From Guidance To Governance: What The NCSC’s New Direction Means For Business Leaders

InnovationFrom Guidance To Governance: What The NCSC’s New Direction Means For Business LeadersByJustin Brooks,Forbes Councils Member.for Forbes Technology CouncilCOUNCIL POSTExpertise from Forbes Councils members, operated under license. Opinions expressed are those of the author. | Membership (fee-based)Jun 02, 2026, 11:00am EDTJustin Brooks, Vice President, U.K. & Ireland, Zscaler. gettyCyber incidents across the U.K. have prompted a clear and direct response from government and national security authorities. In October 2025, the U.K. government issued a ministerial letter to major company CEOs making it explicit that cybersecurity is no longer solely an IT concern—it is a board-level responsibility. At the same time, the National Cyber Security Centre (NCSC) reinforced that expectation by aligning its guidance with the Cyber Governance Code of Practice and the Cyber Assessment Framework (CAF). Together, these signals represent a shift in how cyber resilience is expected to be managed across British industry. The question is no longer whether organizations have security tools in place; it's whether leadership can demonstrate that cyber risk is being governed, measured and reduced in a systematic way. For CIOs, CISOs and CEOs, the CAF provides a practical structure for answering that question.​A Shift From Technical Guidance To Governance​The NCSC Cyber Assessment Framework evaluates how effectively organizations manage cyber risk. Unlike prescriptive compliance, CAF is outcome-focused, assessing an organization's ability to demonstrate managing risk, protecting systems, detecting threats and minimizing incident impact. These four outcomes have been elevated from technical guidance to a governance expectation, requiring boards to show active management of cyber risk, similar to financial or operational risk. This shift acknowledges the modern reliance on complex digital infrastructure across cloud, global supply chains and OT environments, where cybe...