No. The Code, published by DSIT with the NCSC in April 2025, is voluntary. It sets out what directors of medium and large organisations should own on cyber risk, under five principles. It is still worth adopting: it is the clearest statement of what a UK regulator, insurer or court is likely to expect a reasonable board to have done.
The Code is aimed at boards and directors, not security teams. It deliberately avoids technical controls and focuses on the decisions only a board can make: risk appetite, resourcing, roles, incident readiness and assurance. The NCSC publishes board training to go with it.
It is the governance layer that sits above frameworks such as Cyber Essentials, ISO/IEC 27001 or the NIST CSF. The Code asks whether the board is directing and overseeing the work; those frameworks describe the work itself.
| Principle | What the board owns |
|---|---|
| A. Risk management | Cyber risk sits in enterprise risk, with an appetite the board has set |
| B. Strategy | The cyber strategy supports the business strategy and is funded |
| C. People | Clear roles, a culture that reports problems, and directors with enough skills |
| D. Incident planning, response and recovery | A tested plan, including the board's own role in a crisis |
| E. Assurance and oversight | Regular, evidenced reporting, and independent assurance where needed |
The Cyber Security and Resilience Bill is separate legislation that updates the UK's NIS regime and widens its scope to include managed service providers and data centres. It is moving through Parliament. It does not make the Code mandatory, but organisations it brings into scope will face statutory duties, and the Code is a sensible way for their boards to show oversight.
Board reporting, AI governance, DPDP readiness or CMMC. Tell me which and what the constraint is.
me@sarfarazchougule.com →