CyberCQR Good Practice Guide · Regulation
What UK regulators expect of boards on cyber: a sector guide
A practical guide for leaders of UK firms of up to 2,000 people in financial services, law and accountancy: what each regulator requires of the board on cyber security, what is only recommended, who should own it, and the evidence a board should be able to produce on request.
Summary
Several bodies expect something of your board on cyber security. The Information Commissioner's Office (ICO) does for every firm that holds personal data. Your sector regulator does too: the Financial Conduct Authority (FCA), the Solicitors Regulation Authority (SRA) or a professional body such as ICAEW. The government's Cyber Governance Code of Practice sets out good practice for all boards. The Cyber Security and Resilience Bill, still before Parliament, would regulate many of the IT providers that firms of this size depend on.
None of these tells you which products to buy. They expect the board to know its risks, own them, check that controls work, and report quickly when something goes wrong. One principle runs through every regime: a firm can outsource a service, but never the responsibility or the accountability for it. This guide sets out the duties sector by sector, separates rules from guidance, and ends with a table and a checklist a board can use.
How to use this guide. Sections 1 to 3 apply to every firm. Sections 4, 5 and 6 cover FCA-regulated firms, law firms and accountancy practices. Section 7 is the sector-by-sector table. Section 8 puts the reporting clocks side by side, and section 9 is an evidence checklist. The argument for boards is in our briefing Who is asking?, and the steps are in our Top 10 Actions. Facts were checked on 30 October 2026. This is CyberCQR's guidance, not legal advice.
1. Every firm: data protection
If your firm holds personal data about clients or staff, the UK General Data Protection Regulation (UK GDPR) applies. Its security duty is the one cyber rule that reaches every firm in this guide.
Security
The law asks for "appropriate technical and organisational measures", matched to the risk to the people whose data you hold [1]. The ICO's guidance turns that into practical expectations [1]:
- start with a risk assessment of the data you hold and the harm a breach could cause;
- have a security policy, and someone with day-to-day responsibility and the authority to act;
- protect confidentiality, integrity and availability, and be able to restore data in good time after an incident;
- test, assess and evaluate your measures regularly, and act on the results;
- choose processors that give sufficient guarantees, and bind them by contract.
The ICO calls Cyber Essentials a sensible starting point for basic controls, but only a baseline [1]. The ICO's guidance does not set a specific duty for the board. Its example has a chief executive giving a director the task and asking for regular reports to the board [1].
Breach reporting
A personal data breach must be reported to the ICO without undue delay, and within 72 hours of becoming aware of it, unless it is unlikely to put people's rights and freedoms at risk. Where the risk to people is high, they must be told directly. Every breach must be recorded, whether or not it is reported, and a decision not to report must be justified. A processor must tell you about a breach without undue delay [2]. The ICO can fine a firm that fails to report a notifiable breach up to £8.7 million or 2% of global turnover [2].
2. Every firm: the Cyber Governance Code of Practice
The government and the National Cyber Security Centre (NCSC) published the Cyber Governance Code of Practice on 8 April 2025 [3]. It is written for the boards and directors of medium and large organisations, and invites smaller ones to follow its principles. It is guidance: there is no penalty for ignoring it. But it is the plainest statement of what a well-governed board does about cyber, and it is a fair yardstick for a regulator, an insurer or a client to measure you against.
It has five principles: risk management, strategy, people, incident planning and response, and assurance and oversight. The actions that matter most for this guide are [3]:
- A2: assign senior ownership of cyber risk.
- A3: define and communicate the cyber risk appetite, with a plan to stay within it.
- A4: check supplier security in proportion to risk.
- D2: exercise the incident plan at least once a year.
- D3: own regulatory reporting during an incident.
- E1: set clear cyber roles, at executive and non-executive level.
- E2: require formal reporting at least quarterly, with measures and agreed tolerances.
- E5: make sure senior executives understand the firm's regulatory duties.
