Cyber security used to be filed under “IT”. Today, a single successful phishing email or ransomware attack can halt operations, expose customer data, trigger regulatory reporting obligations and damage relationships built over years. That makes cyber risk a strategic, board-level issue for companies of every size, not only large enterprises.
Directors do not need to become technical experts. They do need to understand the risks the business faces, set a clear appetite for those risks, ask the right questions and be confident that management has credible plans to prevent, detect and recover from incidents. This article explains what that looks like in practice for UK boards, drawing on the frameworks published by the National Cyber Security Centre (NCSC) and the obligations set by UK data protection law.
Key takeaways
- Cyber risk falls within directors’ existing duties, including the duty to exercise reasonable care, skill and diligence.
- The NCSC’s Cyber Security Toolkit for Boards and the Cyber Essentials scheme give boards a practical, UK-specific starting point.
- Under UK GDPR, notifiable personal data breaches must be reported to the ICO within 72 hours of becoming aware of them.
- Boards should agree a cyber risk appetite and receive regular, meaningful reporting rather than technical jargon.
- Basic controls such as multi-factor authentication, patching, backups and phishing awareness prevent a large share of common attacks.
- An incident response plan that has been rehearsed by the leadership team is one of the most valuable investments a board can make.
Why cyber security is a board responsibility
Under the Companies Act 2006, directors must promote the success of the company (section 172) and exercise reasonable care, skill and diligence (section 174). A board that ignores a foreseeable and material risk, such as a cyber attack that could stop the business trading, is unlikely to be meeting those standards. Cyber security is also tied to legal obligations under UK GDPR and the Data Protection Act 2018, contractual commitments to customers, and, in some sectors, specific regulatory requirements.
Cyber risk is also a business continuity risk. Many organisations now depend entirely on cloud platforms, payment systems and connected devices. When those systems fail, revenue stops. Boards that treat cyber purely as a technical matter tend to under-invest in the things that matter most in a crisis: decision-making, communication and recovery.
Accountability cannot be delegated away
Boards can and should delegate day-to-day security to management, whether a CTO, an IT manager or a managed service provider. But accountability for oversight remains with the board. The test is whether directors can show they understood the risk, set expectations, challenged management and monitored progress.
The UK frameworks every board should know
NCSC Cyber Security Toolkit for Boards
The National Cyber Security Centre publishes a Cyber Security Toolkit for Boards, designed to help board members understand cyber risk and govern it effectively. It covers embedding cyber into the organisation’s structure, growing expertise, developing a positive security culture, understanding threats, setting risk management approaches, planning for incidents and managing supply-chain risk. The government has also published a Cyber Governance Code of Practice, setting out the actions directors are expected to take. Both are written for non-specialists and are a sensible foundation for board discussion.
Cyber Essentials and Cyber Essentials Plus
Cyber Essentials is a government-backed certification scheme that covers five technical controls: firewalls, secure configuration, user access control, malware protection and security update management. Cyber Essentials Plus adds independent technical testing. Certification is required for some central government contracts and increasingly requested by larger customers. For many SMEs it is the most practical way to demonstrate a baseline level of protection, and the process itself often uncovers gaps.
UK GDPR and the ICO
Where a personal data breach is likely to result in a risk to people’s rights and freedoms, UK GDPR requires the controller to report it to the Information Commission (ICO) without undue delay and, where feasible, within 72 hours of becoming aware of it. Where the risk to individuals is high, the affected individuals must also be informed without undue delay. All personal data breaches should be recorded internally, whether reported or not. The 72-hour clock is short, which is why preparation matters.
Setting your cyber risk appetite
No organisation can eliminate cyber risk. The board’s job is to decide how much risk it is willing to accept in pursuit of its objectives, and to make sure spending and controls are aligned with that decision.
A practical cyber risk appetite statement might address:
- Critical services: which systems and processes must be restored first, and the maximum tolerable downtime for each.
