Adrian Johnson
TLDR:
- The UK government has released a new Code of Practice on cybersecurity governance, aimed at directors and senior business leaders.
- The code emphasizes the importance of cybersecurity as a key focus for businesses, on par with financial and legal risks.
- Areas highlighted in the code include risk management, cyber strategy, people, incident planning and response, and assurance and oversight.
The UK government has published a new Code of Practice on cybersecurity governance, targeting directors and other senior business leaders. The draft document aims to establish cybersecurity as a key focus for businesses, on par with financial and legal risks. The code highlights a number of areas business leaders should focus on to enhance their cybersecurity governance practices.
The code has been designed by the Department for Science, Innovation and Technology (DSIT) in partnership with industry directors, cyber and governance experts, and the UK’s National Cyber Security Centre (NCSC). The government is now inviting industry input into the draft document, with a call for views running until March 19, 2024.
The government emphasized that with digital technologies now underpinning business resilience, executive and non-executive directors must take a greater role in leading technology governance strategies. “Cyber-attacks are as damaging to organizations as financial and legal pitfalls, so it’s crucial that bosses and directors take a firm grip of their organization’s cybersecurity regimes – protecting their customers, workforce, business operations and our wider economy,” said Viscount Camrose, Minister for AI and Intellectual Property.
A draft code of practice on cybersecurity governance has been published by the UK government, aiming to make it a key business priority. Partnerships with relevant organizations resulted in the Ministry of Science, Innovation and Technology producing the document, which is open to consultation until 19 March. Key themes it addresses are risk management, cyber resilience strategy development, cyber awareness programmes, incident planning, and governance oversight.
The UK government has also released new statistics about its Cyber Essentials certification scheme. These statistics show that two-thirds of businesses adhering to the scheme have a formal incident response plan, compared to only 18% of businesses that do not follow the scheme.
Christian Borst, EMEA CTO at Vectra, said that the draft code highlights the need for businesses to urgently overhaul their approaches to cybersecurity, taking a more holistic approach. Sarah Pearce, Partner at law firm Hunton Andrews Kurth, welcomed the new code, particularly the guidance around having a regularly practiced incident response plan in place.