Directors' own accounts
Action C3 asks directors to take personal responsibility for the data and digital assets they use [3]. In our experience, the most common failure is the opposite: management exempts the board from multi-factor authentication, lockouts, inactivity time-outs or monitoring, to save senior people inconvenience. Those accounts control payments, client data and approvals, so they are the ones attackers want. They should carry the strongest controls in the firm.
Stronger no longer means harder. The NCSC has advised for years against forced complexity rules and regular password changes, which push people towards predictable patterns [4]. In April 2026 it went further, saying passwords alone are no longer resilient enough and recommending passkeys wherever available [5]. A passkey signs a person in with a fingerprint, face or device PIN, cannot be phished like a password, and in the NCSC's testing was at least as secure as the strongest password with a second step [5]. Cyber Essentials counts passkeys as multi-factor authentication [6]. Simpler sign-in for the board is now the stronger choice.
The NCSC's Cyber Security Toolkit for Boards supports the Code with free material for directors [7]. For what a quarterly report should look like, see our board reporting guide.
3. Coming: the Cyber Security and Resilience Bill and your IT provider
The Cyber Security and Resilience (Network and Information Systems) Bill would widen the UK's rules for essential services and their suppliers. For most firms reading this, the part that matters is managed service providers.
Where it stands
At the time of writing, the Bill has passed the House of Commons and completed report stage in the House of Lords. Third reading in the Lords is set for 2 November 2026. The Commons must then consider the Lords' amendments before Royal Assent [8]. Most of the detail, including security requirements and incident thresholds, will be set by secondary legislation after consultation, so no start date has been given [9].
What it would mean for managed service providers
Under the government's factsheets, a "relevant managed service provider" is one that gives ongoing management of a customer's IT by connecting to or accessing its systems, and is not a small or micro business [9]. Such providers would have to [9] [10]:
- register with the Information Commission (the ICO's new name);
- take appropriate and proportionate security measures;
- send an initial notice of a significant incident within 24 hours, and a fuller report within 72 hours;
- tell customers who were likely to be harmed.
The government's stated reason is that providers have wide access to client systems, so one compromise can reach many customers [9].
What it does not change
The Bill places duties on the provider, not on your firm, and its significance tests are about impact in the UK as a whole, not about your firm [10]. An incident that matters greatly to you may never meet them. Nor does the duty to tell customers settle how quickly you hear. Your own reporting clocks, set out in section 8, still start when your firm knows. A regulated provider is a better provider. It is not a substitute for your own line of sight. You can outsource the service, but never the responsibility or the accountability.
4. FCA-regulated firms
Duties for every FCA firm
The Principles for Businesses apply to all FCA-regulated firms. Principle 3 requires a firm to organise and control its affairs responsibly, with adequate risk management systems. Principle 11 requires it to be open with the FCA [11]. For cyber, that means the board must be able to show it understood and managed the risk, and told the FCA what it would expect to know.
Outsourcing does not move responsibility
The FCA's outsourcing rules are explicit. A firm that outsources important operational functions stays fully responsible for its regulatory obligations, its senior people must not delegate their responsibility to the supplier, and the outsourcing must not weaken the firm's internal controls or the FCA's ability to supervise it [12]. For a firm whose IT, monitoring and key software are all run by others, the board's job is to oversee those suppliers, not to assume they have it covered.
Operational resilience, for firms in scope
The operational resilience rules, in chapter 15A of the Senior Management Arrangements, Systems and Controls sourcebook (SYSC 15A), apply only to some firms. The FCA lists them as banks, building societies, designated investment firms, enhanced-scope firms under the Senior Managers and Certification Regime (SM&CR), Solvency II insurers, recognised investment exchanges, e-money and payment institutions, registered account information service providers and consolidated tape providers [13]. Unless they are enhanced-scope, payment or e-money firms, financial advisers, wealth managers and brokers fall outside them. The FCA says firms outside the rules must still meet their existing duties [14], and its 2026 review says they may still learn from it [13].
Firms in scope must [13]:
- identify their important business services and set an impact tolerance for each;
- map the people, processes, technology, facilities, information and suppliers behind each service;
- test their ability to stay within tolerance under severe but plausible scenarios;
- fix the weaknesses that mapping and testing reveal;
- have communication plans for disruption;
- keep a self-assessment, which the board must review and approve.
