Cyber resilience has become a boardroom priority for UK public services, marking a significant shift from its previous delegation to technical teams. This change is influenced by new government policies, ongoing organisational reforms, and rapid technological advancements, including the adoption of AI.
Policy changes, such as the Cyber Resilience Pledge and the NCSC’s Cyber Governance Code of Practice, now mandate cyber security as a board-level responsibility. The proposed Cyber Security and Resilience Bill is expected to further broaden these expectations for essential and digital services.
The increasing scale of cyber threats underscores this urgency; the NCSC reported 204 nationally significant cyber incidents in the year to September 2025, a rise from 89 in the preceding year. This equates to an average of four such attacks weekly.
Organisational changes, including Local Government Reorganisation and shifts in public ownership, are creating potential cyber risks by expanding the attack surface and blurring accountability. Furthermore, the widespread use of AI in the public sector, while offering opportunities, also presents governance challenges, particularly concerning 'Shadow AI' and data exposure.
Public sector boards are now expected to treat cyber resilience as a standing agenda item, linking it directly to service continuity, public trust, regulatory exposure, and reform delivery.