A polished cyber update can make everything sound under control. The slides are green, the policy was approved and the security tools have impressive names. Then somebody asks who can shut down a critical system during an attack — and the room goes quiet.
If the answer to a cyber question is “IT are dealing with it”, the important decision probably still has no owner.
This is not a remote risk. The government’s Cyber Security Breaches Survey 2025/2026 found that 43% of UK businesses identified a breach or attack in the previous 12 months. The figure rose to 65% for medium businesses and 69% for large businesses. Phishing alone affected 38% of businesses.
The NCSC’s Cyber Governance Code of Practice puts five things firmly at board level: risk management, strategy, people, incident planning and assurance. These seven questions turn that guidance into a useful conversation.
1. Who is accountable for cyber risk?
The answer should name a person, not a department. IT may operate many of the safeguards, but the business still needs a senior owner who can accept risk, secure funding and require action across teams.
2. Which services must keep running?
A long list of systems is less useful than a clear view of the services the organisation cannot be without. The board should know how long each critical service can be unavailable before serious harm occurs.
This answer should shape backup, recovery, incident response and supplier priorities.
3. What are the three most important current risks?
A risk register with dozens of red items does not help leaders decide. The security lead should be able to explain the few risks most likely to cause serious damage, why they matter now and what decision is required.
4. How do we know the key safeguards work?
Policies and tool licences are not proof. Useful evidence includes tested restores, access reviews, vulnerability findings, incident exercises, staff reporting rates and records showing that important actions were completed.
The board does not need every technical measure. It needs enough evidence to know whether the organisation’s claims are true.
5. Which risks have we accepted?
Some risks are expensive or impractical to remove. Accepting them can be reasonable, but the decision should be explicit. It should state who approved the risk, for how long and what would cause it to be reviewed.
If nobody can identify accepted risks, they may be accumulating through delay rather than choice.
6. What happens in the first hour of a serious incident?
Ask who decides whether to disconnect systems, contact clients, involve insurers or notify a regulator. Those decisions are difficult under pressure and should not depend on finding the right person after an incident begins.
A short exercise will show whether the plan works in practice and whether decision-makers understand their roles.
7. Which suppliers could stop us operating?
Critical suppliers may hold data, host systems or provide access that the business cannot quickly replace. Leaders should know which relationships create the greatest dependency, what assurance has been obtained and what the fallback plan is.
What good ownership looks like
Good cyber governance is visible in ordinary records: named risk owners, prioritised actions, decisions made on time and evidence that safeguards have been tested. Reporting should help the board choose what to fix, fund or accept.
If these seven questions produce unclear or conflicting answers, the next step is not necessarily another security product. It is to establish the risk picture, assign ownership and agree what evidence leadership needs to see.