a critical service.
No pre-agreed incident decision rights: boards convene for the first time mid-incident to decide on shutdowns, regulator notifications or ransom engagement, losing hours. D3 needs a decision matrix agreed beforehand.
Directors exempt from controls: board members on personal email and devices, outside MFA, undermine C3 and are frequent targets for impersonation and fraud.

Where identity fits

Several actions depend on knowing who and what can reach critical services. A1 is incomplete without the privileged accounts, service accounts, API keys and third-party identities that can change those services, and A4 supplier risk is often realised through supplier credentials. A useful board metric is the number of privileged and non-human identities with access to A1 services that have a named owner and a recent review. See the Board Briefing: NHI Risk.

Practitioner checklist

Download the current Code from gov.uk and confirm the action numbering before building templates.
Score all 22 actions against existing evidence and present the gap assessment to the board or risk committee.
Obtain board agreement on the list of critical technology, information and services (A1) and a named owner for each.
Draft a risk appetite statement with measurable tolerances and link each tolerance to a quarterly metric.
Name both an executive and a non-executive owner for cyber and record them in committee terms of reference.
Enrol every director in the NCSC Cyber Governance Training and bring directors' accounts under phishing-resistant MFA.
Agree an incident decision matrix covering shutdown, regulatory notification, law enforcement contact, ransom engagement and market disclosure.
Run at least one board-level exercise a year with an external party and track every resulting action to closure.
Add cyber governance to the internal audit plan and align it with any Provision 29 material controls declaration.

Standards and references

Related NHI Mgmt Group resources: Board Cyber Risk Reporting Guide · CISO Personal Liability Guide · NCSC Cyber Assessment Framework (CAF) Guide · CISO Guide: First 90 Days · Risk Register Template. This guide summarises the UK Cyber Governance Code of Practice and related UK requirements and is not legal advice.

UK Cyber Governance Code of Practice Guide: Board Responsibilities and Actions