One Risk, Many Entities: Board Oversight of Cyber Resilience Across a UK Group

Cyber risk is rarely confined to the legal entity in which it first appears. A shared email tenant, a group payroll provider or a common cloud platform can connect subsidiaries that otherwise operate at arm's length. Yet many UK groups still oversee cyber one entity at a time: each subsidiary reports its own risks, its own incidents and its own supplier arrangements to its own board. The parent board receives a collection of snapshots and mistakes that for a group view.

That is not a failure of diligence. It is a failure of design. Entity-level accountability matters, particularly where regulated subsidiaries, separate customer contracts or local management teams are involved. But board oversight should also aggregate. The practical question for directors in 2026 is not whether cyber is an IT matter. It is whether the group can see its shared exposures, escalate incidents quickly and evidence that it has tested its response.

Why entity-by-entity oversight leaves gaps

A subsidiary-level view can be perfectly adequate for local operations and still miss the risks that matter most at group level. Shared services create common points of failure. A ransomware event at a managed service provider may affect several entities at once. A data breach in one subsidiary may involve group systems, group customer records or a shared processor. A supplier outage may interrupt payroll, invoicing or regulatory reporting across the group.

Regulators, customers and insurers increasingly ask questions that cross legal boundaries. The UK GDPR requires appropriate technical and organisational measures, and personal data often flows between group companies. Sector regulators expect operational resilience. Insurers want to understand concentration and control. None of this removes the need for subsidiary accountability. It simply means the parent board needs a consolidated view and a common language for risk.

Start with one risk register, tagged by entity

A single group cyber risk register does not have to be a monolithic list. It should use a common taxonomy and scoring method, with each risk tagged to the entity or entities affected, the asset or service involved, the risk owner, the controls in place and the residual rating. Subsidiary risk leads contribute their local entries. The group chief information security officer or equivalent consolidates them and presents the top risks and concentrations to the board.

The register should include shared services, third-party dependencies and, where relevant, operational technology. It should also show where a risk is accepted at subsidiary level but has group-wide consequences. The board does not need to manage every entry. It needs to see the few that could affect multiple entities, critical services or the group's reputation, and it needs evidence that owners are treating them.

Design escalation that survives the first hour

Incident escalation is often described in policy language that collapses under pressure. A subsidiary is told to notify the group 'as soon as practicable'. In practice, nobody knows who to call, when, or what decision the group is expected to make. A better approach is to set clear thresholds. Examples might include suspected ransomware, a personal data breach above an agreed number of records, a critical supplier outage, or any event likely to require regulatory notification.

The group should publish named contacts, an out-of-hours route and a simple decision-rights map. The subsidiary should retain local incident leadership, because it knows its customers and operations. The group should provide coordination, legal advice, communications support, insurer notification and, where necessary, additional technical resource. The playbook should be tested, and the group should make clear that escalation is not an admission of failure. A blame-free route to the centre is more useful than a heroic attempt to contain a group issue locally.

Check supplier concentration at group level

Subsidiaries often procure separately. That can be appropriate for local needs, but it can also hide concentration. Several entities may rely on the same cloud provider, payroll bureau, managed service provider or payment platform without the parent board seeing the aggregate exposure. Directors should ask for a supplier concentration map showing the top critical suppliers by entity, contract renewal dates, data access, hosting location and exit options.

The map should distinguish between suppliers that are critical to one subsidiary and those that are critical to several. It should also show whether group-level assurances exist, or whether each subsidiary has negotiated its own terms. The board does not need to centralise every contract. It does need to know where a single failure could interrupt multiple businesses, and whether contingency plans are credible.

Run tabletop exercises across the group

A tabletop exercise is only useful if it includes the people who would actually make decisions. For a UK group, that means parent and subsidiary teams in the same room, whether physically or virtually. A realistic scenario might involve ransomware at a shared service provider, a data breach discovered in one subsidiary but affecting group systems, or a payroll outage in the week before payday. The exercise should test escalation, decision-making, communications, regulatory notification and restoration priorities.

Afterwards, the group should record what changed: which contact list was out of date, which decision took too long, which supplier assurance was missing, which subsidiary did not know its role. The board should receive a short after-action report and a schedule of actions. An exercise that produces a glossy deck but no changes is theatre. One that produces three uncomfortable fixes is assurance.

What directors should ask and document

Board oversight is strengthened by consistent questions. Directors should ask which cyber risks are shared across entities; who owns each top risk; what escalates to the group and when; which suppliers are concentrated; how quickly critical services could be restored; whether the group has tested its response with subsidiaries; what the last exercise changed; whether subsidiary boards receive consistent reporting; whether insurance cover matches the group's exposure; and what decisions the board has taken on risk appetite and treatment.

The answers should be documented in board minutes, not because paperwork is an end in itself, but because evidence matters. Minutes should record the top group risks reviewed, the assurance received, the actions agreed and the date of the next review. That record helps directors demonstrate oversight and helps management see whether the framework is working.

Assurance without centralising everything

A group-level framework does not require the parent to run every subsidiary's cyber programme. It requires common taxonomy, clear thresholds, consolidated reporting and tested escalation. Subsidiaries can retain local ownership, local regulatory relationships and local customer knowledge. The parent board's role is to set the frame, challenge the aggregate picture and ensure that shared risks are not lost between entities. In 2026, that is practical resilience rather than fear. It is also a more defensible way to govern a risk that has never respected an org chart.