Tag: 2025

The press release issued by the Department for Science, Innovation and Technology on 8 April 2025.

Directors and company boards are being urged to shore up their cyber defences using new guidance published today, in a bid to protect their organisations from the growing tide of online threats.

Directors and company boards are being urged to shore up their cyber defences using new guidance published today, in a bid to protect their organisations from the growing tide of online threats.

A new Code of Practice launched by the Cyber Security Minister today (8 April) sets out how business leaders can protect their day-to-day operations and secure future growth for the British economy – the engine driving the government’s Plan for Change.

One of the actions include having a cyber strategy in place to ensure cyber risk management effectively supports business resilience and growth. Other key actions include promoting a cyber secure culture so employees at all levels know what to look out for, and putting incident response plans in place, allowing organisations to quickly respond to incidents when they occur.

The Code has received backing from across UK industry with organisations including the Institute of Directors, EY and Wavestone welcoming the launch.

Cyber attacks have become increasingly common, with 74% of large businesses and 70% of medium-sized firms experiencing attacks and breaches in the past year. Cyber threats cost the UK economy almost £22 billion a year between 2015 and 2019, with significant knock-on effects to daily operations and an organisation’s long-term reputation.

With a third of large businesses lacking a formal cyber strategy and nearly half of medium firms operating without an incident response plan, the Code provides the direction leaders need to take control of their cyber risk.

Cyber Security Minister Feryal Clark said:

A successful cyber attack doesn’t just have the potential to grind operations to a halt – it could drain millions from the bottom line.

If we want to drive the economic growth which is fundamental to our Plan for Change, then we need to stand side-by-side with British business leaders as they face down that threat.

Our new Cyber Governance Code of Practice does exactly that – setting out in clear terms steps organisations should take to safeguard their day-to-day operations, while also securing the livelihoods of their workers and protecting their customers.

NCSC CEO Richard Horne said:

In today’s digital world, where organisations increasingly rely on data and technology, cyber security is not just an IT concern – it is a business-critical risk, on a par with financial and legal challenges.

From my experience working alongside senior leaders across both private and public sectors, I’ve seen first-hand how robust cyber governance is essential to drive resilience, support growth, and help to ensure long-term success.

I urge all board members to engage with the new Cyber Governance resources unveiled today and make cyber security an integral part of their governance. Cyber security is a leadership imperative.

The Cyber Governance Code of Practice is the foundation of this new support package, developed in partnership with the National Cyber Security Centre and industry leaders setting out key actions boards should take to strengthen accountability and reduce risk. It’s supported by online training to help implement the Code, and a detailed Board Toolkit with further practical guidance. This will arm businesses with confidence in the tools they deploy to protect themselves online, safeguarding their businesses, their workers, and their customers.

This package, also produced in collaboration with Non-Executive Directors, ensures boards have practical, relevant resources to deepen their understanding and effectively govern cyber risks.

Small businesses looking to strengthen their online defences are encouraged to engage with the NCSC’s Small Business Guide, which provides quick and easy actions to help bolster their defences and support through the Cyber Local scheme, which provides tailored funding to boost the regional cyber skills.

Cyber security has become a central part of the government’s plans to secure the digital services which drive growth across the country to deliver on its Plan for Change.

Just last week, the Technology Secretary set out his ambition for cyber security legislation which will be introduced to Parliament later this year – a set of proposals which will protect the UK’s supply chains, critical national services, and IT service providers and suppliers. As part of the new measures, hospitals and energy suppliers are set to boost their cyber defences, protecting public services and safeguarding growth.

Stakeholder reaction

John Edwards, UK Information Commissioner, ICO said:

With cyber incidents increasing across all sectors, it is crucial for organisations and businesses to take a proactive approach to cybersecurity governance, including putting the appropriate security measures and training in place to protect people’s data while boosting innovation.

