Risks and Governance Basics
By the end of this module you will be able to:
- Categorise digital risks using a standard taxonomy covering cyber, data, operational, regulatory, and reputational risk
- Distinguish between IT governance, data governance, and digital governance, and explain the scope of each
- Explain the board's accountability for digital risk under the UK Corporate Governance Code and NIST CSF 2.0
British Airways Data Breach
A £20M fine and what it taught UK organisations about data governance
In September 2018, British Airways announced that attackers had stolen the personal and payment card details of approximately 500,000 customers. The breach was caused by a 22-line JavaScript injection into a third-party script loaded on the BA booking page. For roughly two weeks, every customer who completed a booking had their name, billing address, email address, and full payment card details - including CVV - sent directly to an attacker-controlled server.
The ICO's investigation found multiple governance failures. The third-party script was not subjected to adequate security review before being loaded on a payment page. The organisation lacked sufficient monitoring to detect the data exfiltration for 15 days. Security controls appropriate for a page handling payment card data had not been applied. The ICO concluded that BA had failed to process personal data in a manner that ensured appropriate security - a direct breach of the GDPR principle of integrity and confidentiality.
The ICO issued an intention to fine BA £183.4 million in 2019. The final penalty, issued in October 2020 after representations from BA citing the Covid-19 impact on the aviation sector, was reduced to £20 million - still the highest GDPR fine issued by the ICO at that time. The case established that organisations are responsible for the security of third-party scripts they load, that 15 days to detect an active data exfiltration is insufficient monitoring, and that GDPR's integrity and confidentiality principle applies to the technical controls around data in transit, not just data at rest.
What governance failures allowed the breach to occur, and what should organisations do differently?
With the learning outcomes established, this module begins by examining digital risk taxonomy in depth.
6.1 Digital risk taxonomy
Digital risk is the potential for loss, harm, or failure arising from the use of digital technologies, digital data, or digital processes. Organisations need a consistent vocabulary for digital risk before they can manage it. Without a shared taxonomy, risk registers become inconsistent and boards receive incomplete pictures.
Five categories cover the majority of digital risk in UK organisations. The Uber incident spans all five, which is why it is an instructive starting point.
Cyber risk encompasses unauthorised access, data breaches, ransomware, and denial-of-service events. In Uber's case: credentials stolen from a GitHub repository gave attackers access to an AWS environment holding 57 million records. The ICO reported 3,952 personal data breach notifications in the first half of 2023.
Data risk covers the handling, retention, and accuracy of data assets. Uber's 57 million affected records included driver licence numbers and personal contact details. The GDPR notification obligation that Uber violated existed precisely because regulators recognised data risk as distinct from cyber risk.
Operational risk covers process and people failures that affect digital services. Uber's concealment required its bug bounty programme to process a payment outside the programme's legitimate scope. That is an operational process failure.
Regulatory risk is the risk of non-compliance with laws and regulations. UK GDPR requires breach notification to the ICO within 72 hours of becoming aware. Uber failed to notify for 12 months. The GBP 385,000 fine was the direct regulatory risk materialising.
Reputational risk is the risk that an organisation's standing with users, partners, and regulators is damaged. The concealment decision compounded the breach's reputational damage: the story became "Uber covered up a breach" rather than "Uber suffered a breach." Both are damaging; the cover-up is harder to recover from.
The interactive risk matrix below shows common digital risks plotted by likelihood and impact. Hover over any dot to see the risk name and its primary mitigation.
Common misconception
“Governance is bureaucracy that slows digital delivery.”
Governance is what prevents the Uber and SolarWinds scenarios. The Uber concealment decision was made rapidly, with minimal process, and resulted in a regulatory fine, C-suite departures, and years of reputational damage. That decision was governance failure, not governance excess. Effective governance sets risk appetite, defines accountability, and establishes escalation routes so that a breach discovered at 11pm on a Friday is handled by a documented incident response plan, not by an improvised decision to pay attackers and stay silent.
