Cyber Governance Code of Practice Compliance Check

In April 2025 the Department for Science, Innovation and Technology published the Cyber Governance Code of Practice, developed with the National Cyber Security Centre, setting out what boards and directors — not just IT teams — are expected to do to manage cyber risk. Unlike earlier technical guidance aimed at security staff, the Code is written for company leadership and covers five areas: risk management, cyber strategy, people and culture, incident planning, and assurance. It reflects a shift in expectation that cyber security is a business governance issue, similar to financial or health and safety oversight, and directors are expected to be able to demonstrate active involvement rather than delegating it entirely.

While the Code is not yet a standalone legal duty for most companies, it is already shaping expectations elsewhere: directors’ general duties under the Companies Act 2006 to promote the success of the company and exercise reasonable care, skill and diligence can be read to include oversight of material cyber risk, and insurers, lenders, and larger customers are increasingly asking about board-level cyber governance during due diligence and contract renewal. Businesses that can point to a documented cyber risk register reviewed by the board, a named lead for cyber matters, and a tested incident response plan are markedly better placed both to reduce their actual risk and to answer these questions when they’re asked.

This check reviews your business’s alignment with the UK’s Cyber Governance Code of Practice — covering board-level risk oversight, strategy, staff culture, incident planning, and assurance.