Amanda Plc, a medium-sized UK-listed company is seeking to enhance its board- level oversight of cyber risk following the publication of the UK's new Cyber Governance Code of Practice. Nayan, a Compliance professional ha

The Cyber Governance Code of Practice is a guiding framework developed by the UK Government to help organisations integrate cybersecurity into their overall corporate governance. The Code has been created to support boards and directors in governing cybersecurity risks. Thus, Boards must not relegate cybersecurity risk to IT teams. The Code has identified five broad areas while managing cybersecurity risks: Risk Management: Under Risk Management, the board should ensure that the technology processes, information and services critical to the organisation have been "identified, prioritised and agreed," that cyber risks are integrated into the "enterprise risk management and internal controls," and that a defined "cyber risk appetite" is in place, that supplier information is "routinely" assessed and that risk assessments are conducted "regularly". Strategy: In Strategy, the Code mandates the board gain assurance that a "cyber strategy" is developed, aligned with broader business objectives, adheres to risk appetite of the organisation, and is effectively resourced and delivering intended outcomes. People: Regarding People, boards must promote "a cyber-security culture that encourages positive behaviours and accountability," supported by clear policies and regular training and awareness programs whose effectiveness is measured using suitable metrics. Incident Planning, Response and Recovery: For Incident Planning, Response & Recovery, the Code requires a tested "plan to respond to and recover from a cyber-incident," regularly exercised and iteratively improved through post-incident reviews, with clear regulatory and communication protocols in place. Assurance and Oversight: Finally, Assurance & Oversight demands that cyber governance be structurally embedded into the organisation's governance framework, with defined roles, regular (e.g., quarterly) reporting using agreed metrics, two-way dialogue with cyber executives, and integration of cyber considerations into existing audit and assurance mechanisms. By aligning actions precisely with all five principles of the Code, the Company elevates cyber risk to the board level, ensures comprehensive oversight, and embeds cyber resilience into its everyday governance culture.