Cyber assurance · Board governance
Cyber Governance Review for Boards: independent proof the board governs cyber risk
An independent review of how your board governs cyber risk, measured against the UK Cyber Governance Code of Practice: who owns the risk, what the board is told, what directors can evidence under Provision 29 and section 172, how the board would decide on its worst day, and what every certificate and audit covers. Written for chairs, audit committees and the people they answer to. Briefings from £4,500 + VAT, reviews from £12,500 + VAT.
The review at a glance
Definition
What is a cyber governance review?
A cyber governance review is an independent examination of how a board governs cyber risk: whether the risk has a named owner and a defined appetite, whether board reporting supports real decisions, whether directors can evidence their duties, whether the board could handle a serious incident, and whether the assurance the organisation buys covers what the board believes it covers.
The bar for boards has moved. The UK Cyber Governance Code of Practice, published by the government with the NCSC in April 2025, sets out what directors are expected to do across risk, strategy, people, incident planning, and assurance and oversight. Provision 29 of the UK Corporate Governance Code asks boards of premium listed companies to stand behind the effectiveness of their material controls in the annual report for financial years beginning on or after 1 January 2026. Directors’ duties under section 172 sit underneath all of it, and insurers and major customers now ask the same questions regulators do.
Most boards receive a technical answer to a governance question: a penetration test, a maturity score, a slide of green traffic lights. This review answers the question the board is accountable for. Where the gap is technical rather than governance shaped, the Independent Technology Audit covers it, the cyber assurance practice fixes it, and vSCARO runs it month by month. New to independent reviews? Start with our guide to what technology assurance is.
Governance in plain words
Board language throughout. No jargon survives the readout.
Measured against the Code
The UK Cyber Governance Code of Practice, area by area.
Tested by rehearsal
The board walks through an incident it has never faced.
Fixes with prices
Every finding costed and sequenced rather than observed.
The examination
Six things the review examines
Each card says what gets examined and what lands in front of the board. None of it requires a single technical scan.
Who owns the risk
Whether cyber risk has a named owner, a defined appetite and a working route to the board, or whether it lives wherever the last incident left it.
OutputA decision rights map with every gap named.What the board is told
The reporting the board receives, tested for whether it supports decisions or hides behind green traffic lights.
OutputA reporting verdict, with a better board pack specified.What directors are expected to know
The duties in play: the Cyber Governance Code of Practice, Provision 29 and section 172, mapped to what this board can currently evidence.
OutputA director question set with honest current answers.Incident decisions at board level
Who decides on ransom demands, disclosure, regulators and customers, tested by walking the board through a realistic incident.
OutputA verdict on board incident readiness.The assurance map
Certificates, audits and tests the organisation already buys, mapped to what each one covers and where the board relies on nothing.
OutputAn assurance map showing coverage and the bare patches.The Code area by area
Governance measured against the UK Cyber Governance Code of Practice: risk, strategy, people, incident planning, assurance and oversight.
OutputA Code map an investor, insurer or regulator can read.How it works
What happens in the review
Five stages from the chair’s question to the board readout. The full review typically runs two to four weeks around board and committee diaries.
Scope with the chair
The question agreed with the chair, audit committee chair or senior independent director: what prompted the review and who needs to rely on it.
Read the evidence
Board packs, minutes, risk registers, policies and existing assurance reports read at source, before anyone is interviewed.
Test the governance
Directors and executives interviewed, reporting traced from the technical teams to the boardroom, and the board walked through an incident it has never rehearsed.
Validate the findings
Findings validated with management and the chair before anything is written, so the report lands as recognition rather than ambush.
The board readout
The report presented at the board or audit committee: verdicts, evidence and a sequenced fix plan with prices. Yours to act on, with anyone.
Governance fades between reviews: reporting slips, owners move on and the incident plan goes stale. vSCARO keeps the security and assurance function running month by month from £7,500 + VAT, with board reporting built in.
Published fees
The reviews and what they cost
Every engagement has a published floor and a defined output. They stand alone or combine into the board assurance programme.
Board cyber governance briefing
A half day with the board: the duties now in play, the questions directors should be asking and what good governance looks like at board level.Best whenThe board has never had cyber explained in its own language. FeeFrom £4,500 + VAThalf day 02
Board incident exercise
A realistic cyber incident walked through at board level: ransom, disclosure, regulators and customers, with the decision gaps recorded.Best whenThe board has never rehearsed the worst day it could plausibly have. FeeFrom £7,500 + VAT2 to 3 weeks 03
Cyber governance review
The full review: ownership, reporting, duties, incident readiness and the assurance map, measured against the Cyber Governance Code of Practice.Best whenThe audit committee asked whether the board governs cyber risk. FeeFrom £12,500 + VAT2 to 4 weeks 04
Board assurance programme
The review, the incident exercise and a rebuilt board reporting pack, run as one engagement.Best whenA controls declaration, an investor or an insurer needs the full picture with evidence. FeeFrom £18,000 + VAT4 to 8 weeks
The alternatives
How the review compares with what boards usually get
Three answers boards receive to the same question. The difference is which question each one answers.
