CyberCQR Good Practice Guide · Governance

Measuring and reporting cyber risk to the board: a good practice guide

How a UK firm of up to 2,000 people can give its board cyber reporting it can govern from: coverage first, a written risk appetite, indicators with tolerances, a record of accepted risks, and one page every quarter.

CyberCQR Good Practice Guide · Version 1.0 · Reading time about 16 minutes

Summary

The government's Cyber Governance Code of Practice asks boards to define their cyber risk appetite and to require formal reporting at least quarterly, with suitable metrics and agreed tolerances [1]. This guide shows how to do that in a firm without a large security team. It rests on one principle: if you cannot detect it, you cannot protect it. So the report starts with how much of the estate the firm can see.

How to use this guide. Section 1 summarises what the Code asks. Sections 2 to 6 build the parts of the report: coverage, appetite, indicators, the register and accepted risks. Section 7 puts them on one page. Section 8 sets out the yearly cycle, section 9 adds points for FCA-regulated firms, and section 10 is a checklist. The argument is in our briefing All green, still exposed, and the short version in our Top 10 Actions.

1. What the Code asks of boards

The Code was published by the Department for Science, Innovation and Technology and the National Cyber Security Centre (NCSC) in April 2025, for boards of medium and large organisations [1]. A year later, only 32% of medium-sized businesses and 51% of large businesses were aware of it [4]. Its actions on risk and oversight, in plain words:

Action	What the board should do	Where this guide covers it
A1	Be assured that critical technology, information and services are identified, prioritised and agreed.	Section 2
A2	Be assured that a senior person owns cyber risk and that it is part of enterprise risk management.	Section 7
A3	Define and communicate its cyber risk appetite, with a plan to meet it.	Section 3
A4	Be assured that suppliers are assessed in proportion to risk.	Sections 2 and 4
A5	Be assured that risk assessments are regular and reflect change.	Section 8
E1	Set up governance with clear executive and non-executive ownership of cyber.	Section 7
E2	Require formal reporting at least quarterly, set suitable metrics and agree tolerances.	Sections 4 and 7
E3	Hold regular two-way dialogue with senior executives, including the chief information security officer (CISO) or equivalent.	Section 7
E4	Be assured that cyber is part of internal and external audit and assurance.	Section 8

Table 1. Selected actions from the Cyber Governance Code of Practice, paraphrased [1]. The Code also covers strategy, people and incident response.

2. Start with coverage: what can we see?

The NCSC's asset management guidance makes the point directly: "It's far easier to protect things that you know about" [2]. Its guidance on shadow IT, the devices and services used for work that the organisation does not manage, notes that controls such as firewalls, antivirus and multi-factor authentication (MFA) cannot be assumed to be in place on them [3]. It also stresses that shadow IT is rarely malicious: it grows when the approved route is too slow or does not meet people's needs [3].

So before any control is measured, measure coverage. Four figures are enough:

Coverage figure	How to measure it	Where the data usually comes from
Devices	Managed devices as a share of all devices that signed in to company systems this quarter	Sign-in logs, compared with the device management tool (for example Microsoft Entra and Intune)
Cloud services	Approved services as a share of all cloud services in use	Cloud app discovery from proxy or firewall logs, or a cloud access security broker (for example Microsoft Defender for Cloud Apps)
Accounts	Accounts matched to a current person or a named owner, as a share of all accounts	The directory, compared with the HR leavers and joiners list; service accounts with a named owner
Suppliers with access	Suppliers with access to systems or data that are on the supplier register, as a share of all with access	Guest accounts, remote access tools and the supplier register

Table 2. Coverage figures. Many firms already license the discovery tools they need; the work is in switching them on and reading them. That is the same principle as our paper More tools, less security.

Expect the first figures to be uncomfortable. That is the purpose. A firm that discovers it uses three times as many cloud services as it has approved has learned something its dashboard could never have told it.

3. Write the risk appetite statement

A cyber risk appetite statement says what the firm will and will not accept. It should fit on one page and use the board's language, not technical terms. The example below is for an illustrative wealth manager of about 400 staff.

