Cyber Governance Code of Practice Compliance Check

Why this matters

In April 2025 the Department for Science, Innovation and Technology published the Cyber Governance Code of Practice, developed with the National Cyber Security Centre, setting out what boards and directors — not just IT teams — are expected to do to manage cyber risk. Unlike earlier technical guidance aimed at security staff, the Code is written for company leadership and covers five areas: risk management, cyber strategy, people and culture, incident planning, and assurance. It reflects a shift in expectation that cyber security is a business governance issue, similar to financial or health and safety oversight, and directors are expected to be able to demonstrate active involvement rather than delegating it entirely.

While the Code is not yet a standalone legal duty for most companies, it is already shaping expectations elsewhere: directors’ general duties under the Companies Act 2006 to promote the success of the company and exercise reasonable care, skill and diligence can be read to include oversight of material cyber risk, and insurers, lenders, and larger customers are increasingly asking about board-level cyber governance during due diligence and contract renewal. Businesses that can point to a documented cyber risk register reviewed by the board, a named lead for cyber matters, and a tested incident response plan are markedly better placed both to reduce their actual risk and to answer these questions when they’re asked.

What you'll need

• Awareness of who at board or senior leadership level currently owns cyber risk oversight
• Whether a cyber risk register or equivalent exists and is reviewed by leadership
• Details of any incident response plan and when it was last tested
• Any recent customer, lender, or insurer questions about your cyber governance arrangements

What you'll get

A personalised compliance report covering: a score out of 100, an executive summary, a list of findings ranked by severity, and a prioritised action plan with timeframes.