Who is asking? What UK regulators expect of your board on cyber

Summary

Who this is for. Chairs, non-executive directors, chief executives and chief operating officers of UK firms of up to 2,000 people in financial services, legal and professional services, usually without a full-time chief information security officer (CISO). This is CyberCQR's summary of public rules and guidance, not legal advice.

Every firm: the same three questions

Most of the duties that touch a board's cyber oversight apply whatever your sector.

Data protection law. Under the UK General Data Protection Regulation (UK GDPR), every firm that holds personal data must take "appropriate technical and organisational measures" to keep it secure. The ICO expects a risk assessment, a security policy, someone with day-to-day responsibility, the ability to restore data in good time after an incident, and regular testing of whether the controls work [5]. A personal data breach must be reported to the ICO within 72 hours of becoming aware of it, unless it is unlikely to put people at risk. Every breach must be recorded, reported or not, and a decision not to report must be justified [1].

The Cyber Governance Code of Practice. Published by the government and the National Cyber Security Centre (NCSC) in April 2025, the Code is aimed at the boards of medium and large organisations [2]. It is guidance, not law, but it is the clearest statement of what "good" looks like for a board. Two of its actions do most of the work. Action A3 asks the board to define and communicate its cyber risk appetite. Action E2 asks it to require formal reporting at least every quarter, with agreed measures and tolerances [2]. Action D3 asks the board to take ownership of regulatory reporting during an incident [2].

What is coming for your IT provider. The Cyber Security and Resilience Bill would bring managed service providers into regulation for the first time, unless they are small or micro businesses. They would have to manage security risks, register with the Information Commission (the ICO's new name), and report significant incidents [6]. The government's factsheet says they would send an initial notice within 24 hours and a fuller report within 72 hours, and would have to tell customers who were likely to be affected [7]. At the time of writing, the Bill has finished report stage in the House of Lords, with third reading set for 2 November 2026. It then returns to the House of Commons to consider the Lords' changes [4]. Most of the detail will follow in secondary legislation after Royal Assent [6].

Sector by sector

Table 1. A summary. Our Good Practice Guide adds what is recommended and the evidence a board should be able to show.

FCA-regulated firms

Many firms of this size, such as financial advisers and wealth managers, are outside the detailed operational resilience rules. The FCA's own review lists the firms in scope, including enhanced-scope firms under the Senior Managers and Certification Regime (SM&CR), payment institutions and e-money institutions [9]. Firms outside them must still meet their existing duties [10]. In its 2026 review, the FCA criticised unclear board engagement and approval trails, and self-assessments claiming recovery from any scenario without testing severe enough to support the claim [9]. That is a board evidence problem, not a technology one. The new incident reporting rules are covered in our briefing The 24-hour question. The European Union's Digital Operational Resilience Act (DORA) matters only if your group has a regulated business in the European Union [15].

Law firms

The SRA does not prescribe controls. It expects each firm to identify its own threats and respond to them [16]. It does say plainly that a cyber attack affecting your firm or its clients should be reported to it promptly, and that a serious breach of its standards must be [17]. Its client money warning notice is the sharpest edge: where money goes missing, including through theft or a cyber attack, the managers must replace it, from their own resources if need be [12]. In its cybercrime risk outlook, the SRA found email was involved in 83% of the cyber crimes reported to it in 2021 [18]. Payment diversion is a board issue for a law firm because the partners carry the loss.

Accountancy practices

Here the honest answer is that expectations are mostly guidance. ICAEW reminded firms in July 2026 that the duty of confidentiality applies inside the firm as well as outside it [19]. Its 2026 practice assurance report recommends that firms put in place procedures to reduce cyber risk, check suppliers, test incident response, train staff, and verify any change to payment details by phone [14]. None of that is a new rule, but a practice that ignores it will find it hard to argue it took reasonable care.

What this means in practice

Read side by side, the regimes ask a board for the same five things: a named owner, a stated appetite, regular reporting, a tested incident plan with a clear reporting decision, and control over suppliers. None needs a new product. Most firms already own security controls in Microsoft 365 that they have not switched on, and a regulator will be more interested in evidence that existing controls work than in a list of tools bought.