We welcome the new Cyber Governance Code of Practice and would encourage organisations to prioritise the digital safety of their assets and, ultimately, their reputation.

Jonathan Geldart, Director General, Institute of Directors said:

Cyber resilience is fundamental to organisational success and a core responsibility for boards and directors. The UK Government’s Cyber Governance package provides valuable guidance to help business leaders effectively oversee cyber risk.

Members of the Institute of Directors have actively contributed to shaping the Cyber Governance Code of Practice through consultative workshops and panel discussions. We welcome this action by the government, which will support our members, UK business and the wider economy in strengthening cyber security.

Jean-Philippe Perraud, CEO, NEDonBoard, Institute of Board Members said:

Cyber resilience is fundamental to organisational success. The Cyber Governance Code of Practice sets a clear benchmark for boardroom engagement. NEDonBoard, Institute of Board Members, supports board members in upskilling for effective oversight of cyber risk, digital transformation, and resilience.

We are proud to have been a key stakeholder and representative group, actively contributing to the development and refinement of the Cyber Governance Package. We support this important initiative by DSIT and NCSC and encourage boards to embed the principles of the Code and the pledge into their organisations’ oversight and risk management practices.

Rick Hemsley, UK Cybersecurity Leader, EY said:

We are proud to have contributed to the development of the Cyber Governance Code of Practice, drawing on our extensive real-world experience. The code will serve as a vital resource for Boards and senior leadership teams, providing them with the guidance needed to address cyber resilience. The code emphasises the importance of not only protecting sensitive data but also ensuring that organisations can respond effectively to incidents when they occur.

A strong culture of cyber resilience can help organisations to anticipate, withstand, and recover from cyber incidents, ultimately safeguarding their stakeholders and maintaining trust in their operations.

Thomas Clayton, UK Head of Cyber, Zurich UK said:

The cyber insurance market is relatively new in comparison to other propositions in our industry. It has developed rapidly in recent years to keep pace with the sophisticated tactics used in the event of an attack. The key to protecting organisations from attacks is resilience rather than simply prevention – these incidents are detrimental to business operations but also bring longer term reputational and wider economic damage.

Preparation is therefore vital and as a result, the Cyber Governance package published by the UK Government which brings clarity to the responsibility of boards and directors when it comes to governing cyber risk, is something we fully welcome and support.

Anne Kiem OBE, Chief Executive of the Chartered Institute of Internal Auditors said:

We welcome the new Cyber Governance Code of Practice, which empowers organisations to bolster their governance of cyber risks and controls. As cyber-attacks further escalate, boards must ensure that the assurance and oversight of their cyber resilience is robust and consistent with existing internal audit assurance mechanisms – as highlighted in the new Code. Internal audit is key in supporting the Code’s implementation by providing independent, insightful assurance that internal controls for cyber risks are strong and effective.

Rob Deri, CEO of BCS, The Chartered Institute for IT said:

Strong cyber governance is critical in today’s digital landscape, and it must be a board-level priority. BCS welcomes the publication of the Cyber Governance package, which provides valuable guidance in formalising cyber security practices. Cyber risk is a principal risk for organisations, and this package will be a valuable resource for our members and the wider industry.

Chris Dimitriadis, Chief Global Strategy Officer, ISACA said:

ISACA is proud to have supported DSIT in designing this significant new piece of enterprise guidance. Digital trust is critical for enterprises to innovate and drive economic growth. At ISACA, we are committed to equipping organisations and professionals with the knowledge they need to build a culture of resilience. By providing clear guidance on cyber risk management, this Code empowers boards and directors with the tools they need to strengthen organisational cyber resilience.

Esther Mallowah, Head of Tech Policy, ICAEW said:

Boards and directors recognise the importance of cyber resilience to their organisations’ success but face an ever-evolving challenge in understanding and fulfilling their responsibilities around cyber governance. The Cyber Governance package, published by the UK Government, helps to clarify their responsibilities and provides much needed direction on where to focus and what actions to take to govern cyber risk. We’re pleased the government is taking this action to support our members and to improve cyber resilience across the economy and look forward to continuing to work with DSIT on the evolution of the code.