The transition period ended on 31 March 2025, and firms must now assess each year whether they can stay within tolerance [13].
The senior manager responsible
In its policy statement the FCA pointed SM&CR firms to the Chief Operations Function (SMF24) as the natural home for operational resilience. Where a firm has no SMF24, it should identify the most appropriate senior manager to be accountable [14]. In our experience, in a core SM&CR firm that is usually the chief executive or an executive director. Whoever it is, the board should be able to name them and show what they report.
What the FCA found in 2026
The FCA's review a year after the deadline found good practice in board oversight and dashboards, but also weak board engagement, unclear approval trails, and unclear ownership of fixes [13]. It said more work was needed on supplier weaknesses, and named cloud outages as plausible scenarios. It also found some self-assessments claimed the firm could recover from any scenario, without testing severe enough to support the claim [13]. For a board, the lesson is to ask for the testing behind every claim of resilience.
Incident and third-party reporting from 18 March 2027
The FCA's new rules, in policy statement PS26/2, apply from 18 March 2027 [15]. Every firm must report a serious operational incident, and the FCA expects most first reports within 24 hours of the firm deciding that a threshold is met [16]. Some larger firms must also notify the FCA about material third-party arrangements and keep a register. We cover these rules in full in our FCA incident reporting guide, so we do not repeat them here.
DORA, only if you have EU business
The European Union's Digital Operational Resilience Act (DORA) has applied since 17 January 2025 to regulated financial firms in the European Union [17]. It does not apply to a UK firm because of its UK business. If your group has a regulated subsidiary in the European Union, that entity's management body has ultimate responsibility for its information and communication technology (ICT) risk, and must report major ICT incidents and keep a register of ICT suppliers [17]. Ask your EU entity's compliance lead to confirm what applies, rather than building DORA into UK policies by default.
5. Law firms
The SRA's approach is to set outcomes and leave the firm to decide how to meet them. It expects each firm to identify its own threats and adapt its response as they change [18].
What the rules require
The SRA Code of Conduct for Firms requires [19]:
- effective governance, systems and controls (paragraph 2.1);
- that the firm identifies, monitors and manages all material risks to its business (2.5);
- prompt reports to the SRA of serious breaches (3.9), and of other matters it may need to look into (3.10);
- that the affairs of clients and former clients are kept confidential (6.3);
- a COLP and a COFA who take reasonable steps to make sure the firm complies (9.1 and 9.2).
Both SRA codes also require firms to safeguard money and assets entrusted to them by clients [18].
Reporting a cyber attack
The SRA expects a cyber attack that affects the firm or its clients to be reported promptly. Examples include an attack that stops transactions completing, seriously delays client work, or risks the loss of client data or money. It also welcomes reports of serious attempts and near misses, but not everyday phishing [20]. A personal data breach may need a separate report to the ICO within 72 hours (section 1).
Client money
The SRA's warning notice on missing client money is clear. A shortfall must be replaced at once, even if it arose from theft or a cyber attack beyond the firm's control. The managers are jointly responsible, and may have to replace it from their own resources [21]. That makes payment diversion fraud a partner-level risk, not an IT one. In its cybercrime risk outlook, the SRA found email was involved in 83% of the cyber crimes reported to it in 2021, and said attacks on IT suppliers can spread to many firms at once [22].
What the SRA recommends
The risk outlook's advice is guidance rather than rules. It includes multi-factor authentication, several backups, checking who clients and third parties really are, a no-blame culture so staff report mistakes early, and choosing IT providers with their recovery times and restoration priorities in mind [22].
What is changing
In June 2026 the SRA consulted on requiring firms to notify it when they start holding client money. It said it would also look at whether senior people should have clearer personal responsibility for client money [23]. The consultation closed on 17 August 2026 and, at the time of writing, no outcome has been published. Boards of law firms should watch for it.
