The UK government has released a new Code of Practice on cybersecurity governance, aimed at directors and other senior business leaders. The draft document seeks to elevate cybersecurity to the same level of importance as financial and legal risks within businesses.
The code outlines several areas that business leaders should focus on to enhance their cybersecurity governance practices. These include risk management, cyber strategy, fostering a positive cybersecurity culture among employees, incident planning and response, and establishing clear roles and responsibilities for cyber resilience at the executive level.
The Department for Science, Innovation and Technology (DSIT) collaborated with industry directors, cyber and governance experts, and the UK’s National Cyber Security Centre (NCSC) to develop the code.
The government is now seeking industry input on the draft document through a call for views, which will run until March 19, 2024.
The government emphasized the need for executive and non-executive directors to take a more active role in leading technology governance strategies, as digital technologies increasingly underpin business resilience. Viscount Camrose, Minister for AI and Intellectual Property, stressed the importance of bosses and directors taking charge of their organization’s cybersecurity regimes to protect customers, workforce, and business operations.
In the US, new rules from the Securities and Exchange Commission (SEC) require publicly-listed companies to disclose the board of directors’ oversight of cyber threat risks.
Industry experts have welcomed the draft code, highlighting the urgency for businesses to overhaul their cybersecurity approaches. They emphasize the need for a more holistic approach to cybersecurity, focusing on improving cyber resilience.
The UK government also shared statistics related to its Cyber Essentials certification scheme, revealing that two-thirds of businesses adhering to the scheme have a formal incident response plan, compared to only 18% of those who don’t. This highlights the importance of preparation in mitigating harm and reducing the impact of cyber incidents on businesses and their operations.
Overall, the new Code of Practice aims to empower business leaders to navigate potential cyber threats and take advantage of emerging technologies securely.