In 2025 the UK Government, working with the National Cyber Security Centre, published the Cyber Governance Code of Practice. It is aimed at boards and directors, not technical teams, and sets out the actions directors should take to govern cyber risk.
It is voluntary, but it is fast becoming the reference point for what "good" looks like. Here are its five principles in plain English.
A. Risk management
The board should make sure cyber risk is identified, assessed and managed like any other business risk, with clear ownership and a defined risk appetite.
B. Strategy
Cyber resilience should be part of the organisation's strategy, with the right resources and investment behind it.
C. People
The board should promote a culture where cyber security is everyone's responsibility, and make sure directors themselves have enough knowledge to govern it.
D. Incident planning, response and recovery
There should be a plan for responding to and recovering from a serious incident, and it should be tested, including the board's own role.
E. Assurance and oversight
The board should receive regular, meaningful reporting and independent assurance that cyber risk is being managed as intended.
Where to start
A simple first step is to take each principle and ask: could we show that we are doing this today? The gaps that emerge make a practical action plan for the board.