Now you have a taxonomy for the five categories of digital risk, the next question is: which governance frameworks do UK organisations use to manage them? Section 6.2 compares the three most widely adopted frameworks and explains what each one is for.
6.2 Governance frameworks overview
Three frameworks are most widely adopted for digital and IT governance in UK organisations. Each addresses governance at a different level of detail and for a different audience.
COBIT 2019 (Control Objectives for Information and Related Technologies), published by ISACA, is the most thorough governance framework for enterprise IT. It organises governance and management objectives into two domains. The governance domain covers Evaluate, Direct, and Monitor (EDM). The management domains cover Align, Plan and Organise; Build, Acquire and Implement; Deliver, Service and Support; and Monitor, Evaluate and Assess. COBIT 2019 introduced design factors that allow organisations to tailor the framework to their size, regulatory environment, and risk profile.
ISO/IEC 38500:2024 provides high-level principles for corporate governance of information technology. ISO/IEC 38500 is intentionally brief and principles-based, written for boards and senior leaders rather than technical practitioners. Its six principles are:
- Responsibility: individuals and groups understand and accept their responsibilities
- Strategy: organisation's IT strategy aligns with business objectives
- Acquisition: IT acquisitions are made for valid reasons, on appropriate evidence
- Performance: IT is fit for purpose in supporting the organisation
- Conformance: IT complies with all mandatory legislation and regulations
- Human behaviour: IT policies and practices respect human behaviour
NIST Cybersecurity Framework 2.0, published in February 2024, added a sixth function specifically for governance. The framework now has six core functions:
- Govern - covers organisational context, risk management strategy, roles and responsibilities, policy, and oversight. New in CSF 2.0; places cybersecurity governance at board level.
- Identify - understand the assets, data, and risks that need managing.
- Protect - implement safeguards to limit or contain a cyber incident.
- Detect - identify the occurrence of a cyber incident in a timely way.
- Respond - take action regarding a detected cyber incident.
- Recover - maintain plans for resilience and restore capabilities after an incident.
Adding Govern as a first-class function signals that cybersecurity governance is a board-level responsibility, not a technical one. The NIST CSF 2.0 Govern function directly addresses the Uber scenario: had Uber's incident response plan included clear escalation and disclosure obligations, the concealment decision would have required overriding documented governance controls.
“Governance ensures that stakeholder needs, conditions and options are evaluated to determine balanced, agreed-on enterprise objectives; setting direction through prioritisation and decision-making; and monitoring performance and compliance against agreed-on direction and objectives.”
COBIT 2019 Framework: Governance and Management Objectives, ISACA - Section 2.1: Governance of Enterprise IT
COBIT's evaluate-direct-monitor model defines governance as a cycle. Boards evaluate options, set direction, and monitor outcomes. Management implements. The distinction matters because it places strategic accountability with the board and operational accountability with management. An incident response plan that reaches a board risk committee is governance working correctly. One that is resolved at operational level without board visibility is a governance gap.
COBIT, ISO/IEC 38500, and NIST CSF all use the word "governance" but refer to subtly different domains. Section 6.3 clarifies the distinction between IT governance, data governance, and digital governance - and explains why conflating them creates accountability gaps.
6.3 IT governance, data governance, and digital governance
Three concepts are frequently conflated. They overlap but are distinct disciplines, and treating them as interchangeable creates governance gaps.
IT governance covers how technology investment decisions are made, how IT resources are deployed, and how technology performance is assessed. COBIT 2019 and ISO/IEC 38500 are IT governance frameworks. IT governance was designed for an era when technology supported the business from behind the scenes: it managed back-office infrastructure that enabled business processes to run. One consequence of underinvesting in governance is accumulation of technical debt - systems that continue operating but become increasingly expensive and risky to maintain or change.
Data governance covers how data is defined, owned, classified, quality-assured, and controlled. It answers specific questions: who owns this dataset, what does this field mean, how long is this data retained, who can access it. The UK GDPR requires documented accountability for personal data processing. Data governance is the organisational structure that makes GDPR compliance possible, not just the legal obligation itself.