No exemptions at the top

One pattern undermines all of this. Management often spares directors and partners the controls everyone else lives with: multi-factor authentication, lockouts, time-outs and monitoring. That is backwards. The people who control the money, the data and the approvals are the accounts most worth stealing, so they need the most protection, not the least. The usual objection is that security gets in the way. Today, that is no longer true. The National Cyber Security Centre (NCSC) now says passwords on their own are no longer resilient enough, and recommends passkeys, which let people sign in with a fingerprint, face or device PIN [20]. Its testing found passkeys at least as secure as the strongest password with a second step, and faster to use [20]. It has long advised against forced complexity rules and regular password changes, because they push people towards predictable patterns [21]. Complexity is the enemy of security. The simpler sign-in is now the stronger one, so there is no reason for any director to be exempt.

Every regime in this briefing says the same thing in its own words. Under UK GDPR, you remain responsible for what your processors do with personal data [5]. The FCA's outsourcing rules say a firm that outsources important functions stays fully responsible for its regulatory obligations, and its senior people cannot hand that responsibility to the supplier [22]. The FCA's incident guidance makes an incident that starts at a supplier the firm's to report [23]. The Cyber Security and Resilience Bill would regulate larger IT providers, but its duties sit with the provider and change nothing about yours [6].

That matters most for firms with outsourced IT. When the same company runs your systems and monitors them, its internal checks, escalation and service-level reviews can add days before you hear about a problem. Every reporting clock in this briefing starts with your firm knowing. The Bill would put duties on larger providers, but it would not make them your eyes. Alerts above an agreed severity should reach a named person at your firm at the same time they reach the provider.

What we see in practice

We have taken local authorities, law firms and financial firms, all with fewer than 1,000 users, through PCI DSS, the Public Services Network Code of Connection and other regimes. At board level the same attitude came up every time: "we delegate it, we outsource it, so it is not our problem." The people signing the compliance statements rarely understood that their signature made them answerable for what it said. Often the management team or the outsourcing provider had shaped what the board heard, and the picture was better than the truth. Whether by habit or by design, the people filtering the message were not the ones who would be held to account. In several firms the board had also been spared basic controls such as multi-factor authentication, lockouts and time-outs. At finance and law firms we have heard "do you know who I am?" more than once. Our answer: yes, and that is exactly why you will be targeted.

Five questions for your next board meeting

1. Which regulators and codes apply to us, and who on the board owns each one?
2. Have we written down our cyber risk appetite, and when did the board last see it?
3. Do we get cyber reporting at least every quarter, with measures and agreed tolerances?
4. If our IT provider found a serious incident tonight, when would we know, and who decides which regulator we tell?
5. What evidence could we show a regulator tomorrow that our controls work, not just that we own them?

Conclusion

Regulators rarely say how to secure a firm. They say what a well-run firm can show. For a board of a regulated firm of up to 2,000 people, that comes down to ownership, appetite, reporting, rehearsal and suppliers. Get those in writing, test them once a year, and the sector-specific rules become much easier to meet.

Glossary

Table 2. Terms used on this page (alphabetical).

Further reading

From CyberCQR

• Regulator-ready boards: ten cyber actions for any UK sector
• What UK regulators expect of boards on cyber: a sector guide
• The 24-hour question: are you ready to tell the FCA?
• All green, still exposed: what your board's cyber report is not telling you
• Document library: every paper and tool in one table

External

• Cyber Governance Code of Practice [2]

