Board cyber readiness assessment: 21 questions for directors
Answer these 21 questions in one board meeting to see how well your board governs cyber risk and how ready you are for the Cyber Security and Resilience Bill (CSRB). Score only what you’ve seen evidence for, then turn the gaps into three actions with named owners.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
How to use this assessment
This is a self-check for directors on cyber readiness and the Cyber Security and Resilience Bill (CSRB). It's designed for one board meeting. It doesn't replace a technical assessment, and it isn't an official test. It's built from the government's Cyber Governance Code of Practice and the board-related parts of the Cyber Assessment Framework (CAF).
Score each question:
- 2: yes, and we've seen evidence
- 1: we believe so, but haven't seen evidence
- 0: no, or we don't know
The questions
Scope and legal position
- Have we had a reasoned answer on whether we're in scope of the Bill, directly or as a supplier?
- Do we know which regulator would oversee us?
- Has someone reviewed how the Bill's reporting deadlines fit with our other obligations, such as UK GDPR?
Risk
- Is there an agreed list of the technology, information and services most critical to us?
- Has the board approved a cyber risk appetite?
- Does a named senior person own cyber risk, and is it part of enterprise risk management?
- Do we understand who would plausibly attack us, and what they'd target?
Suppliers
- Do we know which suppliers could disrupt our critical services?
- Do relevant contracts include security and incident notification terms?
- Have we considered the chance of being designated a critical supplier, or of a supplier being designated?
People and culture
- Have directors had cyber security training in the past year?
- Do we measure whether staff training works, beyond completion rates?
- Do senior leaders follow the same security rules as everyone else?
Incidents
- Do we have a tested plan for responding to and recovering from an incident?
- Have we exercised it in the past 12 months, with external stakeholders involved?
- Could we decide on and send a 24-hour notification, including out of hours?
- Do we know who speaks to regulators, customers, staff and the media?
Oversight
- Does the board receive formal cyber reporting at least quarterly?
- Do those reports include metrics and tolerances tied to our risk appetite?
- Is cyber integrated with internal and external audit?
- Has independent testing or assurance been reported to the board in the past year?
Reading your score
The bands below are a rule of thumb that we've set for this page, not a regulatory standard.
| Score (out of 42) | What it suggests | Next step |
|---|---|---|
| 0 to 14 | Cyber isn't yet governed at board level | Name an owner and commission a scoping review now |
| 15 to 28 | Foundations exist, but they rest on assumption | Ask for evidence on every "1", and start a CAF self-assessment |
| 29 to 37 | Strong governance with some gaps | Fix the gaps and test with an exercise |
| 38 to 42 | Well governed, on current evidence | Commission independent assurance to check your view |
Any zero on questions 1, 6, 14 or 16 deserves attention, whatever your total.
Where boards usually fall short
Official survey figures suggest many boards have work to do. The Cyber Security Breaches Survey 2025/2026 found:
- 31% of businesses have a board member responsible for cyber security, or 68% of large businesses
- 15% of businesses review risks from immediate suppliers
- 6% review their wider supply chain
These cover all businesses, so a larger organisation should compare itself with the higher end.
What evidence to ask for
Don't accept a verbal "yes" for a score of 2. Ask for:
- the scoping analysis, including any legal advice
- the risk appetite statement and latest top risks
- a supplier register showing the most critical suppliers
- the most recent exercise report and resulting actions
- the latest penetration test or independent assurance summary
- recent board minutes showing challenge and decisions
From the score to an action plan
- Pick three actions, not twenty. Give each a named owner and date.
- Add them to the board's forward plan, and review them at the next meeting.
- Re-score in six months and record why any score changed.
- Take a wider view. Our free readiness assessment covers your wider controls, and the board paper template helps your team report back.
Remember the Bill isn't yet law, and the detailed requirements for security and governance are expected in regulations and guidance. Update your answers when they're published.
Sources
Frequently asked questions
No. It is our self-check, based on the Cyber Governance Code of Practice and board-related parts of the Cyber Assessment Framework. The score bands are a rule of thumb.
The board, with the executive who owns cyber risk. Use it in a meeting so directors can challenge the answers and ask for evidence.
We suggest every six months while the Bill and its regulations are still developing, and after any major incident or change in the business.
No. It looks at governance, not technical controls, and the Bill is not yet law. Use a technical assessment and legal advice to confirm your position.