Digital governance is broader than either. It covers how digital products, services, and platforms are governed as business assets: their risk management, commercial terms, compliance obligations, and alignment with organisational strategy. A bank whose primary channel is mobile banking cannot rely on IT governance frameworks designed for back-office infrastructure. The Uber incident required digital governance at executive level because the decision involved data risk, regulatory risk, reputational risk, and a product decision (whether to continue operating normally after a breach). None of those decisions fit neatly into IT governance or data governance alone.
Common misconception
“Digital risk is only a concern for large organisations.”
UK SMEs (Small and Medium-sized Enterprises) are disproportionately targeted by cyber attackers because they typically have fewer controls and less mature governance than large enterprises. The NCSC (National Cyber Security Centre) Cyber Security Breaches Survey 2023 found that 32% of businesses and 24% of charities recalled a breach or attack in the preceding 12 months. For micro businesses (fewer than 10 employees), the figure was 18% - lower in absolute terms but with far less resilience capacity to absorb the consequences.
Distinguishing between IT, data, and digital governance clarifies who owns what. But who is ultimately accountable? Section 6.4 covers the UK Corporate Governance Code's requirements and what measurable risk appetite means in practice.
6.4 Board accountability for digital risk
The UK Corporate Governance Code, published by the Financial Reporting Council (FRC), places ultimate accountability for material risks with the board of directors. The 2024 edition of the Code strengthens board accountability for risk and resilience compared to its predecessor.
Boards of UK premium-listed companies face four specific obligations regarding digital risk. First, they must understand the organisation's principal digital dependencies: which systems, platforms, and third parties support important business services, and what the failure scenarios are. Second, they must satisfy themselves that controls are proportionate to the risk, not merely confirm that controls exist. Third, they must disclose material digital risks substantively in annual reports, not just name them. The FRC monitoring reports have repeatedly noted that risk disclosures are too generic to demonstrate genuine board engagement. Fourth, they must ensure sufficient digital expertise is accessible to the board to enable informed challenge.
Risk appetite for digital risk must be measurable to be actionable. An appetite statement reading "we have a low appetite for cyber risk" cannot be used to make an investment decision, set a control threshold, or determine whether a specific incident is within or outside tolerance. Measurable thresholds specify the parameters: maximum acceptable downtime per year (e.g., 99.9% availability = 8.7 hours annually), maximum acceptable data breach notification rate, maximum third-party concentration in any single cloud provider.
“The board should establish procedures to manage risk, oversee the internal control framework, and determine the nature and extent of the principal risks it is willing to take to achieve its long-term strategic objectives.”
UK Corporate Governance Code, Financial Reporting Council - Provision 28, 2018 edition (principles carried forward to 2024 edition)
Provision 28 requires boards to assess and manage principal risks and to report on procedures established for doing so. Digital risks qualify as principal risks for most UK-listed companies. The FRC has noted in monitoring reports that risk disclosures remain too generic. A disclosure that names cyber risk without describing likelihood assessment, the controls in place, and how effectiveness is monitored does not demonstrate that the board has fulfilled its responsibilities under this provision.
Boards set risk appetite for the organisation's own controls - but much of an organisation's digital exposure now lives in its supply chain. Section 6.5 covers third-party and supply chain risk, and what the SolarWinds compromise changed about how organisations approach vendor governance.
6.5 Third-party and supply chain risk
Third-party risk arises from digital dependencies on suppliers, cloud providers, and SaaS platforms. When an organisation's digital service depends on a third party's uptime, availability, and security posture, the third party's failures become the organisation's operational incidents. Poorly negotiated contracts can also create vendor lock-in, where switching providers becomes prohibitively expensive - concentrating both commercial and operational risk in a single supplier.
The SolarWinds compromise in late 2020 is the definitive supply chain risk case. Attackers compromised the build process for SolarWinds Orion, an IT monitoring tool used by approximately 18,000 organisations including US federal agencies and multiple FTSE 100 companies. A malicious update was digitally signed by SolarWinds, making it indistinguishable from a legitimate update. Organisations that had verified SolarWinds as a trusted supplier received a verified update that installed a backdoor.
