Unlocking Cyber Resilience: UK’s NCSC Drafts Code of Practice to Elevate Cybersecurity Governance in UK Businesses

In late January, the UK’s National Cyber Security Centre (NCSC) issued the draft of its Code of Practice on Cybersecurity Governance. The document's goal is to raise the profile of cyber issues with organizational directors and senior leaders and encourage them to shore up their defenses from cyber threats.

The draft, which is currently open to public comment and was designed in partnership with industry directors, cyber and governance experts, and the NCSC, intends to establish cybersecurity as a key focus area for businesses, putting cyber on an equal basis with financial and legal threats.

We sat down with Barry O'Connell, the General Manager of EMEA regions at Trustwave, for his thoughts on the guidance, who noted that while the draft contained many solid ideas, implementing the changes may prove more challenging.

Let’s first take a step back and look at what NCSC issued.

Cyber Governance Code of Practice: A Brief Explanation

Some of the broader themes discussed include recommending directors set out clear roles and responsibilities across their organizations, boosting protections for customers, and safeguarding their ability to operate safely and securely in today's ever-more digitized environment. The code also wants companies to have detailed plans to respond to and recover from any potential cyber incidents. The organizations should regularly test their plan so it's as robust as possible, with a formal system for reporting incidents also in place.  

"In today's increasingly digitally dependent economy and society, directors should entwine cyber risk management with existing business resilience and risk management practices. This requires boards and directors, of organizations of all sizes, to embrace and engage with cyber security and understand the risk that cyber incidents present to delivery of the business strategy," said Viscount Camrose, Parliamentary Under Secretary of State, Department for Science, Innovation and Technology, said. "It is in this context that the government sees business resilience and cyber security as intrinsically linked."

Q: What is your initial take on the draft? Is it necessary? Headed in the right direction, is it far-reaching enough? Will it, in fact, help organizations improve their cyber defense posture?

Barry O'Connell: This is a move in the right direction. Governance of cybersecurity and the engagement of senior executives and board members in an organization's exposure and management of cyber risk requires more attention than is typically the case today. There are several studies that show organizations do not have the required level of alignment between the senior leadership and the cybersecurity community, so the UK government facilitating this conversation is a positive step. The challenge will be to drive sufficient focus on turning what is effectively a list of best practices into tangible action. 

Notwithstanding the difficulty of developing a code of practice to meet the needs of the diverse types and sizes of businesses across the UK, the current content requires a level of understanding and sophistication that may exist in many large organizations but will be lacking in less cyber-mature businesses. A differentiated deployment approach for large enterprises and SMBs would be helpful, similar to the Australian Institute of Company Directors' Cyber Security Governance Principals published in October 2022. Many SMB organizations require management oversight on the fundamentals of good cybersecurity hygiene as a first step in ensuring a maturing cybersecurity strategy. 

Q: How does the UK recommendation compare to similar legislation put forth by the US SEC (Preparing the Board of Directors for the SEC's Upcoming Cybersecurity Compliance Regulations | Trustwave) or other nations?

Barry O'Connell: The first thing to note is that this is not legislation; it is a voluntary code of practice. As such, there is no requirement for an organization to comply with the recommendations, although deploying the code of practice may support related legislation such as GDPR, etc. 

If we look at a sliding scale from voluntary adoption through to legislative enforcement, this is currently very much at the softer end of the scale. While using the proposed consultation process to refine the recommendations makes sense, the government needs to think about how to drive deployment of the code of practice to ensure proper adoption. This could include involving business stakeholders like the Confederation of British Industry (CBI) to advocate for stronger cybersecurity governance across its membership. Additionally, the government could mandate that their supply chain partners meet a certain level of cybersecurity maturity using something similar to the Cybersecurity Maturity Model Certification (CMMC) program used by the US Department of Defense (DoD). 

Although the code of practice is a set of suggested actions, it makes sense for businesses to self-police and use the recommendations to conduct their own assessment to understand where they may need to improve the maturity of their cybersecurity governance practices. This is particularly relevant for companies operating in jurisdictions choosing a more aggressive approach to compliance with a cybersecurity governance framework. This could also be the case for organizations involved in critical infrastructure supply chains, including energy, healthcare, financial services, transport, and telecommunications, where some form of stricter compliance regime may evolve over time.

