Emerging cyber threats and organisational risk management: governance implications around adequate cyber insurance

Regulatory expectations and the cyber governance code of practice

To address these challenges, the UK Government published the Cyber Governance Code of Practice, co-designed with the National Cyber Security Centre (NCSC), which sets out expectations for boards and directors to embed cyber risk within strategic oversight and enterprise risk governance. The Code emphasises that directors should take ownership of cyber risk, integrate it with wider risk management, set risk appetite, and ensure regular assurance and reporting at board level. Boards are expected to engage directly with cyber strategy, risk assessments, and cross-organisational accountability rather than leaving these duties solely to technical teams.

Although currently voluntary, the Code effectively translates directors’ existing legal duties, such as the duty to exercise reasonable care, skill, and diligence under UK company law, into actionable governance expectations for cyber oversight. It signals that cyber-risk governance is now a core board responsibility.

The critical role of cyber insurance

Cyber insurance is a critical component of a robust risk management strategy. It provides not only financial protection, but also delivers access to specialised incident response resources and expertise. Effective cyber insurance can reduce the net volatility of losses from cyber events and support organisational resilience.

Senior leaders who choose not to obtain adequate cyber insurance, or who under-insure relative to the organisation’s risk profile, risk creating a material exposure. Without sufficient transfer of risk, organisations may find themselves bearing the full financial and operational costs of an incident, which can exceed internal resources and threaten solvency.