Governing cyber risk: Analysing the Government’s proposed Cyber Governance Code of Practice

Effective cyber security risk governance is essential to organisations’ business resilience and competitiveness. To address this the Government has published a proposed Cyber Governance Code of Practice (the Code), with a consultation period that has just ended. The Code formalises its expectations of boards of directors, of organisations of all sizes, in governing cyber risk, treating it with the same level of importance as any other significant or material business risk.

The proposed Code is intended to be voluntary when implemented – but with cyber risks a significant threat to any organisation with a digital presence, all businesses should consider implementing it. Here we look at its importance, key recommendations, and implications for organisations in the future.

Limited board oversight a concern in managing cyber risks

Today, organisations face a higher risk than ever before of being disrupted by both malicious and unintentional cyber security incidents. As the number of cyber threats continues to increase, it's crucial that organisations prioritise risk management strategies to safeguard their assets. The Government’s Cyber security breaches survey 2024 reports that around 74% of large businesses have experienced cyber security breaches or attacks within the past year.

The survey also revealed that while board engagement and corporate governance approaches towards cyber security tend to be more sophisticated in larger organisations, only 30% of all businesses have board members explicitly responsible for cyber security as part of their job role (63% in large businesses). Lack of knowledge, training and time remained key issues that prevent boards from engaging more in cyber security. The report also highlighted a contrast between more structured board engagement in larger organisations and more informal approaches in smaller organisations, where responsibility is often delegated to third-party providers.

Given the inherent link between business resilience and cyber security risks, the proposed Code emphasises the need for accountability and governance among the board of directors. The mounting cyber risk is no longer just a technology issue, but a critical vulnerability that directly affects the overall health of the organisation.

To effectively govern cyber risk, the new Code recommends a top-down approach. Board members need to take ownership of cyber risk, comprehend the threats that the organisation faces and evaluate the actions taken to manage them. Cyber resilience should be integrated into the organisation's strategy and all relevant business processes, with clearly defined responsibilities for managing cyber resilience across all relevant business domains to prevent silos.

Five principles of the Code – and actions for directors

The Code recommends five overarching principles for managing cyber risks, each with a set of easily understandable actions designed for directors.

1 Risk management

Key steps here include identifying and prioritising digital assets, conducting regular risk assessments, and developing strategies that account for changes in the environment. Cyber security risks should be addressed as part of enterprise risk management with ownership at the board level. Moreover, you should regularly assess suppliers' control environments and ensure they're prepared to withstand cyber threats associated with them.

2 Cyber strategy

Monitor and review the delivery of the cyber resilience strategy in line with the business strategy and the ever-changing risk environment. Allocate resources and investment efficiently to build capabilities that effectively manage cyber security threats and their associated risks.

3 People

Establish cyber security policies that promote a positive security culture, ensuring that the culture aligns with the cyber resilience strategy. Sponsor communications on the importance of cyber resilience to the business. Ensure that the organisation has an effective cyber security training programme, including education and awareness, with metrics in place to measure its effectiveness.

4 Incident planning and response

Your organisation needs a plan to respond to and recover from a cyber incident. This needs to be regularly tested with associated training involving relevant internal and external stakeholders. If an incident occurs, take responsibility for regulatory obligations, support external communication and have a post-incident process in place to incorporate lessons learned into future response and recovery plans.

5 Assurance and oversight

Establish a governance structure with ownership of cyber resilience at executive and non-executive director levels. Regular monitoring of the cyber resilience strategy is needed. Also, communicate regularly with relevant senior management including, but not limited to, the CISO or relevant risk owner. Determine how to achieve assurance and integrate the cyber resilience strategy with existing assurance mechanisms. To read more about this, please refer to Technology resilience is now a priority for internal audit.