CyberCQR Top 10 · Governance
Cyber risk reporting: ten actions for boards
How a board gets cyber reporting it can govern from: start with what the firm can see, agree what it will accept, measure against tolerances, and stop decisions waiting. Each action is mapped to the government's Cyber Governance Code of Practice.
Summary
The point for boards. A security score only measures the part of the estate the firm knows about. The National Cyber Security Centre (NCSC) puts it simply: it is far easier to protect things you know about [3]. Good board reporting starts with how much the firm can see, then shows whether it is inside the risk the board has agreed to accept, then lists what the board must decide.
What the Code asks
The Cyber Governance Code of Practice, published by the government and the NCSC in April 2025, sets out what boards of medium and large organisations should do about cyber risk [2]. Two of its actions go to the heart of reporting. Action A3 asks the board to define and communicate its cyber risk appetite. Action E2 asks it to require formal reporting at least quarterly, with suitable metrics and agreed tolerances [2]. The ten actions below turn those, and the related actions on ownership, assurance and review, into practical steps.
The ten actions
1. Name an executive owner and a non-executive owner for cyber risk
Why it matters. The Code asks for a governance structure with clear executive and non-executive ownership of cyber, built into the wider governance of the firm [2]. Only 52% of medium-sized businesses have a board member with explicit cyber responsibility [1].
What to do.
- Name one executive who owns cyber risk day to day and reports on it.
- Name one non-executive who challenges that reporting on the board's behalf.
- Write both into the board's terms of reference.
2. Measure what you can see before you measure anything else
Why it matters. Every control applies only to assets the firm knows about. The NCSC describes shadow IT, the devices and services used for work that the firm does not manage, as a risk because controls such as antivirus and multi-factor authentication (MFA) cannot be assumed to be in place [4]. A report that leaves out the unknown estate will look better than reality.
What to do.
- Report three coverage figures every quarter: managed devices as a share of devices signing in, approved cloud services as a share of those in use, and accounts matched to a current person or named owner.
- Use discovery, not memory: sign-in logs, device management and cloud app discovery tools, many of which firms already license.
- Treat a falling coverage figure as seriously as a failed control.
3. Agree what the firm depends on most
Why it matters. The Code asks the board to be assured that critical technology, information and services are identified, prioritised and agreed [2]. Without that list, every indicator carries the same weight.
What to do.
- List the five to ten services, data sets and suppliers the firm cannot operate without.
- Have the board agree the list and review it each year.
- For FCA-regulated firms, align it with your important business services.
4. Write a one-page cyber risk appetite statement
Why it matters. Without an agreed appetite, nobody can say whether a risk is acceptable, and every report becomes a matter of opinion. The Code asks boards to define and communicate it [2].
What to do.
- Write it in the board's terms: client harm, regulatory standing, downtime and data.
- For each area, say what the firm accepts and what it does not. For example: "We do not accept client data in services we do not manage."
- Approve it as a board, and review it every year.
5. Choose six to eight indicators, each with a tolerance
Why it matters. The Code asks for suitable metrics with agreed tolerances aligned to the appetite [2]. An indicator without a tolerance is just a number; with one, it tells the board whether to act.
What to do.
- Include the three coverage figures from action 2.
- Add a few protection and recovery measures, such as administrator accounts without MFA, days since a critical system was last restored from backup, and the time from detecting a serious incident to deciding what to do.
- Agree the tolerance for each, and what happens when it is crossed.
6. Keep a risk register the board can read
Why it matters. A register written for specialists is not read by the board. One that is too long hides what matters.
What to do.
- Keep it to the ten to fifteen risks that matter, each with an owner, its current level, its target level and the next action with a date.
- Rate in plain words, such as "inside appetite" or "outside appetite", rather than with invented probabilities.
- Show what changed since the last quarter.
7. Record the risks you accept: who, why and until when
Why it matters. Accepting a risk is a legitimate board decision. Accepting one by default, because nobody decided, is not. A dated record turns silent tolerance into an explicit choice the board can revisit.
What to do.
- For each accepted risk, record the decision, who made it, the reason, any compensating controls, and a review date.
- Show accepted risks that are past their review date in every quarterly report.
8. Require one page every quarter, ending with the decisions needed
Why it matters. The Code sets quarterly as the minimum [2]. In medium-sized businesses, only 70% update senior management even once a year [1]. Decisions that wait for months are risks accepted without a decision.
What to do.