6. Accountancy practices
Here the plain answer is that there is no specific cyber security rule for ICAEW member firms. What exists is a general ethical duty, the law that applies to everyone, and guidance.
What is required
- Confidentiality is one of the five fundamental principles of the ICAEW Code of Ethics, which applies to members and member firms [24]. In July 2026 ICAEW reminded firms that the duty applies inside the firm as well as outside it, and calls for firm controls over how client information is shared and used [25].
- UK GDPR applies as for any firm (section 1). ICAEW's 2026 practice assurance report found firms that had not registered with the ICO [26].
What is recommended
ICAEW's Practice Assurance Monitoring Report 2026 recommends that firms put procedures in place to reduce the risk of cyber incidents [26]. Its suggestions include proper governance to direct and oversee cyber security, checks on suppliers, testing incident response, staff training, monitoring how breaches are reported inside the firm and to the ICO, reviewing cyber insurance cover, and set protocols for new suppliers and changes to payment details [26]. It notes that certifications are often only a starting point. These are recommendations, not requirements. But if a breach leads to a complaint or a confidentiality question, a practice that has followed them will be in a far better position to show it took reasonable care.
If your practice also holds FCA permissions, section 4 applies to that business as well.
7. Sector by sector: what the board should own and show
| Sector | Required | Recommended | Who on the board owns it | Evidence the board should be able to show |
|---|---|---|---|---|
| All firms | UK GDPR security measures, regular testing, breach records, ICO reports within 72 hours [1] [2] | Cyber Governance Code: appetite (A3), quarterly reporting (E2), yearly exercise (D2) [3] | A named executive owner and a named director or partner (Code A2, E1) | Risk assessment; breach log; test results; processor contracts; appetite statement; quarterly reports |
| FCA, all firms | Principles 3 and 11 [11]; incident reporting from 18 March 2027 [15] | Lessons from the FCA's 2026 review [13] | Chief executive or the relevant senior manager | Risk management records; incident decision rights; reporting thresholds |
| FCA, firms in SYSC 15A scope | Important business services, impact tolerances, mapping, scenario testing, board-approved self-assessment [13] | Joint testing with key suppliers [13] | SMF24, or the most appropriate senior manager [14] | Approved self-assessment; mapping; test results; fixes with owners |
| FCA, with EU business | DORA for the EU entity [17] | - | The EU entity's management body | EU entity's ICT risk framework and supplier register |
| Law firms | Governance and controls (2.1), material risks (2.5), prompt reports (3.9, 3.10), confidentiality (6.3) [19]; replace client money shortfalls [21] | SRA risk outlook advice: multi-factor authentication, backups, no-blame reporting, supplier vetting [22] | Managers jointly; COLP and COFA [19] | Risk register; cyber incident reports to the SRA; payment change procedure; client warnings; supplier reviews |
| Accountancy practices | Confidentiality under the Code of Ethics [24]; UK GDPR | Practice assurance report: governance, supplier checks, incident testing, training, payment protocols [26] | The principals or partners, with one named partner | ICO registration; access controls on client files; training records; payment change protocol |
Table 1. CyberCQR's summary of public rules and guidance at 30 October 2026, for illustration. It is not legal advice. The "evidence" column is our view of what a board should be able to produce, not a regulator's list.
8. The reporting clocks, side by side
| To whom | What | How fast | Clock starts |
|---|---|---|---|
| ICO (all firms) | Notifiable personal data breach | Without undue delay, within 72 hours | Becoming aware of the breach [2] |
| FCA (from 18 March 2027) | Operational incident that meets a threshold | First report expected within 24 hours | The firm's decision that a threshold is met [16] |
| SRA (law firms) | Cyber attack affecting the firm or clients; serious breaches | Promptly | Not defined [20] |
| Your IT provider to the regulator (if the Bill becomes law) | Significant incident | Initial notice within 24 hours; full report within 72 hours | The provider becoming aware [10] |
Table 2. The clocks most firms of this size face. A single incident can start several at once.
