Government responds to Call for Views on Cyber Governance
Background
On 31 January, the government published its response to the call for views on the Cyber Governance Code of Practice. This Code was developed in partnership between the Department for Science Innovation and Technology (DSIT) and the National Cyber Security Centre (NCSC).
The primary goal of the Cyber Governance Code of Practice is to establish clear accountability for cyber governance within businesses. It aims to support Directors and Board members to understand the measures they should be taking to minimise the impact of cyber threats. Designed in language familiar to Boards and Directors, the Code outlines clear, actionable steps businesses should follow to enhance their cyber resilience.
The government is exploring how the Code can assist regulators in ensuring regulatory compliance.
Key themes from the consultation response
-
There was overall support for the Code’s design, with all principles receiving at least 94% approval from respondents. Some suggested adding a technical measures principle and including background information to help Boards and Directors implement it. Others recommended incorporating principles covering supply chains and third parties.
Government Response: Government do not plan on making major changes to the Code’s design before its launch, nor will it add specific technical measures, given the broad target audience. Instead, DSIT will: work with NCSC and industry partners to provide guidance on technical measures, make minor wording adjustments for greater clarity and assess the Code’s uptake post-launch and update it as necessary.
- The government found conflicting views on establishing an assurance scheme. Some respondents saw benefit in adopting assurance measures, while others, raised concerns about an over-reliance on such schemes. There was no clear consensus on whether an assurance scheme should be government-led or delivered by private firms. However, there was strong interest in an external review process, such as a self-assessment and independent audit.
Government response: The government acknowledged the challenge in developing an effective assurance scheme and made the decision to not introduce one at the initial launch of the Code. They will continue to explore this option to ensure it does not impose an undue burden on businesses.
- Respondents raised concerns about how the Code will apply to businesses of different sizes. The main concerns raised focused on the document being viewed as technical guidance rather than governance focused and that small to medium-sized enterprises (SMEs) might struggle with compliance costs, particularly if external assurance is required.
Government response: When the Code is launched, the government will clarify that it is primarily intended for medium to large businesses. However, small businesses may still wish to adopt the Code depending on their cyber maturity and risk levels.
- There was a general consensus that more information on how the Code aligns with existing government policies, industry standards and international frameworks is required. Many respondents emphasised the need for a joined-up approach with clear guidance and resources.
Government response: When the Code is published, government will provide additional context on how it aligns to international and industry standards and guidance. The Code will also be mapped to the NCSC Board Toolkit.
- Respondents highlighted the importance of engaging with a broad range of stakeholders to promote adoption. These key stakeholders include CISOs, auditors, insurers, regulators, and risk/audit committees.
Government response: Government agreed and will work closely with a wide range of stakeholders throughout the Code’s implementation. This includes, professional, trade and industry bodies and board networks. They will also engage cyber security professionals to test the Code’s design and impact.
- A minority of respondents called for cyber governance legislation, some also suggested that the Code be incorporated into new cyber and technology regulations.
Government response: The Code will initially be published as a voluntary tool. However, the government will assess its effectiveness and may consider introducing legislation in the future, including its potential impact on public procurement requirements.
Next steps
The Cyber Governance Code of Practice will be published in early 2025. DSIT and NCSC will work together to develop supportive material which will help to promote its uptake. DSIT will work with industry partners to develop a public pledge and monitor its uptake over time.
Jill Broom
Jill Broom
Jill leads the techUK Cyber Security programme, having originally joined techUK in October 2020 as a Programme Manager for the Cyber and Central Government programmes. She is responsible for managing techUK's work across the cyber security ecosystem, bringing industry together with key stakeholders across the public and private sectors. Jill also provides the industry secretariat for the Cyber Growth Partnership, the industry and government conduit for supporting the growth of the sector. A key focus of her work is to strengthen the public–private partnership across cyber to support further development of UK cyber security and resilience policy.
Before joining techUK, Jill worked as a Senior Caseworker for an MP, advocating for local communities, businesses and individuals, so she is particularly committed to techUK’s vision of harnessing the power of technology to improve people’s lives. Jill is also an experienced editorial professional and has delivered copyediting and writing services for public-body and SME clients as well as publishers.
- Email:
- [email protected]
- Website:
- www.techuk.org/
- LinkedIn:
- https://www.linkedin.com/in/jill-broom-19aa824
Annie Collings
Annie Collings
Annie is the Programme Manager for Cyber Resilience at techUK. She first joined as the Programme Manager for Cyber Security and Central Government in September 2023.
In her role, Annie supports the Cyber Security SME Forum, engaging regularly with key government and industry stakeholders to advance the growth and development of SMEs in the cyber sector. Annie also coordinates events, engages with policy makers and represents techUK at a number of cyber security events.
Before joining techUK, Annie was an Account Manager at a specialist healthcare agency, where she provided public affairs support to a wide range of medical technology clients. She also gained experience as an intern in both an MP’s constituency office and with the Association of Independent Professionals and the Self-Employed. Annie holds a degree in International Relations from Nottingham Trent University.
- Email:
- [email protected]
- Twitter:
- anniecollings24
- LinkedIn:
- https://www.linkedin.com/in/annie-collings-270150158/
Tracy Modha
Tracy Modha
Tracy supports several areas at techUK, including Cyber Exchange, Cyber Security, Defence, Health and Social Care, Local Public Services, Nations and Regions and National Security.
Tracy joined techUK in March 2022, having worked in the education sector for 19 years, covering administration, research project support, IT support and event/training support. My most outstanding achievement has been running three very successful international conferences and over 300 training courses booked all over the globe!
Tracy has a great interest in tech. Gaming and computing have been a big part of her life, and now electric cars are an exciting look at the future. She has warmed to Alexa, even though it can sometimes be sassy!
- Email:
- [email protected]
- Phone:
- 02073312000
- Twitter:
- @TracyModha,@TracyModha
- Website:
- www.techuk.org,www.techuk.org
- LinkedIn:
- https://www.linkedin.com/in/tracymodha83,https://www.linkedin.com/in/tracymodha83