Area	Example statement
Visibility	We do not accept devices, cloud services or accounts we cannot see being used for client work.
Client data	We do not accept client data held in services we do not manage. We accept the residual risk of a breach where agreed controls are in place and tested.
Availability	We accept short interruptions to internal services. Client-facing services must be recoverable within one working day.
Privileged access	We do not accept administrator access without MFA and time-limited approval.
Suppliers	We accept outsourcing of IT operations, provided serious incidents reach a named person at the firm within hours, not days.
New technology, including AI	We accept new tools approved through a quick, simple route. Unapproved tools holding client data are outside appetite.
Decisions	We do not accept cyber decisions waiting more than one board cycle without a recorded reason.

Table 3. An illustrative appetite statement. Write your own; the value is in the board agreeing it, not in the wording.

4. Choose indicators, each with a tolerance

Choose six to eight indicators from a library like the one below. Every indicator needs a tolerance: the line beyond which the board wants to be told and expects action. Green then means "inside tolerance", not "work is being done".

Indicator	Why a board cares	Example tolerance
Unmanaged devices signing in	Controls cannot be assumed on devices we do not manage.	Under 2% of devices; none with administrator rights
Unapproved cloud services holding client data	Client data outside our control.	None
Accounts with no current owner	Leavers' and orphaned accounts are a common way in.	None privileged; others closed within 30 days
Accounts without MFA	A password alone is easily stolen or guessed.	None for administrators; under 1% overall
Standing administrator accounts	Permanent high privilege magnifies any compromise.	No more than two emergency accounts
Critical patches outstanding on internet-facing systems	Exposed weaknesses are found quickly by attackers.	None older than 14 days
Days since a critical system was restored from backup	An untested backup is a hope, not a control.	No more than 90 days
Time from detecting a serious incident to deciding what to do	Delay drives cost and, for FCA-regulated firms, reporting risk.	No more than four hours
Supplier notice time for incidents	Your decisions wait on their information.	Within the contract term, every time
Accepted risks past their review date	Silent acceptance replaces decision.	None
Board decisions waiting more than one meeting	A decision not taken is a risk accepted by default.	None without a recorded reason
Exercise actions overdue	Lessons learned but not acted on.	None older than 90 days

Table 4. An indicator library. Tolerances are our illustrations for a typical firm of this size, not benchmarks; set your own against your appetite.

Two things to leave out of the board pack: counts of attacks blocked and vendor security scores. Both measure activity on the known estate. They are useful to the people running security, but a board cannot make a decision from them, and they can make an incomplete picture look complete.

5. Keep a register the board can read

Keep the register to the ten to fifteen risks that matter. Rate each in plain words against the appetite, rather than multiplying invented probabilities by invented impacts.

Risk	Owner	Now	Target	Next action and date
Client data in unapproved cloud services	Chief operating officer	Outside appetite	Inside appetite	Move two team file shares to approved storage by end of quarter
Serious incident at managed IT provider not reported to us quickly	Chief operating officer	Outside appetite	Inside appetite	Add two-hour notification clause at renewal in March
Administrator accounts with standing access	IT lead	At tolerance	Inside appetite	Move to time-limited approval by next quarter
Practice system unrecoverable within one day	IT lead	Unknown	Inside appetite	Witnessed restore test next month
Leavers' accounts not closed	HR director	Inside appetite	Inside appetite	Keep monthly HR and directory check

Table 5. An illustrative extract. "Unknown" is an honest rating and belongs in the report until it can be measured.

6. Record the risks you accept

Accepting a risk is a proper board decision. What a board should avoid is accepting one by default because nobody decided. Record each accepted risk with:

the risk, and the decision to accept it;
who made the decision, and when;
the reason, such as cost, timing or a business need;
any compensating controls;
a review date, usually no more than twelve months away.

Show every accepted risk that is past its review date in the quarterly report. Its review is a decision the board owes itself.

7. The quarterly board page

One page, the same format every quarter, in this order:

Section	What it contains
1. What can we see?	The four coverage figures and their trend. Anything new discovered this quarter.
2. Are we inside appetite?	Each indicator against its tolerance, marked inside, at or outside, with the trend.
3. What changed?	Risks that moved, new risks, incidents and near misses, and lessons learned.
4. What have we accepted?	Accepted risks, highlighting those due or past review.
5. What do we need you to decide?	Each decision needed, with the date it was first requested and the recommendation.
6. Who has checked this?	Who prepared it, and who independent of the work checked it, and when.

Table 6. The one-page structure. See it working in our interactive board self-assessment.

