The short answer
The Cyber Governance Code of Practice is voluntary guidance for boards and directors, published by the Department for Science, Innovation and Technology with the NCSC on 8 April 2025. It sets out 22 actions under five principles: risk management, strategy, people, incident planning, response and recovery, and assurance and oversight.
On this page
- What is the Cyber Governance Code of Practice?
- Is the Cyber Governance Code of Practice mandatory?
- What are the five principles and the director actions?
- How does the Code relate to the NCSC Cyber Security Toolkit for Boards?
- How can Cyber Essentials, ISO 27001, PCI DSS and testing evidence support board reporting?
- What should the board ask each quarter?
- How should a board start implementing the Code?
- Why Sovereign Secure?
- What should you do next?
The Cyber Governance Code of Practice is voluntary guidance that tells boards and directors which cyber security actions they personally own. It was published on 8 April 2025 by the Department for Science, Innovation and Technology (DSIT), developed with technical experts from the National Cyber Security Centre (NCSC) and governance experts from industry. It contains 22 actions grouped under five principles, and it is aimed at medium and large organisations in both the public and private sectors.
The Code is not a technical standard. It does not tell your IT team how to configure firewalls. It tells the board how to direct, resource and oversee cyber risk, and what assurance to ask for. The government pairs it with Cyber Essentials as the minimum an organisation should have in place: the Code for governance, Cyber Essentials for the basic technical controls.
What is the Cyber Governance Code of Practice?
It is the foundational code in DSIT’s set of cyber security codes of practice. Organisations that follow the more specialised codes, such as the Software Security Code of Practice or the AI Cyber Security Code of Practice (covered in our AI governance guide), should follow the governance code as well. The full text is on GOV.UK.
Two free resources support it: the NCSC’s Cyber Security Toolkit for Boards (see how the Code relates to the toolkit below) and Cyber Governance Training, which explains why and how boards should take each action. The Code is written for directors, not for the people who run security day to day, though security leaders can use it to show the board what is expected of it.
Is the Cyber Governance Code of Practice mandatory?
No. The Code is voluntary and creates no new legal obligations. It still matters for three reasons:
- Directors’ existing duties. Directors of UK companies already owe statutory duties, including the duty under section 174 of the Companies Act 2006 to exercise reasonable care, skill and diligence. The Code gives boards a reference point for what reasonable attention to cyber risk looks like.
- Internal controls declarations. Companies reporting against the UK Corporate Governance Code 2024 face Provision 29 for financial years beginning on or after 1 January 2026, which asks the board for a declaration on the effectiveness of its material internal controls. For many businesses, cyber controls are part of that picture.
- Customer and insurer scrutiny. Large customers, insurers and investors increasingly ask how cyber risk is governed. A board that can show it follows the Code has a clear answer.
What are the five principles and the director actions?
The Code has five principles, A to E, with between four and five actions under each, 22 in total. The summary below paraphrases each action.
| Principle | What directors should do |
|---|---|
| A. Risk management (5 actions) | Make sure the technology, information and services critical to the organisation are identified and prioritised; agree senior ownership of cyber risk and build it into enterprise risk management; define the cyber risk appetite; make sure supplier risk is assessed in proportion; make sure risk assessments are regular and reflect change |
| B. Strategy (4 actions) | Make sure a cyber strategy exists and is embedded in the wider business strategy; check it matches the risk appetite and regulatory obligations; allocate resources to it; monitor whether it is being delivered |
| C. People (4 actions) | Promote a positive cyber security culture; make sure clear policies support it; improve your own cyber literacy; use metrics to check that training and awareness work |
| D. Incident planning, response and recovery (4 actions) | Make sure a response and recovery plan exists for business-critical services; make sure it is exercised at least once a year with internal and external stakeholders; take responsibility for regulatory reporting and critical decisions during an incident; make sure lessons from incidents feed back into plans |
| E. Assurance and oversight (5 actions) | Set up a cyber governance structure with executive and non-executive ownership; require formal reporting at least quarterly with metrics and tolerances; hold regular two-way dialogue with the chief information security officer or equivalent; integrate cyber into internal and external audit; make sure senior executives know the relevant regulations and codes |
Two actions set a fixed rhythm that most boards can adopt immediately: formal cyber reporting at least quarterly (principle E) and an incident response exercise at least once a year (principle D). A cyber tabletop exercise is the usual way to meet the second, and our incident response plan template and business continuity plan template give you the plans the exercise tests.
How does the Code relate to the NCSC Cyber Security Toolkit for Boards?
The Code says what directors should do; the toolkit explains how. The NCSC’s Cyber Security Toolkit for Boards is the resource the NCSC publishes to help boards implement the Code’s actions, and it is organised around the same principles, so each principle has its own section with background and practical guidance. Free downloads include the complete toolkit as a PDF, an executive summary, a list of questions for the board to ask (with possible answers) and a short “Cyber security 101” script for board members.
Use the two together. Take the 22 actions in the Code as the checklist the board signs up to, and turn to the matching toolkit section when you need to understand an action or decide what good evidence looks like. Neither creates a legal duty, and neither replaces the technical frameworks your security team works to.
How can Cyber Essentials, ISO 27001, PCI DSS and testing evidence support board reporting?