Whether specific systems could be broken into that week
Engineers, in the language of engineers
A clean test says nothing about governance
Days of testing, findings without owners
What the security team chose to show the board
A twenty minute agenda slot
The board marks the homework of the people presenting it
Free, and shaped by the people it reports on
Whether the board governs cyber risk, measured against the Code
Chairs, audit committees and the people they answer to
Where Intelance runs your security function, the review goes to another firm
2 to 4 weeks, from £12,500 + VAT, fixed in writing
Scope
Exactly what the fee covers
You get
A decision rights map naming who owns cyber risk, with every gap identified.
A board reporting verdict and a specification for the pack the board should be receiving.
A director question set mapped to the Code, Provision 29 and section 172, with honest current answers.
An assurance map showing what every certificate, audit and test covers.
A board readout with every fix costed and sequenced, presented in person.
This is not
A penetration test. Nothing is scanned and nothing is attacked. The board is examined, and never the servers.
A certification. The review maps to the Code and the ladder that follows it, and accredited bodies certify separately.
A blame exercise. Findings are validated with management before the board sees them, and fixes matter more than fault.
A self-review. Where Intelance runs your security function through vSCARO, the review goes to another firm and we say so.
Where to start
The calls we usually get
Four situations we are usually called into. If none of them fit, speak to us and we will point you at the right first step.
Why Intelance
The rules this work runs under
Board language throughout
Every document is written for directors. Technical detail sits in appendices for the teams who need it, and never in the readout.
Measured against the Code
The UK Cyber Governance Code of Practice gives the review its spine, so the verdict maps to what government, insurers and investors already expect.
Tested rather than surveyed
Reporting is traced end to end and the board rehearses a real incident. Questionnaires alone flatter everyone involved.
If we run it, we do not review it
Where Intelance operates your security function, the review goes to another firm and we say so. Independence is the product.
Starting fees and what fixes them
From £4,500 + VAT for the briefing and from £12,500 + VAT for the review, fixed in writing before work starts.
Who carries out the work
Reviews are led by a senior partner who has sat on both sides of the board table, delivered with senior reviewers who run security and assurance functions for clients every month, with established associates across cyber, AI and data governance where depth is needed.
Assurance guides
All insights
Technology AssuranceWhat is technology assurance? Independent reviews explained
Boards run on assurances, and most of what reaches them is assertion. What technology assurance is, how it differs from consulting and internal audit, when it gets called, and what independent reviews cost in the UK.
9 July 2026 · 6 min read Read the guide
AI GovernanceWhat is AI governance? The seven questions boards should ask
9 July 2026 · 9 min read
Cyber EssentialsCyber Essentials vs ISO 27001 vs IASME Cyber Assurance: which do you need?
9 July 2026 · 6 min read
Cyber EssentialsCyber Essentials vs ISO 27001: when you need one, both, and in what order
23 March 2026 · 10 min readReady to talk?
Tell us what the board has been asked
Thirty minutes with a senior reviewer: what prompted the question, what the board currently receives and who needs to rely on the answer. If a briefing would serve the board better than a review, we will say so in the call.
FAQs
Questions about the governance review
What is a cyber governance review?
An independent examination of how a board governs cyber risk: whether the risk has a named owner and a defined appetite, whether board reporting supports real decisions, whether directors can evidence their duties, whether the board could handle a serious incident, and whether the assurance the organisation buys covers what the board believes it covers.
Is this a penetration test or technical assessment?
No. Nothing is scanned and nothing is attacked. The review examines governance: ownership, reporting, duties, incident decision making and the assurance map. Where the findings point at technical gaps, the Independent Technology Audit and the wider cyber assurance practice take over.
What is the UK Cyber Governance Code of Practice?
A code published by the government with the NCSC in April 2025 setting out what boards and directors are expected to do about cyber risk across five areas: risk management, strategy, people, incident planning and response, and assurance and oversight. The Intelance review measures your governance against it, area by area.
What does Provision 29 require of boards?
Provision 29 of the UK Corporate Governance Code asks boards of premium listed companies to monitor the risk management and internal control framework and, for financial years beginning on or after 1 January 2026, to declare in the annual report whether their material controls are effective. Cyber controls sit squarely inside that declaration, and the review shows what the board can currently evidence.
What does a cyber governance review cost in the UK?
With Intelance, the board briefing runs from £4,500 + VAT for a half day, the board incident exercise from £7,500 + VAT, the full cyber governance review from £12,500 + VAT, and the board assurance programme from £18,000 + VAT. Every fee is a published floor, fixed in writing before work starts.
Who is interviewed during the review?
The chair or sponsoring committee chair, a selection of directors, and the executives who own or report on cyber risk. The interviews test how governance works in practice, and the papers are read at source before anyone is asked a question.
Does the board need technical knowledge to benefit?
No, and the review never assumes it. Everything is written and presented in board language, and one of its outputs is a question set directors can use in every future cyber discussion without needing a technical background.
What happens after the review?
The fixes are yours to act on with any provider. Where you want the governance run rather than just repaired, vSCARO operates the security and assurance function month by month from £7,500 + VAT with board reporting built in, and the review can be repeated when the board wants fresh evidence.