References

1. [1]Information Commissioner's Office, Personal data breaches: a guide, updated 20 August 2025.
   https://ico.org.uk/for-organisations/guide-to-dp/guide-to-the-uk-gdpr/personal-data-breaches
2. [2]Department for Science, Innovation and Technology and National Cyber Security Centre, Cyber Governance Code of Practice, 8 April 2025.
   https://www.gov.uk/government/publications/cyber-governance-code-of-practice/cyber-governance-code-of-practice
3. [3]Financial Conduct Authority, PS26/2: Operational incident and third party reporting, March 2026.
   https://www.fca.org.uk/publications/policy-statements/ps26-2-operational-incident-third-party-reporting
4. [4]UK Parliament, Cyber Security and Resilience (Network and Information Systems) Bill: bill page and stages, checked 30 October 2026 (House of Lords third reading set for 2 November 2026).
   https://bills.parliament.uk/bills/4035
5. [5]Information Commissioner's Office, A guide to data security, UK GDPR guidance.
   https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/a-guide-to-data-security/
6. [6]Department for Science, Innovation and Technology, Cyber Security and Resilience Bill factsheet: relevant managed service providers, factsheets collection updated 30 June 2026.
   https://www.gov.uk/government/publications/cyber-security-and-resilience-network-and-information-systems-bill-factsheets/relevant-managed-service-providers
7. [7]Department for Science, Innovation and Technology, Cyber Security and Resilience Bill factsheet: incident reporting, updated 30 June 2026.
   https://www.gov.uk/government/publications/cyber-security-and-resilience-network-and-information-systems-bill-factsheets/incident-reporting
8. [8]Financial Conduct Authority, FCA Handbook, PRIN 2.1: The Principles.
   https://handbook.fca.org.uk/handbook/PRIN/2/1.html
9. [9]Financial Conduct Authority, Operational resilience: insights and observations one year on, 27 March 2026.
   https://www.fca.org.uk/publications/good-and-poor-practice/operational-resilience-insights-observations-one-year
10. [10]Financial Conduct Authority, PS21/3: Building operational resilience, March 2021.
    https://www.fca.org.uk/publication/policy/ps21-3-operational-resilience.pdf
11. [11]Solicitors Regulation Authority, Code of Conduct for Firms.
    https://www.sra.org.uk/solicitors/standards-regulations/code-conduct-firms/
12. [12]Solicitors Regulation Authority, Warning notice: money missing from client account.
    https://www.sra.org.uk/solicitors/guidance/money-missing-client-account/
13. [13]ICAEW, Overview of the ICAEW Code of Ethics: the fundamental principles.
    https://icaew.com/-/media/corporate/files/technical/ethics/overview-icaew-codeof-ethics-dl.ashx
14. [14]ICAEW, Practice Assurance Monitoring Report 2026, 2026.
    https://www.icaew.com/-/media/corporate/files/regulations/practice-assurance/practice-assurance-monitoring-report-2026.ashx
15. [15]European Union, Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA), 14 December 2022, applying from 17 January 2025.
    https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng
16. [16]Solicitors Regulation Authority, The impact of cybercrime, December 2023.
    https://www.sra.org.uk/solicitors/resources/cybercrime/cybercrime/
17. [17]Solicitors Regulation Authority, SRA Update 123: Reporting cybercrime incidents, 11 January 2024.
    https://www.sra.org.uk/news/news/sra-update-123-cybercrime/
18. [18]Solicitors Regulation Authority, Risk Outlook report: information security and cybercrime, 1 June 2022.
    https://www.sra.org.uk/sra/research-publications/risk-outlook-report-information-security-cybercrime/
19. [19]ICAEW, Protecting client confidentiality, regulatory news, July 2026.
    https://www.icaew.com/regulation/regulatory-news/regulatory-news-2026-07/protecting-client-confidentiality
20. [20]National Cyber Security Centre, NCSC: Leave passwords in the past, passkeys are the future, 23 April 2026.
    https://www.ncsc.gov.uk/news/ncsc-leave-passwords-in-the-past-passkeys-are-the-future
21. [21]National Cyber Security Centre, Password administration for system owners: updating your approach.
    https://www.ncsc.gov.uk/collection/passwords/updating-your-approach
22. [22]Financial Conduct Authority, FCA Handbook, SYSC 8.1: General outsourcing requirements.
    https://www.handbook.fca.org.uk/handbook/SYSC/8/1.html
23. [23]Financial Conduct Authority, FG26/3: Operational incident reporting, finalised guidance, March 2026.
    https://www.fca.org.uk/publication/finalised-guidance/fg26-3.pdf