From the guide
Provision 29 and cyber risk: what NEDs need to ask
Provision 29 creates a useful boardroom moment: the declaration must be supported by judgement and evidence, not simply by the existence of policies or a reassuring dashboard. The full guide works through this in detail; here are the essentials.
The questions a board should ask
The board decides which controls are material — the FRC does not prescribe a list. That makes the quality of the board's judgement, and the evidence supporting it, central. The guide sets out nine evidence-led questions. The core of them:
- Which cyber risks could materially affect our strategy, important services, reporting or obligations — and how did management reach that judgement?
- What current evidence shows that the material controls are operating effectively, rather than merely designed or documented?
- What failures, near misses, overdue actions or recurring weaknesses have we seen, and what did they tell us?
- Which external organisations, technologies and hidden fourth parties underpin our most important services — and where could apparently separate suppliers fail together?
- Who is authorised to intervene, accept risk or stop an activity when time is short?
- Which recovery assumptions have been tested — and did the test demonstrate an acceptable outcome within our tolerances?
The evidence to request
Cyber does not become material because it appears on a risk register — it becomes material when failure could affect the organisation's ability to deliver, comply, report or retain trust. The guide offers five practical tests: service, obligation, impact, dependency and judgement. For the controls that pass those tests, ask for:
- Evidence of operating effectiveness, not only activity, status or policy compliance.
- Known weaknesses, near misses and overdue remediation, visible in the board's assessment.
- Important business outcomes mapped to the external dependencies that support them.
- Escalation thresholds and decision authority agreed before an incident occurs.
- Alternatives, failover and recovery assumptions tested under realistic conditions.
A practical scenario
A supplier is labelled critical, but its connection to important services is unclear. The dashboard is green, yet nobody can explain the evidence standard behind it.
A critical supplier is not automatically a critical dependency. The board needs to understand which important outcomes depend on that supplier, what else shares the same point of failure, and whether the proposed alternative is genuinely independent.
Buck's interpretation
A defensible board position is not a perfect-control claim. It is a proportionate, evidence-based judgement that acknowledges uncertainty and shows how the organisation responds to it. One well-evidenced uncertainty is more valuable than eight optimistic ticks.
The board's real question is often not whether it has enough information, but whether it can turn the information it already has into a defensible decision. Watch for three warning signs: a green dashboard nobody can explain, a "critical" supplier with an unclear connection to important services, and a response plan that begins after the useful intervention window has closed.
The sensible next step: use the guide's confidence check with the Chair, committee Chair, CISO and operational-risk lead. Select one important service and ask the team to demonstrate the controls, dependencies, warning signals, decision ownership and tested recovery assumptions supporting it.
The full guide includes the Provision 29 timeline, all nine questions, the five materiality tests and a five-minute board confidence check.
Download the full guide