- Data: the board’s tolerance for loss or exposure of different categories of data, from public information to special category personal data and commercially sensitive material.
- Third parties: the level of assurance required from suppliers that hold your data or connect to your systems.
- Innovation: how the business balances the adoption of new tools, including AI services, against security and data protection risks.
For example, a 40-person e-commerce company might decide it has very low tolerance for payment data exposure and for website downtime during peak trading, but a higher tolerance for short disruption to internal collaboration tools. That clarity helps management prioritise investment and gives the board a yardstick for reviewing performance. Cyber appetite should sit within the company’s wider risk management framework rather than as a separate exercise.
The fundamentals that stop most attacks
Most successful attacks against smaller organisations exploit basic weaknesses rather than sophisticated vulnerabilities. Boards should check that the fundamentals are in place before approving spending on advanced tools.
Phishing and social engineering
Phishing emails, fake invoices and impersonation of senior executives remain among the most common routes into an organisation. Regular, practical awareness training helps, but it should be combined with technical filtering and, importantly, with simple processes: for example, verifying any change to supplier bank details by phone using a known number. Staff should feel able to report a suspicious email, or admit to clicking one, without fear of blame. Fast reporting dramatically reduces the impact.
Multi-factor authentication
Multi-factor authentication (MFA) is one of the most effective controls available. It should be enabled on email, remote access, cloud platforms, finance systems and all administrator accounts as a minimum. Boards should ask whether there are any exceptions and why.
Patching, configuration and access
Unsupported software and unpatched systems are frequent entry points. Management should be able to confirm that security updates are applied promptly, that default settings are hardened, and that staff only have the access they need. Leavers’ accounts should be removed immediately.
Backups and recovery
Backups only help if they are separated from the main environment, protected from ransomware and regularly tested. “We have backups” is not the same as “we have restored from backup recently and know how long it takes”.
Tip: Ask management when a full restore from backup was last tested, how long it took and what went wrong. The answer will tell you more about your real resilience than any dashboard.
Questions boards should ask the CTO
Good oversight depends on good questions. The table below sets out questions directors can put to the CTO, IT lead or managed service provider, and what a reassuring answer looks like.
| Area | Question for the board to ask | What good looks like |
|---|---|---|
| Critical assets | What are our most important systems and data, and where are they held? | A current inventory of key systems, data and owners, including cloud services |
| Threats | What are the most likely attacks against a business like ours? | A clear, non-technical view of the main threats, linked to the risk register |
| Basic controls | Do we have MFA, patching and secure backups everywhere they matter? | Confirmed coverage, with exceptions listed and time-bound plans to close them |
| Certification | Do we hold Cyber Essentials or Cyber Essentials Plus, and when is renewal due? | Current certification or a dated plan to achieve it |
| People | How do we train staff and measure phishing resilience? | Regular training, simulated exercises and an easy route to report suspicious messages |
| Suppliers | Which suppliers could cause us a serious cyber incident? | A tiered supplier list with security assurances for critical providers |
| Detection | How quickly would we know if we had been breached? | Logging and monitoring in place, with clear alerting and escalation routes |
| Response | Who decides what, and when, if we suffer a major incident? | A documented and tested incident response plan with named roles |
| Investment | What are the top three improvements we should fund next year? | Prioritised proposals tied to risk reduction, not a shopping list of tools |
Managing supplier and third-party risk
Many incidents begin with a supplier: a compromised software provider, an IT support company with privileged access, or a cloud platform misconfiguration. Your security is only as strong as the weakest organisation with access to your systems or data.
- Tier your suppliers by the access and data they hold, and focus assurance effort on the critical few.
- Set contractual requirements for security controls, breach notification timescales, audit rights and data return or deletion on exit.
- Ask for evidence such as Cyber Essentials certification, recognised security certifications or completed security questionnaires.
- Review access regularly, particularly for managed service providers with administrator rights.
- Plan for supplier failure, including how you would operate if a critical platform were unavailable for several days.