Julia Graham, CEO, Airmic said:

Airmic supports actions to improve the management of cyber risk and the guidance for boards and top management provided by the Code of Practice and supporting materials. These will add tangible value to our members and the organisations they represent by helping to keep our country,  businesses and citizens safe and resilient to risks set out in the National Risk Register, including cyber threats.

Mike Maddison, CEO of NCC Group, said:

Cyber security is an economic necessity in today’s digital and interconnected world. But, a major cultural shift within organisations’ senior leadership is needed to ensure that those running the UK’s public and private sector institutions understand our collective responsibility to invest in cyber resilience.

The Code of Practice is a welcome step in the right direction. Delivering whole-of-society cyber resilience is a complex undertaking. As part of the UK Government’s wider approach, initiatives like the Code play a key role in spotlighting senior leaders’ responsibilities and supporting the rollout of stronger digital defences.

Ben Martin, Policy Manager at the British Chambers of Commerce said:

Cyber threats against businesses are continuously evolving, and without coordinated action many SMEs will remain at risk. Research suggests there is a lack of specialist digital security knowledge in many smaller companies. This guidance is a welcome step forward to help firms take the steps needed to protect their digital assets and information.

Graham Wynn, Assistant Director for Consumer, Competition and Regulatory Affairs, British Retail Consortium said:

The BRC first published a Guide to cyber security measures for Boards and Directors nearly a decade ago. This Code with its emphasis on risk; strategy; recovery; and people is very much in line with our approach. It is vital that Boards should understand the risks and the need for a coherent plan of action in the event of an attack. The Code will help to highlight that need.

Graeme Trugdill, CEO British Insurance Brokers’ Association said:

BIBA welcomes the Cyber Governance Code of Practice published by the UK Government. This voluntary guidance will support boards and directors of medium and large businesses to govern their cyber risk and enhance their operational resilience.

Olu Odeniyi, Co-founder, CxB said:

Cyber resilience is essential for organisational success, and the UK Government’s Cyber Governance Code provides clear guidance on the responsibilities of boards and directors in managing cyber risks. We at CxB – Cyber Governance for Boards strongly welcome this initiative and contributed our expertise, thought leadership and experience to help shape the Code and the associated training, which empowers boards across all sectors to strengthen their cyber resilience.

Rowena Ironside, founder of WB Directors’ ‘Women on Boards’ network & portfolio NED said:

Cyber resilience is fundamental to organisational success – all board directors today need to have a handle on the risk and their responsibilities in this area. We welcome the Cyber Governance Package published by the UK Government, which clarifies the responsibilities of boards and directors in governing cyber risk. It will be an indispensable tool for members of our cross-sector non-executive director network to ensure the organisations they govern strengthen their security posture and contribute to a more resilient economy.

The press release issued by the Department for Science, Innovation and Technology on 8 April 2025.

Industry heavyweights from the energy and technology sectors will descend on Whitehall today (8 April) for the first meeting of the UK’s new AI Energy Council.

Co-chaired by the Technology and Energy Secretaries, today’s inaugural meeting will see members agree the council’s objectives with a key aim focused on how the government’s clean energy superpower mission, and its commitment to advancing AI and compute infrastructure, can work together to deliver economic growth.

It’s expected the Council will also look at clean energy, like renewables and nuclear – advising on improving energy efficiency and sustainability in AI and data centre infrastructure, such as the use of water. The council will also take steps to ensure the secure adoption of AI across the UK’s energy network itself.

Unveiled in January as part of the government’s response to the AI Opportunities Action Plan, the Council will bring together expert insights on the energy demands of AI, as the UK puts the technology front and centre of its plans to drive economic growth and deliver its Plan for Change.

