Cyber risk is a business risk, and boards are accountable for it. The UK Government's Cyber Governance Code of Practice, published in 2025 with the National Cyber Security Centre, sets out what boards and directors are expected to do. I help boards understand those expectations and put them into practice.
How I can help
- Board cyber governance review against the Code's five principles: risk management, strategy, people, incident planning and response, and assurance and oversight.
- Cyber risk appetite and reporting: agreeing what level of risk is acceptable and what the board needs to see to oversee it.
- Incident readiness: board-level exercises so directors know their role before a real incident happens.
- Translating the technical: helping the board and the security team understand each other.
Who this is for
Boards who know cyber matters but are not sure whether they are asking the right questions, or who need to show customers, investors or regulators that cyber risk is properly governed.