Why This Is Now a Board Issue

The UK Corporate Governance Code, the Companies Act 2006, and upcoming legislation including the Cyber Security and Resilience Bill are making cyber governance an explicit board responsibility. Directors who cannot demonstrate they understood and governed cyber risk face personal liability.

This is not about understanding firewalls or endpoint detection. It is about three questions every director must be able to answer:

1. What are our most critical digital assets, and how are they protected?
2. If we suffered a major cyber incident tomorrow, can we recover?
3. What evidence exists that we have exercised appropriate governance?

The Governance Gap

Most boards receive quarterly security reports that focus on prevention: how many threats were blocked, how many vulnerabilities were patched, how many employees completed awareness training. Prevention metrics are important, but they answer the wrong question.

The question boards should be asking is not "how well are we preventing attacks?" but "what happens when prevention fails?" Because prevention will fail. The NCSC, the ICO, and every credible security authority acknowledges this. The measure of an organisation's cyber maturity is not whether it can prevent every attack, but whether it can recover from one.

What "Appropriate Measures" Means for Directors

UK GDPR Article 32 requires "appropriate technical and organisational measures" for data protection. The standard is proportionality: measures should be appropriate to the risk. For an organisation's most critical assets, physical controls represent the highest standard of appropriateness.

Physical controls are:

• Demonstrable. Unlike software configurations that require technical expertise to verify, physical disconnection is self-evident.
• Tamper-evident. Physical access logs provide audit trails that software logs cannot match for integrity.
• Comprehensible. Directors can understand and explain physical controls to regulators, insurers, and shareholders without technical translation.

The Five Things Every Board Should Govern

1. The Crown Jewels Register

A documented list of the organisation's most critical digital assets, with clear ownership and protection standards for each. The board should review this annually.

2. Recovery Capability

Evidence that the organisation can recover from a major cyber incident without depending on systems that might themselves be compromised. This includes offline storage of recovery credentials and procedures.

3. Incident Response Readiness

A practised incident response capability, tested at least annually, with documented results reported to the board. Tabletop exercises should include scenarios where primary systems are unavailable.

4. Regulatory Compliance Posture

Demonstrable compliance with applicable regulations, with evidence that goes beyond checkbox compliance to reflect genuine governance commitment.

5. Insurance Alignment

Confirmation that cyber insurance coverage aligns with actual risk exposure, and that policy conditions (including security requirements) are being met.

How OSS Supports Board Governance

Offline secure storage directly addresses the governance requirements that boards face:

• Evidence of appropriate measures: Physical controls for the organisation's most critical assets demonstrate proportionate protection.
• Recovery assurance: Physically disconnected recovery credentials provide the certainty that recovery is possible regardless of attack sophistication.
• Audit trail integrity: Tamper-evident access logs provide the governance evidence that regulators and insurers expect.
• Director accountability: Documented physical controls demonstrate that directors exercised reasonable care in governing cyber risk.

Questions Directors Should Ask

1. Where are our recovery credentials stored? Could they be encrypted by the same attack we are trying to recover from?
2. Have we identified our crown jewels? Are they protected with measures proportionate to their value?
3. When did we last test our ability to recover from a major incident? What were the results?
4. What physical controls exist for our most critical data? Can we demonstrate these to a regulator?
5. Does our cyber insurance policy specifically require or reward physical security controls?

Conclusion

Cyber governance is no longer optional for directors. Physical controls through offline secure storage provide the demonstrable, comprehensible, and auditable governance that directors need to fulfil their responsibilities and protect both the organisation and themselves.