Concerns over the energy demands needed to power AI data centres is an issue faced by countries the world over. One of the ways the UK is already rising to meet this challenge is by focussing its new AI Growth Zones – dedicated hotbeds of AI development – in areas which can access at least 500MW of power. Representing the equivalent of enough energy to power roughly two million homes, this will help to spark significant private investment from companies looking to set up shop in Britain – creating local jobs which will put more money in people’s pockets.

Secretary of State for Science, Innovation, and Technology, Peter Kyle said:

The work of the AI Energy Council will ensure we aren’t just powering our AI needs to deliver new waves of opportunity in all parts of the country, but can do so in a way which is responsible and sustainable.

This requires a broad range of expertise from industry and regulators as we fire up the UK’s economic engine to make it fit for the age of AI – meaning we can deliver the growth which is the beating heart of our Plan for Change.

Secretary of State for Energy Security and Net Zero, Ed Miliband said:

We are making the UK a clean energy superpower, building the homegrown energy this country needs to protect consumers and businesses, and drive economic growth, as part of our Plan for Change.

AI can play an important role in building a new era of clean electricity for our country and as we unlock AI’s potential, this Council will help secure a sustainable scale up to benefit businesses and communities across the UK.

The UK government has also been working closely with both Ofgem and the National Energy System Operator to deliver fundamental reforms to the UK’s connections process. Subject to final signoffs from Ofgem, this could release more than 400GW of capacity from the connection queue – accelerating projects vital to economic growth such as the delivery of new large scale AI data centres.

Joining the council are 14 organisations – including regulators and companies drawn from the energy and tech sectors – who will support its work by sharing expert insights.

Among these organisations are: EDF, Ofgem, National Energy System Operator (NESO), Scottish Power, National Grid, Google, Microsoft, Amazon Web Services, and chip designer ARM, and infrastructure investment firm Brookfield.

This collaborative approach which brings together the energy and technology sectors will make sure there is join up across the board to speed up energy projects getting connected to the grid – especially with a growing pipeline of tech companies announcing plans to build datacentres across the UK.

Alison Kay, Vice President, UK and Ireland, at Amazon Web Services (AWS), said:

At Amazon, we’re working to meet the future energy needs of our customers, while remaining committed to powering our operations in a more sustainable way, and progressing toward our Climate Pledge commitment to become net-zero carbon by 2040.

As the world’s largest corporate purchaser of renewable energy for the fifth year in a row, we share the government’s goal to ensure the UK has sufficient access to carbon-free energy to support its AI ambitions and to help drive economic growth.

Jonathan Brearley, CEO of Ofgem, said:

AI will play an increasingly important role in transforming our energy system to be cleaner, more efficient, and more cost-effective for consumers, but only if used in a fair, secure, sustainable and safe way.

Working alongside other members of this Council, Ofgem will ensure AI implementation puts consumer interests first – from customer service to infrastructure planning and operation – so that everyone feels the benefits of this technological innovation in energy.

As part of our Clean Power Action Plan, the government is getting more homegrown clean power connected to the grid by building the necessary infrastructure, prioritising the projects needed for 2030 to connect as much clean power as possible. We will clean up the grid connection queue, meaning crucial infrastructure from housing to gigafactories and data centres can get a connection to the grid, helping to unlock billions of investment and grow the economy.

Bolstered by accelerated planning approvals which will mean spades in the ground at a fraction of the time it currently takes, AI innovators will be able to call on cutting-edge infrastructure and ready access to power to drive forward the next wave of AI opportunity.

Further information

Attendees to the first meeting of the AI Energy Council will include representatives of:

• Ofgem
• NESO
• Energy Networks Association
• Nuclear Industry Association
• ScottishPower
• National Grid
• EDF
• Google
• Microsoft
• Amazon Web Services
• Equinix
• Brookfield
• ARM
• ARIA

The council will meet on a quarterly basis, with the next meeting scheduled for this summer.