In short: The Cyber Governance Code of Practice is UK government guidance, published by DSIT with the NCSC on 8 April 2025, setting out what boards and directors of medium and large organisations should do to govern cyber risk. It has five principles: risk management; strategy; people; incident planning, response and recovery; and assurance and oversight.
What the Code is
The Department for Science, Innovation and Technology (DSIT) published the Code with the NCSC on 8 April 2025, following a call for views that ran from January to March 2024. It is meant to be the first point of reference for board members on cyber risk, and government is monitoring uptake through an evaluation survey.
Key points:
- Audience: boards and directors of public and private organisations, primarily medium and large ones. It is not written for the people who run security day to day.
- Smaller organisations are not the main target, but the Code says they should still apply its principles, alongside NCSC guidance written for them.
- Status: it is guidance set out by government, not legislation, and it does not lead to a certificate.
- Format: five principles, each with a short list of actions for the board.
You can read the Code, a one-page summary and documents mapping it to other standards, including the NCSC Cyber Assessment Framework, on gov.uk.
The five principles
| Principle | What the board is expected to do (paraphrased) |
|---|---|
| A. Risk management | Know which technology, information and services are critical; give a senior person ownership of cyber risk within enterprise risk management; set a risk appetite; assess suppliers in proportion to risk; reassess as things change |
| B. Strategy | Make sure there is a cyber strategy that fits the organisation's wider strategy, risk appetite and legal duties, that it is properly resourced and that it is delivering |
| C. People | Build a security culture with clear policies and accountability, improve directors' own cyber literacy, and check that training and awareness actually work |
| D. Incident planning, response and recovery | Keep a plan for responding to and recovering from incidents that affect critical services, exercise it at least once a year with internal and external parties, own reporting obligations and learn from incidents |
| E. Assurance and oversight | Set up a governance structure with clear executive and non-executive roles, get formal reporting at least quarterly against agreed measures, keep an open dialogue with senior executives including the CISO or equivalent, integrate cyber into internal and external audit, and confirm executives know their regulatory obligations |
Support for directors
Government and the NCSC provide free material to help boards act on the Code:
- NCSC Cyber Governance Training for board members and directors.
- NCSC Cyber Security Toolkit for Boards, which helps put the Code's actions into practice.
- Standards mapping documents showing how the Code lines up with other frameworks.
- A one-page summary for board packs.
Directors who want a structured awareness session for the wider leadership team can also look at cyber security training for board members on our sister site.
Where Cyber Essentials gives the board assurance
The Code is about governance; it does not tell you which technical controls to deploy. That is where Cyber Essentials comes in. The government presents the Code and Cyber Essentials together as the minimum foundation for managing cyber risk: one covers how the board governs, the other covers whether the basic technical defences are actually in place.
In practice Cyber Essentials helps a board meet several actions in the Code:
- Assurance and oversight (E). A current Cyber Essentials or Cyber Essentials Plus certificate is independent evidence the board can track, and its 12-month expiry gives a natural reporting point. Under the Danzell question set, the board-level declaration also commits the organisation to staying compliant throughout the certificate period.
- Risk management (A). Requiring suppliers to hold Cyber Essentials is a proportionate way to manage supply chain risk; see how to check a Cyber Essentials certificate.
- People (C). Cyber Essentials does not cover training, so pair it with security awareness training.
- Incident readiness (D). The NCSC highly recommends backups but they are not a Cyber Essentials technical requirement, and Cyber Essentials does not test response plans; the Code expects boards to make sure the plan is exercised at least once a year.
Boards wanting a governance standard that is certified can look at IASME Cyber Assurance or ISO 27001.
Questions directors can ask today
- Which of our services and data would hurt us most if they were lost or exposed, and who owns that risk?
- Do we hold a current Cyber Essentials or Cyber Essentials Plus certificate, and does its scope cover the whole organisation?
- Is MFA switched on for every cloud service and administrator account?
- How quickly do we install critical security updates, and what devices are no longer supported?
- When did we last exercise our incident response plan, and with whom?
- What do we require of our key suppliers, and how do we check it?
How we help
Forever Systems helps boards turn the Code's technical expectations into evidence: a gap analysis against the Cyber Essentials controls, remediation of the gaps, and support through certification with an IASME-licensed Certification Body. We can also help you define the metrics your board reports on each quarter. Contact us to arrange a conversation.
How Forever Systems helps you get certified
Most organisations fail Cyber Essentials for the same handful of reasons: unsupported operating systems left in scope, missing multi-factor authentication on cloud services, default passwords on routers and firewalls, and security updates that sit for longer than the 14 days the scheme allows. We find those gaps before an assessor does, then help you fix them.
- Readiness review and gap analysis of your devices, cloud services, firewalls and user accounts against the current question set
- Remediation: patching, configuration hardening, MFA roll-out, firewall changes and device management with tools such as Microsoft Intune
- Support through assessment with an IASME-licensed certification body, for both Cyber Essentials and Cyber Essentials Plus
- Supply chain and sector requirements: help when a customer, a public-sector contract or a framework asks for certification as a condition of working with them
- Staying compliant all year, so renewal is a formality rather than a scramble
Forever Systems Ltd is an IT and cyber security provider. We prepare you for certification and work alongside a licensed certification body, which carries out the assessment and issues the certificate.
Want to know how close you are to passing Cyber Essentials?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is the Cyber Governance Code of Practice mandatory?
No. It is government guidance for boards and directors, not legislation, and there is no certificate. Government expects boards of medium and large organisations to use it as their first point of reference for cyber risk.
When was the Cyber Governance Code of Practice published?
DSIT published it with the NCSC on 8 April 2025.
What are the five principles of the Cyber Governance Code of Practice?
Risk management; strategy; people; incident planning, response and recovery; and assurance and oversight.
Does the Code require Cyber Essentials?
The Code does not make certification compulsory. Government presents the Code and Cyber Essentials together as the minimum foundation, with the Code covering governance and Cyber Essentials covering the basic technical controls.
Does the Code apply to small businesses?
It is aimed mainly at medium and large organisations, but small organisations are encouraged to apply its principles alongside NCSC guidance for small businesses.