Leave a Comment / Across Industry / By

UK Cyber Governance Code of Practice: What Boards Are Expected to Do

The Cyber Governance Code of Practice is a voluntary UK government code, launched on 8 April 2025 by the Department for Science, Innovation and Technology (DSIT) and co-designed with the National Cyber Security Centre (NCSC), that sets out what boards and directors are expected to do to govern cyber risk. It groups 22 board-level actions under five principles: risk management, strategy, people, incident planning, response and recovery, and assurance and oversight.

Board members reviewing documents together at a meeting table

It is not law and comes with no certification scheme. But the government calls it the “first point of reference for board members”, and it now sits behind the government’s Cyber Resilience Pledge and its advice to business leaders. This guide explains what the Code says, what each principle asks of a board, the free support that comes with it, and how a board can start using it.

Who published the Code, and when

The Code was launched on 8 April 2025 by the Cyber Security Minister. It was developed by DSIT and, in the words of the GOV.UK publication page, “co-designed with technical experts from the National Cyber Security Centre (NCSC) and a range of governance experts across industry”. The launch press release was issued jointly by DSIT and the NCSC.

It followed a DSIT call for views in 2024 and a government response in January 2025, which set out the draft Code’s five principles. The GOV.UK publication page lists three organisations against it: the Department for Digital, Culture, Media and Sport, the National Cyber Security Centre and the Department for Science, Innovation and Technology.

The Code describes itself as “the foundational code in DSIT’s modular approach to cyber security codes of practice”. It sits alongside Cyber Essentials: the Code says the two together “set out the minimum standard that organisations should have in place to manage their cyber risk”.

Is it mandatory? Its legal status

No. In its January 2025 response the government said the Code would be “launched as a voluntary tool, that is, without its own statutory footing”, and that it would be published without an accompanying assurance scheme, so there is no certificate of compliance to obtain.

Voluntary does not mean it can safely be ignored, for two reasons:

  • The government has kept firmer options open. It said that if uptake is limited it “will look into options for firmer levers to promote greater uptake”, which “may include the future introduction of legislation and/or the utilisation of public procurement requirements”.
  • Organisations can commit to it publicly. Signatories of the voluntary Cyber Resilience Pledge, announced in April 2026 and formally launched at 10 Downing Street on 7 July 2026, commit, among other actions, to “Implement all actions within the Cyber Governance Code of Practice” and to ensure all board members take the NCSC’s Cyber Governance Training within three months and then annually. The government said in November 2026 that more than 230 organisations had signed.

In April 2026 ministers’ open letter to business leaders on AI cyber threats also told larger businesses to use the Code. Separately, some organisations face binding rules (for example NIS2 or DORA for EU operations, and the Cyber Security and Resilience (Network and Information Systems) Bill, which was still before Parliament in November 2026); the Code does not replace those, and how it relates to directors’ legal duties is a separate question.

Who the Code is for

The Code is aimed at boards and directors of both public-sector and private organisations. It is designed for medium and large organisations, but says small organisations “should seek to implement the Code’s principles” and should also use the NCSC’s guidance written for them.

It is not a technical standard. The Code says it is “not intended to be used by those who are responsible for the day-to-day management of cyber security”, though security teams can use it to show boards what their responsibilities are. It covers what the board oversees, not how the security team configures systems.

The five principles and 22 actions

The Code itself is short. Each principle carries four or five actions, and the actions cross-reference each other, so the risk appetite (A3) shapes the strategy (B2), resourcing (B3) and reporting tolerances (E2).

PrincipleWhat the board is expected to do (paraphrased from the Code)
A: Risk management (5 actions)Gain assurance that the technology processes, information and services critical to the organisation are identified, prioritised and agreed; agree senior ownership of cyber risks and gain assurance that they are integrated into enterprise risk management and internal controls; define and communicate cyber risk appetite and gain assurance there is an action plan to meet it; gain assurance on supplier and supply chain risk; gain assurance that risk assessments are regular and account for change.
B: Strategy (4 actions)Gain assurance that a cyber strategy exists and is embedded in the wider organisational strategy; that it fits the risk appetite and regulatory obligations; that resources are allocated effectively; and that it is being delivered and achieving its outcomes.
C: People (4 actions)Promote a cyber security culture of positive behaviours and accountability; gain assurance that policies support it; undertake training to improve your own cyber literacy; gain assurance, using suitable metrics, that staff training and awareness is effective.
D: Incident planning, response and recovery (4 actions)Gain assurance there is a response and recovery plan for business-critical services; that the plan is exercised at least annually with internal and external stakeholders; take responsibility for individual regulatory obligations such as reporting during an incident and support critical decisions and external communications; gain assurance that post-incident reviews feed lessons back in.
E: Assurance and oversight (5 actions)Establish a cyber governance structure with clear roles, including ownership of cyber at executive and non-executive director level; require formal reporting at least quarterly with metrics and agreed tolerances; hold regular two-way dialogue with senior executives including the CISO; gain assurance that cyber (including the Code’s actions) is integrated with existing internal and external audit and assurance; gain assurance that senior executives know their regulatory obligations and the best practice in other codes of practice.

Most actions begin with “gain assurance”. The Code’s glossary defines it as: “Obtain and maintain confidence or verification that systems, processes or controls are effective, reliable, and meet required standards, often through audits, reviews, or third-party validations”. In other words, the board is not expected to do the security work, but it is expected to see evidence that the work is done and working.