The same discipline applies when you share sensitive information externally. During fundraising or M&A, for instance, a properly controlled virtual data room is far safer than email attachments or consumer file-sharing tools.
Strengthen your board’s cyber oversight
BoardroomUK helps boards build practical cyber governance, from risk appetite and board reporting to placing non-executive directors with technology and security experience.
Building and testing an incident response plan
When an incident happens, the first hours are critical and often chaotic. A clear, rehearsed plan allows the business to act quickly and consistently.
What the plan should cover
- Roles and authority: who leads the response, who can authorise decisions such as taking systems offline, and who deputises.
- Contacts: internal team, IT providers, legal advisers, insurers, forensic specialists and communications support, with out-of-hours details held offline.
- Assessment and containment: how incidents are triaged, contained and escalated to the board.
- Regulatory reporting: how the business will decide, within 72 hours, whether a personal data breach must be reported to the ICO, and whether individuals must be told.
- Communications: templates and approval routes for staff, customers, suppliers and, where relevant, media.
- Recovery: priorities for restoring services, aligned to the risk appetite.
- Lessons learned: a structured review once the incident is closed.
Rehearse it
A plan that sits in a folder is of limited value. Run a tabletop exercise at least annually with the executive team and, ideally, board members. The NCSC offers free resources to help organisations run exercises. Scenarios such as ransomware encrypting finance systems at month-end, or a supplier reporting that your customer data has been exposed, quickly reveal gaps in authority, contacts and communication.
Check your insurance
If you hold cyber insurance, make sure the plan reflects the policy’s requirements, such as notifying the insurer promptly or using approved incident response providers. Failing to follow policy conditions could affect cover.
Tip: Keep a printed or offline copy of the incident response plan and key contacts. If your systems are encrypted, you may not be able to open the plan stored on them.
Reporting cyber risk to the board
Board reporting on cyber should be concise and decision-focused. Avoid long lists of blocked attacks or technical metrics that do not translate into risk. Useful reporting typically includes:
- the status of the top cyber risks against appetite, and whether each is improving or deteriorating;
- coverage of key controls such as MFA, patching and tested backups;
- phishing exercise results and training completion;
- significant incidents and near misses, with lessons learned;
- supplier assurance status for critical providers;
- progress on the agreed improvement programme.
Cyber should appear on the board agenda at least twice a year, with a short update in every board pack. Using secure board meeting software also reduces the risk of sensitive board papers being circulated insecurely by email.
Building cyber capability on the board
Boards do not need a cyber specialist in every seat, but they do need enough collective understanding to challenge management effectively. Options include short training sessions for all directors based on the NCSC toolkit, periodic briefings from independent experts, and recruiting a non-executive director with technology or security experience. The aim is a board that can tell the difference between confident reassurance and genuine assurance.
Frequently asked questions
Are directors personally responsible for cyber security?
Directors are responsible for overseeing how the company manages its risks, including cyber risk, as part of their duties under the Companies Act 2006. Day-to-day security can be delegated, but the board must be able to show it understood the risk, set expectations and monitored management’s response.
When must we report a data breach to the ICO?
Under UK GDPR, a personal data breach must be reported to the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to individuals’ rights and freedoms. High-risk breaches must also be communicated to affected individuals.
Is Cyber Essentials enough?
Cyber Essentials provides a valuable baseline covering five core technical controls and is required for some government contracts. Many organisations will need further measures, such as monitoring, supplier assurance and incident response planning, depending on their risk profile.
How often should the board discuss cyber security?
A short update in each board pack and a deeper discussion at least twice a year is a practical rhythm for most SMEs, alongside an annual incident response exercise and review of the cyber risk appetite.
What is the NCSC Cyber Security Toolkit for Boards?
It is free guidance from the National Cyber Security Centre that helps board members understand and govern cyber risk. It is written for non-technical directors and covers culture, threats, risk management, incident planning and supply-chain security.
Last reviewed:
