Pension scheme trustees should "double down" on cyber security efforts to ensure the protection of data, assets, and members, RSM UK partner, Stuart Leach, has said.

Leach's comments were made in response to a new Cyber Governance Code of Practice launched by the Department for Science, Innovation and Technology (DSIT), in partnership with the National Cyber Security Centre (NCSC).

The code outlines clear guidance for directors and board members to take greater ownership of cyber risks, and is designed to be senior leaders' first point of reference, forming part of the government's broader support for cyber governance.

While the code of practice is voluntary, Leach said he welcomed its objective of supporting boards and directors of medium and large businesses in governing their cyber risk and enhancing operational resilience.

"Pensions trustee boards are accountable for effective governance, cyber controls, resilience, and importantly, robust plans to respond effectively to cyber incidents," he said, encouraging trustees to up their cyber security efforts given this.

He stated: "Now is the time for pension trustees to double down on cyber security efforts to ensure the protection of data, assets, and members.

"With increasing geo-political tensions and highly sophisticated cyber criminals motivated by financial gain and destabilisation, the Government Communications Headquarters (GCHQ) has observed weekly attacks against British organisations and state agencies, and from our own observations of the threat landscape, we expect cyber-attacks to increase, with broader targeting across industries.

"Additionally, the cyber governance code of practice states that 50 per cent of businesses and 66 per cent of high-income charities experienced some form of cyber security breach or attack in the last 12 months, with the prevalence of attacks being even higher amongst medium businesses (70 per cent) and large businesses (74 per cent).

"This serves as a stark reminder that, for pension trustee boards, there's more to be done to improve cyber resilience and keep pace with emerging cyber risks and threats."

---