What is a board cyber governance assessment and why does my organisation need one?

It is the standard for board-level cyber governance published by the Department for Science, Innovation and Technology with the National Cyber Security Centre in April 2025. It sets out 22 actions across five principles (risk management, strategy, people, incident planning, and assurance and oversight) that directors are expected to own.

Is the Cyber Governance Code mandatory?

The Code itself is voluntary, but it is the benchmark regulators, insurers and acquirers increasingly hold boards to, and the Cyber Security and Resilience Bill — introduced to Parliament in November 2025 and now in committee — raises the cost of ignoring it materially. Treating it as optional is a board decision with consequences.

How does this relate to the NCSC Board Toolkit?

The NCSC Cyber Security Board Toolkit is the National Cyber Security Centre’s guidance for boards on governing cyber risk. The Code of Practice turns that guidance into 22 specific actions a board is expected to own. This assessment scores you against those 22 actions, so it works as a practical companion to the Board Toolkit: the Toolkit tells you what good governance looks like, this tells you where yours actually stands and what to fix first.

What is cyber security governance?

Cyber security governance is how the board directs and oversees cyber risk: who is accountable, how risk decisions are made, what the board sees and challenges, and how it gains assurance that controls work. It is distinct from the technical controls themselves. This assessment measures the governance, not the firewall, which is why it needs no technical knowledge to complete.