The Department for Science, Innovation and Technology, with the NCSC, has published the Cyber Governance Code of Practice, setting out the actions boards and directors should take to govern cyber risk.
The Code is organised around five principles:
- Risk management
- Strategy
- People
- Incident planning, response and recovery
- Assurance and oversight
The Code is voluntary, but it gives a clear benchmark for what “reasonable care, skill and diligence” looks like for directors under section 174 of the Companies Act 2006 when it comes to cyber risk. It is supported by board training and a toolkit.
Leadership and commitment are already at the heart of ISO/IEC 27001, so the Code fits naturally with an existing ISMS governance structure.
Source: Cyber Governance Code of Practice (GOV.UK)
This update is general information, not legal advice. If you would like help assessing the impact on your information security or privacy programme, contact us.