Q: Is defining a governance framework the easy part (relatively)? At what point does this process become difficult? What are the stumbling blocks?

Barry O'Connell: The Governance Code of Practice defines what to do, not how to do it. Several governance frameworks are available specifically for cybersecurity, and examples from other disciplines that could be easily adapted. Cybersecurity governance is not so much an academic challenge in that CISOs, by and large, know, or could learn what good governance looks like. It's more of an execution challenge requiring participation from business leadership to engage with the Cybersecurity team to share a clear articulation of the digital processes and supply chains used by the organization to execute business outcomes. In turn this needs to be supported by a measurement system that delivers clear, business-oriented, actionable metrics. Finally, there is a requirement for the business to recognize the cultural aspects of deploying a successful Cyber Security Strategy. 

Q: What areas do governance frameworks typically cover, and how should an organization go about defining them for itself?

Barry O'Connell: As mentioned above, we can think about defining a framework in four main areas: Strategy, Processes and Organization, Metrics, and Culture. Defining these areas in terms of cybersecurity requires a conversation with the broader organization. Here is a broad definition of each:

Strategy: This is the strategy of the company. It's key that the cybersecurity strategy mirrors the overall strategy of the company to provide the context for board and executive leadership alignment. The question is how we execute that strategy using digital assets, what risks we see in using those assets, and what steps we are taking to mitigate those risks. It needs to be understood that the CISO doesn't 'own' security; they are facilitatory. The ownership and responsibility organizationally and legally reside with the board and executive team. 

Processes and Organization: This is "the how" aspect of executing our strategy. We need to understand the operating models enabled by digital assets and the processes we use to execute our operation. We need to look at how we organize, including the structures we use to enable the flow of information, the access organizations and individuals have to data, and the role of external partners in our supply chain. This is the core of business and defines how we operate. This is where we will find our key exposure to cyberattacks. This requires the involvement of the business owners within the organization. They are the owners and custodians of the business processes and, as such, are responsible for managing risk. 

Metrics: How we measure our maturity and the steps we are taking to improve the overall cybersecurity health of the organization. The cybersecurity community is reasonably comfortable with operational metrics but struggles when it comes to translating these metrics into something consumable by the business community. Cybersecurity is an enabler of business commerce and, as such, needs to have metrics that align with the performance and outcomes of the processes that support the business. Reporting the number of alerts the SOC received is interesting to a SOC manager but demonstrating potential cyber threats to the organization and how they've been prevented, enabling successful business operation, is much more relatable to a business leader. This information also lays the foundation for demonstrating increased cyber maturity and is key when asking for the next round of protective and offensive security investment.

Culture: This requires defining and deploying the behaviors we want the organization to exhibit when assisting with maturing our cybersecurity posture. It’s a common refrain from security professionals that security is everyone’s responsibility. This is true but we need to ensure appropriate programs are established, executed and monitored. While the Cyber security community can help define these programs the responsibility for their success lies with business leaders. I once heard of a manager, in an effort to score highly on an internal assessment of employee awareness, tell his team of the upcoming phishing exercise and that they should not open the email designated to carry the malicious payload. Not exactly the behavior of someone aligned the cultural aspects Cybersecurity.

Q: Finally, any points the draft does not cover that you feel should be included?

Barry O'Connell: There's nothing fundamentally wrong with the draft or any glaring omissions. It does feel as if it's been written by a consultant-fueled working group distilling years of experience conversing with large corporations that have teams of well-informed security professionals and equally aware business partners.

However, this is not reality for most UK businesses. I'd like to see the code of practice be more consumable for the majority of businesses and more specific on how to achieve the desired outcomes. I’d also like to see a more granular approach when it comes to defining what’s required for businesses of different sizes and complexity. This comment is not to knock what's been created. We should celebrate that the government is looking at this topic. My advice would be to take up the offer from the team that put this together and submit your own feedback.