SolarWinds illustrates why supply chain risk cannot be managed by vendor approval alone. A vendor that passed all due diligence checks in 2019 was compromised at the build level in 2020. The National Cyber Security Centre (NCSC) published Supply Chain Guidance specifically in response to SolarWinds, establishing a framework for assessing supplier security beyond initial approval.
“Corporate governance of IT is the system by which an organisation directs and controls the use of IT to achieve objectives and manage risk appropriately, in conformance with applicable law and regulation.”
ISO/IEC 38500:2024, Corporate Governance of Information Technology - Section 3.1: Definitions and governance principles
ISO/IEC 38500 is the only international standard specifically for corporate governance of IT. Its principles - responsibility, strategy, acquisition, performance, conformance, and human behaviour - apply directly to third-party and supply chain governance. The acquisition principle explicitly requires boards to satisfy themselves that technology acquisition decisions account for the long-term risk implications, not just the initial procurement cost.
A developer stores user passwords in plain text in the database to make login faster. Which GDPR principle does this most directly violate?
Your organisation uses a SaaS platform that stores all customer records in a proprietary format with no data export API. If you needed to switch provider, you could not retrieve your data without the vendor's cooperation. What risk category does this primarily represent?
A mobile app collects users' precise location data and stores it indefinitely, with a privacy notice that says location data may be used 'for future product improvements'. Which GDPR principles does this most likely breach?
Key takeaways
- The Uber breach in 2016 spanned all five digital risk categories: cyber, data, operational, regulatory, and reputational. The concealment decision was a governance failure, not a technical one.
- COBIT 2019 provides the most thorough IT governance framework. ISO/IEC 38500:2024 provides board-level principles. NIST CSF 2.0 added a dedicated Govern function in 2024, placing cybersecurity governance explicitly at board level.
- IT governance, data governance, and digital governance are distinct disciplines. Digital governance extends to product decisions, platform risk, and third-party dependencies in ways that traditional IT governance was not designed to address.
- The UK Corporate Governance Code places accountability for digital risk with the board. Risk appetite statements must be measurable: specifying maximum acceptable downtime, breach notification rate, and third-party concentration makes appetite actionable.
- Third-party and supply chain risk cannot be managed through initial vendor approval alone. The SolarWinds compromise in 2020 shows that post-approval continuous monitoring, SBOM review, and network segmentation are required.
Standards and sources cited in this module
ICO Penalty Notice: Uber BV and Uber London Ltd, 2018
Uber data breach: fine of GBP 385,000
Primary source for the Uber breach facts, the GBP 385,000 fine, and the concealment timeline described in the opening story and throughout the module.
COBIT 2019 Framework: Governance and Management Objectives, ISACA
Section 2.1: Governance of Enterprise IT; EDM domain
The primary IT governance framework described in Section 6.2. The evaluate-direct-monitor model and governance/management distinction are foundational concepts in the module.
ISO/IEC 38500:2024, Corporate Governance of Information Technology
Governance principles and the evaluate-direct-monitor model
The board-level IT governance standard quoted in Section 6.5. The acquisition principle is directly relevant to supply chain risk governance.
NIST Cybersecurity Framework 2.0 (February 2024)
Govern function: organisational context, risk management strategy, oversight
Cited in Section 6.2 for the addition of a dedicated governance function. The CSF 2.0 Govern function places cybersecurity governance at board level, not technical team level.
Provision 28: Principal risks and board accountability
The authoritative governance standard for UK-listed companies cited in Section 6.4. Places accountability for principal digital risks with the board and requires substantive risk disclosure.
NCSC Supply Chain Guidance, National Cyber Security Centre
12 principles of supply chain security
Published in direct response to the SolarWinds compromise. Cited in Section 6.5 as the NCSC framework for continuous third-party risk monitoring beyond initial approval.
The foundations are complete. You understand what digitalisation is, what drives it, what enables it, and what constrains it. Stage 2 moves into applied practice, starting with the data pipelines that power every digital operating model.
Module 6 of 15 in Foundations