Cyber risk used to be delegated to IT. Today it sits squarely with the board.
In April 2025 the UK government and the National Cyber Security Centre published the Cyber Governance Code of Practice, setting out what boards and directors should do to govern cyber risk. It is voluntary for now, but it is quickly becoming the benchmark. Meanwhile the Cyber Security and Resilience Bill is making its way through Parliament, bringing managed service providers and data centres into scope and tightening incident reporting.
Directors do not need to be technical experts. They need to ask the right questions, and expect clear answers.
1. Do we know what really matters, and where it sits?
Every organisation has a handful of systems, data sets and services it cannot operate without. The board should know what they are, who owns them and how they are protected. If the answer takes a week to assemble, visibility is the first problem to solve.
2. Who is accountable, and when did we last rehearse a serious incident?
A plan that has never been tested is a hope, not a plan. Ask when the leadership team last walked through a realistic scenario, such as a ransomware attack or a major supplier outage, and what changed as a result.
3. Could we report a serious incident within 24 hours?
Under the Bill, in-scope organisations will need to send an initial notification of a significant incident within 24 hours and a fuller report within 72. Financial services firms already face similar expectations. The real test is whether you could establish what happened, and what was affected, that quickly.
4. How exposed are we through our suppliers?
Attackers increasingly come in through the supply chain. The Bill reflects this by allowing regulators to designate critical suppliers. Boards should know which suppliers have access to their systems and data, what assurance they hold, and how many separate providers they rely on. Every additional supplier is another door to secure.
5. Can we see our whole estate in one place?
Most breaches exploit gaps between systems, teams and suppliers. If security tools, networks, cloud platforms and communications each report separately, nobody sees the full picture. A single, joined-up view is the foundation for every other answer on this list.
From questions to confidence
The Code’s five principles, risk management, strategy, people, incident planning and response, and assurance, all depend on the same thing: clear, timely information the board can trust.
At Citycom, security is designed into every layer we manage, not added afterwards. We are certified to ISO/IEC 27001:2022 and Cyber Essentials Plus, and Ark Intelligence brings Cloud, Infrastructure, Security, Communications and AI into one real-time view, so risks are found before they reach you.
Data you can see. Results you can control.
If cyber resilience is on your board’s agenda, let’s talk. Start a conversation at citycom.co.uk or call 0330 912 1212.
