Refreshed 'cyber security toolkit' helps board members to govern online risk
I am delighted to announce the launch of the NCSC’s refreshed cyber security Board Toolkit.
Originally published in 2019, the toolkit proved very popular with boards and it's their feedback, together with input from non-executive directors and our i100 industry team, that will ensure the toolkit remains up-to-date, relevant, and framed in language that boards are familiar with.
The toolkit helps boards ensure that cyber resilience and risk management are embedded throughout their organisations. It will help you to make informed cyber decisions that are aligned to your wider organisational risks, and ensure cyber security is assigned appropriate investment against other competing business demands.
As a board member, it is important to view cyber resilience strategically. Cyber security risk should have the same prominence as financial or legal risks in board discussions.
Crucially, cyber security is not just ‘good IT'; it underpins operational resilience and when done well, enables your organisation's digital activity to flourish.
What's new?
In each of the sections within the Board Toolkit you’ll now find:
- bite-sized videos to provide boards with a quick overview of each module
- essential activities that boards should expect to see in your organisation
- indicators of success: a series of questions (with possible answers) that boards can use to help evaluate your organisation's performance; these are designed as a ‘starting point’ to encourage productive cyber security discussions between boards and key stakeholders (rather than a checklist that’s simply to be worked though)
We also have some new additions:
- a sample script of questions to find out whether you (as a board member) have enough cyber security knowledge to ensure your organisation has the appropriate plans in place to mitigate threats
- an ‘executive summary’ that summarises each section of the Board Toolkit
- use cases that draw on real-life incidents to bring the guidance to life
- a Board Toolkit podcast, with contributions from industry-leading voices including the NCSC's former Chief Operating Officer Paul Maddison:
What's not changing?
The 9 core themes in the modules haven’t changed. Board members have told us how much they like the questions and possible answers, so we’ve kept these and made sure that all the questions are available in a single pdf. We’ve also kept (and updated) the ‘Introduction to cyber security for Board members’, for those who are new to the subject and need to quickly get up to speed.
The toolkit helps organisations to adopt a methodical and proactive approach to cyber security, and outlines basic safeguards that can greatly reduce the likelihood - and impact - of cyber attacks. I’d encourage all board members to take time to read the toolkit, and use it to drive productive cyber security discussions between boards and key stakeholders in your organisation.
In the meantime, if you have any feedback on the new guidance, you can get in touch by emailing [email protected]. We'll be happy to hear from you.
Lindy Cameron
CEO, NCSC
Share and print this article
Written by
