You may find yourself overseeing a very different kind of organisation, thanks to cyber regulation
Boards don't tend to spend much time considering whether their organisation poses a risk to the UK as a whole. That may need to change.
Policymakers are increasingly anxious about societal resilience to interconnected cyber threats, and cyber regulation is on an upwards trajectory. NEDs in all sectors need to keep an eye on this trend.
The party's over?
Some boards expect to have room for manoevre. Boards of smaller privately-held companies, particularly fast-growth commercial ventures and those in unregulated sectors, may be used to light or informal governance. You may even have joined one of these boards in the expectation of an exciting growth journey, unhindered by compliance and its enlarging effects on board packs.
Yet thanks to the Cyber Security and Resilience Bill now passing through Parliament, an increasing number - particularly in the tech sector - will be drawn into the orbit of cyber regulation. Government will be actively monitoring which pose enough risk to critical services and supply chains to be brought into scope, and being small won't necessarily exempt you.
What would it mean for your organisation if it was brought into the orbit of cyber regulation? How would the board's modus operandi need to change?
The transparent board
Organisations which must submit full company annual reports (large, medium-sized and listed companies) already have duties to report on their principal risks. Listed companies are already expected to report, including a directors' statement, on how they are managing those risks, and very large private companies may choose voluntarily to report.
Now government is seeking views on the modernisation of corporate reporting, and particularly "whether all very large companies should be required to report specifically on how the directors are managing cyber security risks".
This seems to respond to the observation that the JLR cyber attack was large enough to damage the British economy, yet government has few regulatory levers to prevent a similar attack on non-regulated sectors.
Your magically expanding board pack
Organisations which are already regulated should also expect their regulators to increase scrutiny on cyber risk management. For example, the Prudential Regulation Authority (PRA)'s new CEO tells us that it "will significantly increase our focus on firms’ operational and cyber resilience ... {and] consult jointly with the FCA on a new supervisory statement by the end of the year".
Unfortunately, it's not clear that much will be done to remove complexity for those organisations with multiple regulators. Board members beware: your board pack only threatens to get bigger.
