On this page
A board knows its IT is under control when it can see four things in writing: who owns each technology risk, what the plan is, how suppliers are held to account, and what happens when something goes wrong. If any of those depends on one person’s memory, the board is trusting rather than governing.
That is the test whether you run a 60-person practice or a group with several offices. The difference at a larger organisation is that the board is further from the detail, so the reporting has to do more of the work.
What does good IT governance look like for a board?
The clearest public benchmark is the government’s Cyber Governance Code of Practice, published in April 2025 with the NCSC. It is written for boards and directors, and it sets out actions under five headings: risk management; strategy; people; incident planning, response and recovery; and assurance and oversight.
Its actions are specific. Boards are asked to “agree senior ownership of cyber security risks”, to gain assurance that the organisation has a cyber strategy and that it “is being delivered effectively”, and to “require formal reporting on at least a quarterly basis”. The Code focuses on cyber risk, but the same structure works for technology risk more broadly: named ownership, a plan, regular evidence and a tested response.
The Code is aimed mainly at medium and large organisations. Smaller firms are encouraged to follow its principles alongside the NCSC’s guidance written for them.
Who should own technology risk?
A named person at senior level, not “IT”. Ownership means someone accountable for the decisions about risk: what the organisation will accept, what it will fix first and what it will spend. The people who do the technical work report to that owner; they do not replace them.
Where personal data is involved, this is also a legal point. Under UK GDPR Article 5(2), the controller is responsible for complying with the data protection principles and must be able to demonstrate it. A board that cannot show who owns that responsibility will struggle to demonstrate anything.
How should a board oversee IT suppliers?
Most organisations depend on outside suppliers for their systems, support and software, so supplier oversight is part of governance rather than a procurement afterthought. The Code asks boards to “gain assurance that supplier information is routinely assessed”.
In practice, that means keeping a current list of the suppliers the organisation relies on, knowing which of them hold or process its data, reviewing their performance against what the contract says, and knowing how you would leave each one. Renewals that roll over without anyone reading the terms are a governance gap, not just a cost issue.
What should the board actually receive?
A short, regular report, at least quarterly, that a non-technical director can read in a few minutes. A useful one covers:
- the top technology risks, who owns each one and what has changed since the last report
- progress against the technology roadmap, including anything late or over budget
- evidence that basic controls are working, such as patching, backups and access reviews
- supplier issues, renewals due and contract changes
- any incidents, what was learned and what changed as a result
The NCSC’s Cyber Security Toolkit for Boards follows the same structure as the Code and gives boards practical material for each area, including what to ask.
How do you know the incident plan works?
By testing it. The Code asks boards to gain assurance that there is a plan to respond to and recover from a cyber incident, and that it is exercised at least annually. A plan that has never been rehearsed tends to fail on the practical questions: who makes the call to shut systems down, who speaks to clients, and who has the contact details when email is unavailable.
An illustration, not a real case: a board is told its backups are fine. In the annual exercise, it turns out the person who knows how to restore them is the only one with the access needed, and is on leave that week. Nothing has gone wrong yet, but the board has just learned that its recovery depends on one person.
Where does IT leadership fit?
Governance needs someone senior to own the strategy, roadmap, risk and governance, and to turn technical detail into something a board can act on. That is the role of IT leadership. At INNOSEC, it includes structured governance frameworks and quarterly board-level reporting, and every engagement starts with a structured assessment and a 90-day roadmap. If the gap is the plan itself, our article on what an IT roadmap should include covers that.
Talk to us about where your technology needs to go
Book a free 15-minute call. If it’s a fit, we start with a structured assessment and a 90-day roadmap, then agree whether you need ongoing strategic partnership or a defined project.
Frequently asked questions
Is the Cyber Governance Code of Practice mandatory?
It is published as government guidance rather than legislation, and describes itself as the first point of reference for board members. It is aimed mainly at medium and large organisations, though smaller ones are encouraged to follow its principles.
How often should the board review IT risk?
The Code asks for formal reporting at least quarterly, with the incident plan exercised at least once a year. Significant changes, such as a new system or supplier, should come to the board when they happen.
Can a board delegate IT governance to its IT provider?
It can delegate the work, not the accountability. The provider can run controls and produce reports, but the board still needs named senior ownership and evidence it has reviewed.
Founder of INNOSEC. More than 25 years designing and securing IT, now looking after professional and construction firms across Northern Ireland.