- Use a fixed one-page format: what we can see, whether we are inside appetite, what changed, what we accepted, and what we need decided.
- List every decision awaiting the board with the date it was first requested.
- Treat any decision waiting more than one meeting as a risk in its own right.
9. Get assurance from someone who did not do the work
Why it matters. The Code asks for regular two-way dialogue with senior executives, including the chief information security officer (CISO) or equivalent, and for cyber to be built into internal and external assurance [2]. In our experience, an all-green report usually means the writer cannot see the whole estate, or has not shared what they can see. Independent checking is how a board tells the difference.
What to do.
- Have the board hear directly from the person responsible for security at least once a year, not only through the IT provider's report.
- Have the coverage figures and a sample of indicators checked by someone independent of the people who produce them.
- Include cyber in the internal audit plan.
10. Review the appetite and indicators every year, and after any serious incident
Why it matters. The Code asks for regular risk assessment that reflects recent and expected changes, and for lessons from incidents to feed back into it [2]. Indicators that never change stop being read.
What to do.
- Review the appetite statement and tolerances once a year.
- After a serious incident or a near miss, ask which indicator should have warned you, and add or change one.
- Retire indicators that no longer drive a decision.
A plan for the first quarter
| When | Actions | Owner |
|---|---|---|
| Month 1 | 1. Name the owners. 2. Produce the first coverage figures. 3. Agree the critical services list. | Chair; executive owner |
| Month 2 | 4. Draft the appetite statement. 5. Choose indicators and draft tolerances. 6. Cut the register to what matters. | Executive owner; adviser |
| Month 3 | 4 and 5. Board approves appetite and tolerances. 7. Start the accepted-risk record. 8. First one-page report. | Board |
| Then | 8. Report every quarter. 9. Independent check of coverage once a year. 10. Annual review. | Executive and non-executive owners |
Table 1. A suggested order. Numbers refer to the ten actions above.
Five questions for your next board meeting
- What share of the devices, cloud services and accounts our people use can we see and manage?
- Where is our cyber risk appetite written down, and when did the board last approve it?
- Which of our cyber indicators has a tolerance, and which are just numbers?
- Which cyber decisions are waiting on this board, and since when?
- Who independent of the work has checked that our cyber report is complete?
Glossary
| Term | Meaning |
|---|---|
| Accepted risk | A risk the board has knowingly decided to carry, recorded with a reason and a review date. |
| Chief information security officer (CISO) | The person responsible for an organisation's information and cyber security, full-time or fractional. |
| Coverage | The share of the devices, services and accounts in use that the firm knows about and manages. |
| Important business service | A service which, if disrupted, could cause intolerable harm to clients or risk to the market, as identified under the FCA's operational resilience rules. |
| Key risk indicator | A measure that shows whether a risk is moving towards or away from the level the board will accept. |
| Risk appetite | The level and kinds of risk the board is prepared to accept. |
| Shadow IT | Devices and services used for work that the organisation does not know about or manage. |
| Tolerance | The limit on an indicator beyond which the board wants to be told and expects action. |
Table 2. Terms used on this page (alphabetical).
Further reading
From CyberCQR
- All green, still exposed: what your board's cyber report is not telling you
- Measuring and reporting cyber risk to the board: a good practice guide
- How much of your estate can the board see? (interactive)
- FCA incident reporting: ten actions before 18 March 2027
External
References
- [1]Department for Science, Innovation and Technology and Home Office, Cyber security breaches survey 2025/2026, 30 April 2026.
https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026 - [2]Department for Science, Innovation and Technology and National Cyber Security Centre, Cyber Governance Code of Practice, 8 April 2025.
https://www.gov.uk/government/publications/cyber-governance-code-of-practice/cyber-governance-code-of-practice - [3]National Cyber Security Centre, Asset management, May 2021.
https://www.ncsc.gov.uk/guidance/asset-management - [4]National Cyber Security Centre, Shadow IT: managing 'unknown assets' that are used within an organisation, July 2023.
https://www.ncsc.gov.uk/pdfs/guidance/shadow-it.pdf - [5]National Cyber Security Centre, Cyber Security Toolkit for Boards.
https://www.ncsc.gov.uk/collection/board-toolkit
Security is the outcome, not a solution.
CyberCQR is a UK cyber security advisory practice. We help boards set a cyber risk appetite, choose indicators that mean something and get one honest page every quarter, without vendor commissions or product resale.