Boards across the United States, United Kingdom, and European Union are under growing pressure to demonstrate effective oversight of cybersecurity risks. As incidents become more frequent and impactful, boards must not only understand their responsibilities but also stay informed about evolving legal obligations, best practices, and governance expectations.
Earlier this year, the French national cybersecurity regulator (ANSSI) hosted a first-of-its-kind tabletop exercise involving over 5,000 professionals from 1,000 public and private organisations. The event underscored the critical need for companies and their leadership teams to embed robust crisis-management strategies to prepare for and respond to cybersecurity incidents.
Cybersecurity resources, frameworks, and regulatory developments are increasingly relevant to boards that oversee operations in the U.S., UK, and EU. Practical guidance, legal requirements, and emerging trends continue to shape how boards should approach cyber-risk management, incident response, and disclosure obligations. By synthesising materials from government agencies, industry bodies, and legal experts, this resource aims to support directors in better fulfilling their fiduciary duties and enhancing organisational resilience in the face of cyber threats.
General Guidance for Boards
Cybersecurity oversight has become a core boardroom issue in the U.S., UK, and EU, driven by regulatory developments and heightened expectations around risk governance. Several board-level professional associations have published guidance for directors on implementing and overseeing their organisations’ cybersecurity programs. In the UK, government bodies and regulators have issued resources to help boards navigate their cybersecurity responsibilities, while across the EU, national cybersecurity agencies have developed targeted resources to support board-level engagement with cyber risk. Collectively, these resources reflect a growing recognition that cybersecurity is not merely a technical issue but a core component of corporate governance and organisational resilience.
 |
The National Association of Corporate Directors’ (NACD) Handbook on Cyber-Risk Oversight sets out key principles for board engagement, emphasising the need for directors to understand and manage cyber risks as part of their fiduciary duties. The NACD’s 2025 Public Company Survey analyses the priorities of over 200 boards of directors and identifies emerging trends in AI and cybersecurity oversight. The Cybersecurity Law Report, in an article authored by our team, outlines five actionable steps boards can take to prepare for and respond to cyber incidents. |
 |
The Cyber Security Code of Practice outlines governance principles tailored to board-level oversight, while the National Cyber Security Centre (NCSC) Board Toolkit offers practical tools and key questions to guide boardroom discussions. Sector-specific guidance is also available:
|
 |
In France, the SME cybersecurity memorandum published by the French Confédération des Petites et Moyennes Entreprises, along with the accompanying executive guidance, provides tailored advice for directors and senior managers, emphasising the strategic importance of cybersecurity. In addition, cloud service providers, under the ‘SecNumCloud’ framework (established by the national cybersecurity regulator, ANSSI), can certify the resilience of their solutions against cyberattacks. The framework establishes broad organisational requirements, including personnel standards that must be addressed by the management body. Germany’s Cyber Risk Management Handbook and Cyber-Risk Oversight Toolkit offer a comprehensive framework for executive-level risk oversight, emphasising principle-based compliance that aligns with the NACD Handbook on Cyber-Risk Oversight. Italy’s National Cybersecurity Agency has issued both executive-level guidance and a governance fundamentals guide to help boards integrate cybersecurity into corporate strategy. |
Security Controls
In the wake of high-profile data breaches over the last decade, organisations are not only encouraged but often required to maintain safeguards that protect internal, proprietary, and customer data. They must implement technical defences against cyberattacks and educate employees on cybersecurity best practices. Accordingly, all organisations should adopt certain policies to prevent cyber incidents, as well as industry-specific measures to protect highly sensitive consumer records and information. Government entities in the U.S., UK, and EU have published control frameworks that organisations can use to minimise vulnerabilities, safeguard confidential information, and protect customers, corporate integrity, and business.
|
The U.S. Department of Commerce’s National Institute of Standards and Technology (NIST) has developed a comprehensive catalogue of controls, Security and Privacy Controls for Information Systems and Organizations, for entities to consider when developing corporate policies and procedures. NIST has also established its Cybersecurity Framework as a hub of resources for cybersecurity practices more broadly. The Center for Internet Security, a nonprofit organisation focusing on controls and benchmarks, has developed its 18 CIS Critical Security Controls as pillars of enterprise information security. |
|
In the UK, the Information Commissioner’s Office has developed a range of resources and guidance regarding situation-specific cybersecurity measures and broader best practices. Similarly, the National Cyber Security Centre (NCSC) has published its Cyber Assessment Framework (available as a PDF on the NCSC website) to help organisations assess and improve their cybersecurity and resilience. In addition, the NCSC’s 10 Steps to Cybersecurity offers guidance for medium to large organisations to strengthen their information management protocols. For financial institutions, the FCA Handbook Chapter 5.1 provides industry-specific guidance regarding data security. |
|
In the EU, the European Union Agency for Cybersecurity provides a repository of best practices and controls for the EU Cyber Security Incident Response Teams network to help manage the responsible reporting, coordination, and remediation of cybersecurity vulnerabilities. Country-specific resources are also available:
|
Cyber Reporting and Disclosure Obligations
Cybersecurity reporting obligations are a regulatory priority across the U.S., UK, and EU, with increasing regulatory expectations for transparency, resilience, and board-level accountability. Reporting requirements are increasingly stringent, often requiring rapid notification of significant cyber events to national authorities, sector regulators, and, in some cases, affected stakeholders. Sector-specific and product-level responsibilities are also expanding, particularly in financial services and digital product manufacturing, where organisations must report vulnerabilities and operational disruptions. Boards should remain informed about these evolving disclosure and reporting requirements and proactively ensure that their organisations are prepared to respond to developing reporting and disclosure obligations.