Every clock in this table starts with someone knowing. If your IT provider runs your systems and also monitors them, ask how long its internal checks take before you are told. Validation, escalation, account management and a look at service levels can each add time. Agree in writing that serious alerts reach a named person at your firm at the same moment they reach the provider.
9. The board's evidence checklist
If a regulator, auditor, insurer or major client asked tomorrow, could the board produce these within a day?
Every firm
- A one-page register of the regulators and codes that apply, with owners and clocks.
- Named executive and board owners for cyber risk, in writing.
- A cyber risk appetite statement, approved and minuted in the last 12 months.
- A list of critical services, data and systems, with a figure for how much of the estate is monitored.
- Four quarterly cyber reports, with measures, tolerances and decisions.
- An incident plan with a "who do we tell?" step, and decision-makers with written authority.
- A breach log, including breaches not reported and the reasons.
- A record of an incident exercise in the last 12 months, with timings and closed actions.
- Supplier terms on incident notice, and an alert route the firm controls.
- Test results showing controls work, and one independent review a year.
- Directors' cyber training records.
- A report showing no security exemptions for directors or partners, and passkeys or other phishing-resistant sign-in for the board and anyone who approves payments.
FCA firms in SYSC 15A scope
- A self-assessment approved by the board, with the testing behind it.
- The named senior manager accountable for operational resilience.
Law firms
- Records of cyber incidents reported to the SRA, and the decision on those not reported.
- A written payment change procedure, and client warnings about bank details.
Accountancy practices
- ICO registration, and controls over who in the firm can see which client files.
- A protocol for new suppliers and changes to payment details.
Glossary
| Term | Meaning |
|---|---|
| COFA | Compliance Officer for Finance and Administration: the person in a law firm responsible for compliance with the SRA Accounts Rules. |
| COLP | Compliance Officer for Legal Practice: the person in a law firm responsible for compliance with the SRA's other rules. |
| Core SM&CR firm | The standard tier of the Senior Managers and Certification Regime for FCA solo-regulated firms. |
| Cyber Essentials | A government-backed certification scheme covering basic technical controls. |
| ICT | Information and communication technology. |
| Impact tolerance | The most disruption to an important business service a firm will accept. |
| Important business service | A service to clients or the market which, if disrupted, could cause intolerable harm. |
| Managed service provider | A company that runs some or all of a firm's IT under contract, often with remote access to its systems. |
| Passkey | A sign-in that replaces the password with a cryptographic key held on your device, unlocked by a fingerprint, face or PIN. |
| Processor | Under UK GDPR, a supplier that handles personal data on your behalf. |
| Secondary legislation | Detailed rules made by ministers under powers in an Act, after it is passed. |
| SMF24 | The Chief Operations Function, a senior management role under the SM&CR. |
| SYSC 15A | The chapter of the FCA Handbook that holds the operational resilience rules. |
Table 3. Terms used on this page (alphabetical).
Further reading
From CyberCQR
- Who is asking? What UK regulators expect of your board on cyber
- Regulator-ready boards: ten cyber actions for any UK sector
- Reporting operational incidents to the FCA: a good practice guide
- Measuring and reporting cyber risk to the board: a good practice guide
- How much of your estate can the board see? (interactive self-assessment)
- Document library: every paper and tool in one table
External
- Cyber Governance Code of Practice [3]
- Cyber Security and Resilience Bill: managed service providers factsheet [9]
References
- [1]Information Commissioner's Office, A guide to data security, UK GDPR guidance.
https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/a-guide-to-data-security/ - [2]Information Commissioner's Office, Personal data breaches: a guide, updated 20 August 2025.
https://ico.org.uk/for-organisations/guide-to-dp/guide-to-the-uk-gdpr/personal-data-breaches - [3]Department for Science, Innovation and Technology and National Cyber Security Centre, Cyber Governance Code of Practice, 8 April 2025.
https://www.gov.uk/government/publications/cyber-governance-code-of-practice/cyber-governance-code-of-practice - [4]National Cyber Security Centre, Password administration for system owners: updating your approach.
https://www.ncsc.gov.uk/collection/passwords/updating-your-approach - [5]National Cyber Security Centre, NCSC: Leave passwords in the past, passkeys are the future, 23 April 2026.