The actions that land on directors personally

A few actions are more concrete than the rest and are worth reading closely, because they describe things directors do themselves, or set a minimum frequency:

  • C3, your own training: “Undertake training to improve your own cyber literacy and take responsibility for the security of the data and digital assets that you use.”
  • D2, annual exercising: the Code asks for “at least annual exercising of the plan involving relevant internal and external stakeholders”, with lessons fed into the plan and risk assessments.
  • D3, during an incident: directors “take responsibility for individual regulatory obligations, such as reporting”, and support critical decisions and external communications.
  • E1, named ownership: a governance structure including “ownership of cyber at executive and non-executive director level”.
  • E2, quarterly reporting: “Require formal reporting on at least a quarterly basis, set suitable metrics to track, and agree tolerances for each.”

The free support package around the Code

The Code is one part of what the government calls a free package of support on cyber governance. In the Code’s own words, the Code sets out “what actions boards need to take” and the training “confirms why and how board members take those actions”.

  • NCSC Cyber Governance Training: an introductory module plus five modules, one per principle. The NCSC says each module “should take approximately 20 minutes to complete” and includes a short scenario video, five multiple-choice questions and a printable summary. Organisations can also build it into their own learning platform; the NCSC says the package “is completely free to use” under a simple licence agreement.
  • NCSC Cyber Security Toolkit for Boards: first published in 2023 and reviewed on 8 April 2025, it is now “organised around the Cyber Governance Code of Practice” and explains how boards can implement each principle. Its downloads include a set of questions boards can ask about cyber security.
  • Cyber governance mapping: DSIT documents mapping the Code to other frameworks, including the NCSC Cyber Assessment Framework, the NIST Cybersecurity Framework and ISO/IEC 27001:2022, useful if your organisation already reports against one of them.

How far UK organisations have got

The government’s Cyber Security Breaches Survey 2025/2026, published in April 2026, was the first edition to ask about the Code. It found that, when prompted, 16% of businesses and charities had heard of it, rising to 51% of large businesses. Board-level responsibility for cyber security sat at 31% of businesses overall and 68% of large businesses, and 57% of medium businesses had a formal cyber security strategy. So even among the organisations the Code targets, many boards have work to do.

How a board can start applying the Code

The Code does not prescribe an implementation order. A practical sequence that follows its own cross-references looks like this:

  1. Get every director through the NCSC training. It supports action C3 and gives the board a shared vocabulary before any gap analysis.
  2. Run a short self-assessment against all 22 actions. For each, ask management what evidence exists today, and mark it as met, partly met or not met.
  3. Name owners (A2 and E1). Agree which executive owns cyber risk and which non-executive director leads oversight, and record it in the governance structure.
  4. Agree the cyber risk appetite (A3). This anchors strategy, resourcing and reporting, so do it before redesigning the board pack.
  5. Reset reporting (E2). Ask for a formal report at least quarterly, with a small set of metrics and an agreed tolerance for each.
  6. Book the exercise (D2). If the incident plan has not been exercised in the last year, schedule one that includes directors and key external parties.
  7. Bring in audit (E4). Ask internal audit how cyber, and the Code’s actions, fit into the existing assurance plan.

For example, imagine a 300-person firm with no named cyber owner on the board: steps 3 and 5 alone would give it a clear owner and a quarterly view of cyber risk against agreed tolerances. The detailed questions a board might put to its CISO, and how directors build their own knowledge, are covered in separate articles.

If you work in or alongside a security team, our free lessons on cybersecurity governance and reporting cyber risk to the board explain the mechanics behind actions A2 and E2.

Training for directors at LSCS

Our Board Governance of Cybersecurity course is a 12-hour, BCS Tech 10 accredited programme for directors and senior executives, run as one day in person or five days virtual instructor-led, and its UK content includes the NCSC Board Toolkit. It costs £1,900; contact us for dates. We can also tailor training for a leadership team through enterprise training.

Frequently asked questions

Is the Cyber Governance Code of Practice mandatory?

No. The government published it as a voluntary tool without its own statutory footing, and there is no certification scheme. It has said it may look at legislation or procurement requirements if uptake is limited.

Who published the Cyber Governance Code of Practice?

It was launched on 8 April 2025 by the Department for Science, Innovation and Technology (DSIT) and co-designed with the National Cyber Security Centre (NCSC) and governance experts from industry. The GOV.UK publication page lists the Department for Digital, Culture, Media and Sport, the NCSC and DSIT as its organisations.

What are the five principles of the Cyber Governance Code of Practice?

Risk management; strategy; people; incident planning, response and recovery; and assurance and oversight. They contain 22 actions in total.

Does the Code apply to small businesses?

It is designed for medium and large organisations, but the Code says small organisations should seek to implement its principles and should also use NCSC guidance written for them.

How often should the board receive cyber reports under the Code?

Action E2 asks boards to require formal reporting at least quarterly, with suitable metrics and an agreed tolerance for each.

References

Start Learning With LSCS

Student wearing headphones studying online on a laptop at home
OUR COURSES

RELATED POSTS

ALL POSTS
Professional working through printed documents beside a laptop
Career Outlook

How to Become a GRC Analyst in the UK: Skills, Routes and Roadmap

November 11, 2026
Laptop on a desk beside an exam answer sheet and pencil
Career Outlook

Which Cyber Security Certifications Are Worth It in the UK?

November 11, 2026
Trainer leading a staff workshop at a flipchart in an office meeting room
Across Industry

Cyber Security Awareness Training for Employees: A UK Guide

November 11, 2026

Stay Ahead With LSCS

Get critical Cybersecurity updates, events invitations, and industry analysis. Our immersive, hands-on training is the most direct path to a high-growth cyber career.

Subscription Form

Leave a Comment

Your email address will not be published. Required fields are marked *

Scroll to Top