The Cyber Governance Code of Practice: a guide for boards
The Cyber Governance Code of Practice tells boards and directors how to govern cyber risk across five areas: risk, strategy, people, incidents and oversight. It’s separate from the Cyber Security and Resilience Bill (CSRB), but following it puts boards in a stronger position as requirements develop.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
What the Code is
The Cyber Governance Code of Practice was published by the Department for Science, Innovation and Technology on 8 April 2025. It sets out what boards and directors should do to govern cyber risk, and is aimed mainly at medium and large organisations. Small organisations are encouraged to use its principles.
It's separate from the Cyber Security and Resilience Bill (CSRB). The Code isn't created by the Bill, and we have not found anything in the Bill's text that requires boards to follow it. Don't confuse it with the code of practice in Part 3 of the Bill, which is a different power relating to duties under future regulations.
The five sections
| Section | What the board should do |
|---|---|
| A: Risk management | Get assurance on critical technology and information, assign senior ownership, set a risk appetite, check supplier risk is managed, and make sure assessments stay current |
| B: Strategy | Confirm a cyber strategy exists, fits the wider strategy and risk appetite, is properly resourced, and is achieving results |
| C: People | Promote a positive culture, make sure clear policies support it, build your own cyber literacy, and use metrics to check training works |
| D: Incident planning, response and recovery | Confirm a plan exists, exercise it at least annually, take responsibility for regulatory obligations during an incident, and make sure lessons are captured |
| E: Assurance and oversight | Set up a governance structure with clear roles, require formal reporting at least quarterly, maintain two-way dialogue with senior executives, integrate cyber into audit, and confirm executives understand regulatory duties |
Why it matters if the Bill doesn't require it
The direction of travel. In the Lords, the Government resisted personal liability for executives and was reported as pointing to board-level governance requirements in future regulations, aligned with the Cyber Assessment Framework (CAF). Those details have not been settled.
Overlap with the CAF. CAF outcome A1.a expects regular board-level discussion on timely, accurate information, and a board-level individual with overall accountability. Following the Code gives you much of what's needed for that.
Directors' existing duties. Directors must already exercise reasonable care, skill and diligence under the Companies Act 2006. A clear record of how the board handled cyber risk helps show that. See director liability.
The gap is real. The Cyber Security Breaches Survey 2025/2026 found only 31% of businesses have a board member responsible for cyber security, rising to 68% of large businesses.
Turning it into board actions
The Code tells boards what to confirm. Here's how to put that into practice over a year. The timings are our suggestion, apart from the quarterly reporting and annual exercise, which come from the Code.
| When | Action |
|---|---|
| First meeting | Name a senior owner, agree a critical services list, and agree a reporting format |
| Next quarter | Approve a risk appetite statement and review top risks |
| Every quarter | Receive a formal report with metrics and tolerances |
| Twice a year | Review supply chain risk and the delivery of the strategy |
| Once a year | Take part in an incident exercise, then review lessons |
| Once a year | Review regulatory obligations, including readiness for the Bill |
Questions directors can ask now
- Which technology and services would stop us operating if they failed, and who owns that list?
- What level of cyber risk have we agreed to accept, and are we within it?
- Which suppliers could cause us the most harm?
- Who decides whether an incident must be reported, and could we do that within 24 hours?
- When did we last exercise our plan with external stakeholders, and what changed afterwards?
- Are we likely to be regulated under the Bill, and how do we know?
If the answers rely on reassurance rather than evidence, ask for evidence. The NCSC publishes further questions in its board toolkit.
Support available
- The Cyber Security Toolkit for Boards follows the same structure as the Code and includes a list of questions with possible answers.
- The government offers training for directors through its cyber governance resources.
- Our board readiness assessment and board paper template help you apply this to the Bill.
Sources
Frequently asked questions
Boards and directors, mainly of medium and large organisations in the public and private sectors. Small organisations are encouraged to use its principles. It is not aimed at people running day-to-day security.
We have found nothing in the Bill’s text requiring boards to follow it. It is government guidance, but it can help show directors have taken cyber risk seriously.
The Code asks for formal reporting at least quarterly, with metrics and tolerances aligned to strategy and risk appetite.
No. Part 3 of the Bill contains a separate power to issue a code of practice for people with duties under future regulations.