The Code asks directors to obtain assurance, not to do technical work. Independent certifications, assessments and test reports are the most reliable assurance a board can get, because someone outside the organisation has checked the evidence. Each source answers a different question, and each has limits the board should understand.
| Evidence | What it tells the board | Principles | Limits to keep in mind |
|---|---|---|---|
| Cyber Essentials and Cyber Essentials Plus | Five technical controls are in place across the certified scope; CE+ adds hands-on testing | A, E | Covers common internet-based attacks only, within the stated scope |
| ISO 27001 certification | A risk-based management system is operating, with internal audit, management review and independent certification audits | A, B, C, E | Scope-dependent; shows the system works, not that every control is strong |
| PCI DSS assessment (ROC and AOC, or SAQ) | Controls protecting payment card data meet PCI DSS v4.0.1 | A, E | Limited to the cardholder data environment; an SAQ is a self-assessment unless a QSA has reviewed it |
| Penetration test reports | How far an attacker could get today, and whether earlier findings were fixed | A, D, E | A snapshot of the systems tested, on the dates tested |
| Vulnerability scanning trends | Whether known weaknesses are being found and fixed on time | A, E | Finds known issues; does not show how they could be chained together |
| Incident exercise reports | Whether the response plan works and who decides what | D | Only as good as the scenario chosen |
Ask for the scope statement with every certificate and report. A board that knows what was not tested is better placed than one that only sees a pass.
DSIT has also published official mappings of the Code to other frameworks, including ISO/IEC 27001:2022 and the NCSC Cyber Assessment Framework, so a board that already reports against one of them can reuse that structure.
What should the board ask each quarter?
Because principle E asks for formal reporting at least quarterly, many boards turn the Code into a standing agenda item. The questions below follow the five principles, so the answers show the board which of the 22 actions are slipping. For questions organised around technical controls rather than governance, see our NCSC 10 Steps to Cyber Security guide.
| Principle | Questions for the quarterly report |
|---|---|
| A. Risk management | Which business-critical services and data would hurt most if lost, and has that list changed? Are we inside our agreed cyber risk appetite, and if not, what is the plan and by when? Which suppliers could disrupt critical services, and when were they last assessed? |
| B. Strategy | Is the cyber strategy on track, and is it resourced to deliver this year’s priorities? |
| C. People | What do our training and phishing metrics show, and what changed as a result? |
| D. Incident planning, response and recovery | When was the incident response plan last exercised, and what did we change afterwards? Do we know our reporting obligations in an incident, and who on the board signs them off? |
| E. Assurance and oversight | Who are the named executive and non-executive owners of cyber risk? What did the latest penetration test, vulnerability scans and audits find, and how many findings are overdue? Are our certifications current, and do their scopes still match the business? Has internal audit covered cyber this year? Has anything changed in regulation, contracts or insurance that affects our obligations? |
How should a board start implementing the Code?
Start small and make it routine. A workable sequence is:
- Read the Code and the NCSC board toolkit together as a board.
- Agree executive and non-executive ownership of cyber risk.
- Rate the board against each of the 22 actions as in place, partly in place or not in place.
- Agree a cyber risk appetite and the metrics that will show whether you are within it.
- Book the annual incident exercise and set the quarterly reporting format.
- Build an assurance calendar covering certification renewals, audits and testing.
- Review progress against the 22 actions once a year.
The Code sits above the technical work, so pair it with a technical framework for the practices your team should run, such as Cyber Essentials for the basics or the CIS Controls for a fuller roadmap. For an independent view of where you stand, a cyber security audit gives the board a baseline to measure against. If the organisation has no senior security lead to report to the board, our guide to the virtual CISO (vCISO) explains how a part-time security leader can fill that gap.
Why Sovereign Secure?
Sovereign Secure Ltd has been a UK company since 2012 (Companies House 08334453), headquartered in Accrington, Lancashire, with offices in Los Angeles, Singapore, Dubai and Dhaka. We are an IASME-licensed Cyber Essentials certification body, ISO 27001 certified, a PCI SSC-approved QSA, QPA and CPSA company, and a member of the PCI SSC Global Executive Assessor Roundtable for 2026 to 2028.
That means much of the evidence in the table above comes from one team: Cyber Essentials and CE+ certification, ISO 27001 consultancy (with certification audits by our partner certification body, MQA International), PCI DSS assessments, penetration testing and vulnerability scanning. Our cyber security consultancy page shows how these fit together.
What should you do next?
Put the 22 actions on your next board agenda and identify the evidence you already hold. If there are gaps in assurance, tell us what your board needs to see and we will recommend the certification, assessment or test that provides it. Use the enquiry form on this page or call +44 161 523 5276.
Your next step
- ISO 27001 checklistClause-by-clause readiness and a Stage 1 and Stage 2 audit checklist, free in Excel.Get the checklist
- Statement of Applicability templateAll 93 Annex A controls in a free spreadsheet, with a worked example.Get the SoA template
- Get an ISO quoteConsultancy from an ISO 27001-certified firm, with audits through our partner certification body, MQA International.Get an ISO quote
Last reviewed October 2026 by the Sovereign Secure assessment team.
