Board paper template for the Cyber Security and Resilience Bill
Use this unofficial template to brief your board on the Cyber Security and Resilience Bill (CSRB). It covers whether the Bill affects you, your gaps and exposure, your options, the budget and the decisions you need. Adapt it, keep it to about two pages, and check facts before submitting.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
How to use this template
Use this to brief your board on the Cyber Security and Resilience Bill (CSRB) and ask for a decision. It's unofficial, and neither the Bill nor regulators prescribe a format. Keep the finished paper to about two pages, replace the square brackets, and delete anything that doesn't apply.
A good paper answers three questions: does this affect us, how exposed are we, and what do you need the board to decide?
The template
BOARD PAPER
Title: Cyber Security and Resilience Bill: position and proposed response
Date: [date]
Author and sponsor: [name, role] / [executive sponsor]
Purpose: [For decision]
Decision requested: [One sentence, e.g. approve the plan and budget in section 6]
1. SUMMARY
- The Bill is [current stage, checked on date]. It is not yet law.
- Our assessment: we are [directly regulated as X / likely a supplier to regulated
organisations / not in scope, but affected through customers].
- Main risk: [one sentence].
- We request: [decision, cost, owner].
2. WHY THIS MATTERS TO US
- Services affected: [critical services]
- Customers or contracts affected: [names or types, revenue at risk]
- Regulator: [name, or "to be confirmed"]
3. OUR POSITION UNDER THE BILL
Basis of assessment: [legal advice / internal review, date]
Category: [OES / RDSP / RMSP / critical supplier risk / indirect only]
Reasons: [thresholds, size test, services provided]
Assumptions and open questions: [items awaiting regulations or guidance]
4. WHAT WOULD BE REQUIRED
Duty | Current state | Gap | Owner
Registration | [ ] | [ ] | [ ]
Security measures | [ ] | [ ] | [ ]
24-hour and 72-hour reports | [ ] | [ ] | [ ]
Customer notification | [ ] | [ ] | [ ]
Supplier management | [ ] | [ ] | [ ]
Board governance | [ ] | [ ] | [ ]
5. RISK AND EXPOSURE
- Maximum fine (if regulated): greater of £17m and 4% of turnover for serious
failures; greater of £10m and 2% for administrative failures. For us: [figure].
Check against the final Act.
- Regulator cost recovery: [estimate, or "not yet known"]
- Incident impact: [scenario, duration, estimated cost]
- Commercial impact: [contracts at risk if we can't evidence security]
- Current risk rating against appetite: [rating] against [appetite]
6. OPTIONS
Option A: Do nothing until the regulations are published
Cost: [ ] Risk: [ ]
Option B: Do no-regrets work now, and wait on the rest (recommended)
Cost: [ ] Risk: [ ]
Option C: Full programme now
Cost: [ ] Risk: [ ]
Recommendation and reason: [ ]
7. PLAN
Next 30 days: [e.g. confirm scope, name owner, test reporting route]
Next 90 days: [e.g. CAF self-assessment, supplier register, exercise]
By [date]: [e.g. close priority gaps]
Budget: [one-off] and [annual]
8. BOARD ACTIONS REQUESTED
[ ] Approve Option [ ]
[ ] Confirm [name] as accountable board-level owner
[ ] Approve budget of [amount]
[ ] Agree quarterly reporting on [metrics]
[ ] Schedule a board-level incident exercise by [date]
9. REPORTING
Next report: [date]
Metrics: [e.g. time to triage, critical patches overdue, CAF scores, top suppliers
assessed, exercise actions closed]
Tips for each section
Summary. Many directors will read only this section. State the decision clearly, and check the Bill's stage on the day you submit the paper, as it's moving quickly. Our status page tracks it.
Position. Explain your reasoning, and be honest about what's uncertain. The OES vs RDSP vs RMSP guide can help you with this section. If you're relying on the small business exclusion, check how group companies affect it.
Fines. Work out your own figure, but don't lead with it. A headline fine can distract from likelier costs such as downtime, lost contracts and recovery work. Don't suggest directors face personal fines under the Bill unless the final text says so. See director liability.
Options. Because detailed requirements are still to come, the board may ask why it shouldn't wait. Separate the work that's useful regardless of the final detail, like incident exercises, supplier registers and clear ownership, from work that depends on regulations.
Plan. Use the Cyber Assessment Framework (CAF) as your benchmark if appropriate, and be clear this is your choice unless your regulator has said otherwise. A self-assessment gives you scores to report.
Reporting. The Cyber Governance Code of Practice asks for formal reporting at least quarterly, with metrics and tolerances. Pick a small set of measures that could change a decision.
Before you submit
- Has your legal team reviewed the scope section?
- Does each cost have a source, and is each estimate labelled as an estimate?
- Have you defined OES, RMSP and other terms for non-specialists? The glossary can help.
- Has the executive sponsor agreed the recommendation?
- Does the decision requested match the actions in section 8?
Sources
Frequently asked questions
No. Neither the Bill nor regulators prescribe a format, so treat this as a working draft and adapt it to your own board’s style.
That is a judgement for your board. Much of the groundwork is useful regardless, including clear ownership, supplier registers and incident exercises. Separate that work from anything that depends on later detail.
We suggest not. Maximum fines are worth stating accurately, but the likelier costs of downtime, recovery and lost contracts often make a stronger case.
An executive who can own the risk and the budget. The Cyber Assessment Framework also expects a board-level individual with overall accountability for security.