|
The SEC’s rule on Risk Management, Strategy, Governance and Incident Disclosure, which became effective in 2023, governs public disclosures related to material cybersecurity risks, material cybersecurity incidents, and cyber-risk governance. The National Association of Corporate Directors has produced guidance as to how directors can align oversight practices with the SEC’s expectations. They have also published a piece exploring how organisations can combine the use of regulatory guidance with AI-driven analysis to help comply with the SEC’s disclosure requirements. Our team provides a summary of the SEC’s rule and describes how companies should consider updating and revising their protocols in light of the rule. |
|
The ICO provides detailed guidance on how and when to report incidents, including under the Network and Information Systems (NIS) Regulations. Other UK regulators have also published guidance:
Financial institutions face additional obligations, including promptly notifying the Financial Conduct Authority (FCA) of significant cyber events (see Chapter 15 of the FCA Handbook). |
|
The EU continues to advance its cybersecurity framework, including incident-reporting obligations, through several legislative measures:
|
Cyber Trends
Most jurisdictions track the evolving cyber threat landscape through a combination of regulator data and industry research. In the U.S. and EU, these trends are centralised in databases. In the UK, annual surveys and regulator trends are published to help organisations understand and better protect against cyber risks. Whilst particularly useful for security and IT personnel, these resources also enable boards to gain a clear understanding of the cyber threat landscape and associated cyber risks.
|
The CISA Known Exploited Vulnerabilities Catalog is an authoritative, regularly updated list of security vulnerabilities that have been actively exploited in the wild, designed to help organisations prioritise remediation efforts and strengthen their cybersecurity posture. The Government Accountability Office has released a report detailing the types of incidents that the government encounters and the need to address those vulnerabilities. |
|
The ICO’s Data Security Incident Trends provide insight into the types and frequency of reported breaches, helping boards understand sector-specific risks. The NCSC’s Annual Cyber Security Breaches Survey offers a broader view of how UK organisations are managing cyber threats, including board-level engagement and investment trends. |
|
The European Vulnerability Database (EUVD) provides a real-time view of known vulnerabilities affecting European systems, offering boards a technical perspective on emerging risks. The 2024 ENISA Report on the State of Cybersecurity in the Union presents a comprehensive overview of threat trends, regulatory developments, and strategic priorities across member states – an essential resource for boards operating in or across the EU. The 2025 ENISA Threat Landscape Report analyses 4,875 cybersecurity incidents recorded between July 2024 and June 2025, highlighting the most significant threats and trends currently impacting the EU. |
Board Liability
As attempted cyberattacks and data breaches become a routine expectation rather than an anomaly in the corporate environment, boards may be exposed to potential liability arising from their actions before and after a cybersecurity incident. Board liability varies across the U.S., UK, and EU.
In the UK, for example, directors owe general duties to an organisation under the Companies Act which would apply when managing a cybersecurity incident. Directors must act in good faith, promote the success of an organisation, exercise independent judgment, and avoid conflicts of interest.
In the U.S., directors are bound by their fiduciary duties to act in the best interests of an organisation, place the interests of the organisation above their own, ensure the organisation has systems in place to monitor potential risks, and respond appropriately to any red flags indicating significant cyber risks. Accordingly, boards should be aware of their obligations to institute management training for cybersecurity incidents, oversee the execution of response protocols, and report on outcomes. Equally important, boards should recognise when failure to do so may result in director liability.
|
Our team reviews U.S. law to provide a synopsis of how boards can fulfil their role after a cyber breach. We also provide practical recommendations for boards responding to a cyber incident. In addition, we address how boards should approach cybersecurity regulations and response protocols in an article published by the Cybersecurity Law Report. |
|
In the UK, Sections 172 and 174 of the Companies Act govern boards’ duties, which apply to cyber risk and oversight. |
|
In the EU, the European Voice of Directors Association has published its Guide to Directors’ Duties and Liabilities, which offers a helpful overview of the scope of board obligations. Belgium has also published useful guidance in this area:
|
The importance of cybersecurity oversight for boards in the U.S., UK, and EU continues to grow. As cyber threats evolve and regulations tighten, boards must remain informed and be proactive in managing cyber risks. Leveraging resources from government agencies, industry bodies, and legal experts can enhance both the understanding and execution of cybersecurity responsibilities. Doing so helps ensure compliance and strengthens organisational resilience, making effective cybersecurity governance an essential component of corporate strategy and risk management in today’s digital environment.
Please note that all links included in this article are current as of the date of publication. Underlying resources should be verified on a case-by-case basis to ensure ongoing applicability of resources to your organisation. In addition, some resources may only be available in the local language in which they were published.
Ransomware Fusion Center
Stay ahead of evolving ransomware threats with Alston & Bird's Ransomware Fusion Center. Our Privacy, Cyber & Data Strategy Team offers comprehensive resources and expert guidance to help your organization prepare for and respond to ransomware incidents. Visit Alston & Bird's Ransomware Fusion Center to learn more and access our tools.
If you have any questions, or would like additional information, please contact one of the attorneys on our Privacy, Cyber & Data Strategy team.
You can subscribe to future advisories and other Alston & Bird publications by completing our publications subscription form.