Name an executive owner who presents the page and a non-executive owner who challenges it. At least once a year, the board should hear directly from the person responsible for security, not only through the IT provider's report.

When the page is all green

In our experience, a report that is green across every measure, quarter after quarter, usually means one of two things: the writer cannot see the whole estate, or has not shared what they can see. The first is far more common and is fixed by measuring coverage. The second is a governance problem. Either way, the right response to an all-green page is a question, not thanks: how complete is this picture, and who has checked?

8. The yearly cycle

Quarter	Board activity
Every quarter	The one-page report; decisions taken; accepted risks reviewed if due.
Quarter 1	Review and approve the appetite statement and tolerances.
Quarter 2	Risk assessment refreshed for changes in the business, suppliers and threats.
Quarter 3	Incident exercise with the board; lessons into the register.
Quarter 4	Independent check of coverage figures and a sample of indicators; cyber in the audit plan for next year.

Table 7. An illustrative annual cycle. Move activities to fit your board calendar.

9. For FCA-regulated firms

Important business services. Use the services you identified under the FCA's operational resilience rules as your critical services list, and their impact tolerances as anchors for availability indicators.
Incident reporting. From 18 March 2027 the FCA expects a first report within 24 hours of deciding an incident is reportable. "Time from detection to decision" therefore belongs in your indicators. See our guide to the new reporting rules.
Senior manager responsibility. Make sure the executive owner of cyber risk matches the senior manager whose responsibilities cover operational resilience and technology.

10. Readiness checklist

Executive and non-executive owners of cyber risk named.
Critical services, data and suppliers listed and agreed.
Four coverage figures measured from discovery tools, not estimates.
Risk appetite statement written and approved by the board.
Six to eight indicators chosen, each with an agreed tolerance.
Register cut to the risks that matter, rated against appetite.
Accepted risks recorded with owners, reasons and review dates.
One-page quarterly report in use, ending with decisions needed and their dates.
Board hears directly from the person responsible for security at least yearly.
Independent check of coverage and indicators at least yearly.
Appetite and tolerances reviewed yearly and after any serious incident.

Glossary

Term	Meaning
Accepted risk	A risk the board has knowingly decided to carry, recorded with a reason and a review date.
Chief information security officer (CISO)	The person responsible for an organisation's information and cyber security, full-time or fractional.
Cloud access security broker	A tool that discovers which cloud services are in use and can apply controls to them.
Coverage	The share of the devices, services, accounts and suppliers in use that the firm knows about and manages.
Cyber Governance Code of Practice	Government guidance, published in April 2025, on how boards of medium and large organisations should govern cyber risk.
Important business service	A service which, if disrupted, could cause intolerable harm to clients or risk to the market, as identified under the FCA's operational resilience rules.
Key risk indicator	A measure that shows whether a risk is moving towards or away from the level the board will accept.
Multi-factor authentication (MFA)	Signing in with something beyond a password, such as an app prompt or a security key.
Risk appetite	The level and kinds of risk the board is prepared to accept.
Shadow IT	Devices and services used for work that the organisation does not know about or manage.
Tolerance	The limit on an indicator beyond which the board wants to be told and expects action.

Table 8. Terms used on this page (alphabetical).

References

[1]Department for Science, Innovation and Technology and National Cyber Security Centre, Cyber Governance Code of Practice, 8 April 2025.
https://www.gov.uk/government/publications/cyber-governance-code-of-practice/cyber-governance-code-of-practice
[2]National Cyber Security Centre, Asset management, May 2021.
https://www.ncsc.gov.uk/guidance/asset-management
[3]National Cyber Security Centre, Shadow IT: managing 'unknown assets' that are used within an organisation, July 2023.
https://www.ncsc.gov.uk/pdfs/guidance/shadow-it.pdf
[4]Department for Science, Innovation and Technology and Home Office, Cyber security breaches survey 2025/2026, 30 April 2026.
https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026
[5]National Cyber Security Centre, Cyber Security Toolkit for Boards.
https://www.ncsc.gov.uk/collection/board-toolkit

Security is the outcome, not a solution.

CyberCQR is a UK cyber security advisory practice. As a fractional CISO, we set up exactly this: coverage figures, a risk appetite, indicators with tolerances and one honest page every quarter, without vendor commissions or product resale.

Book a call