Reporting under Provision 29 UK Corporate Governance Code: A focus on cyber

As companies prepare for mandatory reporting in 2027 under Provision 29 of the UK Corporate Governance Code (which applies to financial years beginning on or after 1 January 2026), the Financial Reporting Council (FRC) has published a timely new Provision 29 Mythbuster. The Mythbuster aims to assist companies with reporting on cyber security under Provision 29 (including in the context of the board’s “declaration of effectiveness” of the company’s material controls) and recognises that, for many companies, controls relating to cyber security are likely to be material controls.

Future risks: The Mythbuster provides a helpful reminder that the declaration of effectiveness is at the company’s balance sheet date and that there is no expectation that the declaration looks beyond that date. While acknowledging that point-in-time assurance does not imply enduring protection and the declaration of effectiveness cannot cover unknown future cyber security risks, the FRC echoes commentary from other regulators in expecting that companies consider reasonable changes in cyber risk when designing, monitoring, and reviewing their controls. 

Reporting on breaches: Provision 29 does not introduce a new cyber incident or breach reporting obligation: the emphasis, and reporting obligation, is instead focused on whether the incident or breach indicates that a material control did not operate effectively as at the balance sheet date.  Nevertheless, in practice, any investigation by other regulators – e.g., into the adequacy of ‘organisational and technical measures’ by the Information Commissioner’s Office or ‘systems and controls’ by the Financial Conduct Authority – will look closely at how boards get comfortable from a Provision 29 perspective. Companies will need to be mindful of their record keeping (and preserving legal privilege where appropriate). 

Sensitivity of disclosures: In response to concerns from companies about disclosures relating to their cyber security giving away secrets to potential attackers, the Mythbuster helpfully confirms the FRC’s expectation that the declaration should be focused on the organisation’s assurance process and its outcome, rather than disclosing the specific technical controls used to prevent or mitigate the harm arising from an incident.

Wider expectations on companies and boards: Despite the reassuring tone overall, the Mythbuster reminds organisations and board members of the minimum standards organisations should have in place to manage cyber risk and directors’ responsibilities relating to cyber risk management, as set out in the Cyber Governance Code of Practice. 

It also reminds organisations of the government’s voluntary Cyber Resilience Pledge which was sent to many of the UK’s largest organisations last year. The pledge reinforces the expectation that cyber is a board-level responsibility but also calls on businesses to require the government’s minimum standard of cyber security (Cyber Essentials) to be met across its supply chain. Whilst encouraging and supporting cyber resilience through supply chains would be positive steps for strengthening organisational resilience, support for the pledge amongst organisations has been varied to date, particularly given the international complexity of many supply chains and the risk of potential challenges based on public statements that depend on third party suppliers' compliance.