https://www.ncsc.gov.uk/news/ncsc-leave-passwords-in-the-past-passkeys-are-the-future - [6]National Cyber Security Centre, Cyber Essentials: Requirements for IT Infrastructure v3.3, April 2026.
https://www.ncsc.gov.uk/files/cyber-essentials-requirements-for-it-infrastructure-v3-3.pdf - [7]National Cyber Security Centre, Cyber Security Toolkit for Boards.
https://www.ncsc.gov.uk/collection/board-toolkit - [8]UK Parliament, Cyber Security and Resilience (Network and Information Systems) Bill: bill page and stages, checked 30 October 2026 (House of Lords third reading set for 2 November 2026).
https://bills.parliament.uk/bills/4035 - [9]Department for Science, Innovation and Technology, Cyber Security and Resilience Bill factsheet: relevant managed service providers, factsheets collection updated 30 June 2026.
https://www.gov.uk/government/publications/cyber-security-and-resilience-network-and-information-systems-bill-factsheets/relevant-managed-service-providers - [10]Department for Science, Innovation and Technology, Cyber Security and Resilience Bill factsheet: incident reporting, updated 30 June 2026.
https://www.gov.uk/government/publications/cyber-security-and-resilience-network-and-information-systems-bill-factsheets/incident-reporting - [11]Financial Conduct Authority, FCA Handbook, PRIN 2.1: The Principles.
https://handbook.fca.org.uk/handbook/PRIN/2/1.html - [12]Financial Conduct Authority, FCA Handbook, SYSC 8.1: General outsourcing requirements.
https://www.handbook.fca.org.uk/handbook/SYSC/8/1.html - [13]Financial Conduct Authority, Operational resilience: insights and observations one year on, 27 March 2026.
https://www.fca.org.uk/publications/good-and-poor-practice/operational-resilience-insights-observations-one-year - [14]Financial Conduct Authority, PS21/3: Building operational resilience, March 2021.
https://www.fca.org.uk/publication/policy/ps21-3-operational-resilience.pdf - [15]Financial Conduct Authority, PS26/2: Operational incident and third party reporting, March 2026.
https://www.fca.org.uk/publications/policy-statements/ps26-2-operational-incident-third-party-reporting - [16]Financial Conduct Authority, FG26/3: Operational incident reporting, finalised guidance, March 2026.
https://www.fca.org.uk/publication/finalised-guidance/fg26-3.pdf - [17]European Union, Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA), 14 December 2022, applying from 17 January 2025.
https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng - [18]Solicitors Regulation Authority, The impact of cybercrime, December 2023.
https://www.sra.org.uk/solicitors/resources/cybercrime/cybercrime/ - [19]Solicitors Regulation Authority, Code of Conduct for Firms.
https://www.sra.org.uk/solicitors/standards-regulations/code-conduct-firms/ - [20]Solicitors Regulation Authority, SRA Update 123: Reporting cybercrime incidents, 11 January 2024.
https://www.sra.org.uk/news/news/sra-update-123-cybercrime/ - [21]Solicitors Regulation Authority, Warning notice: money missing from client account.
https://www.sra.org.uk/solicitors/guidance/money-missing-client-account/ - [22]Solicitors Regulation Authority, Risk Outlook report: information security and cybercrime, 1 June 2022.
https://www.sra.org.uk/sra/research-publications/risk-outlook-report-information-security-cybercrime/ - [23]Solicitors Regulation Authority, Consumer protection review: consultation on prescribed events, press release, 19 June 2026.
https://www.sra.org.uk/news/news/press/consumer-protection-review-consultation-2026 - [24]ICAEW, Overview of the ICAEW Code of Ethics: the fundamental principles.
https://icaew.com/-/media/corporate/files/technical/ethics/overview-icaew-codeof-ethics-dl.ashx - [25]ICAEW, Protecting client confidentiality, regulatory news, July 2026.
https://www.icaew.com/regulation/regulatory-news/regulatory-news-2026-07/protecting-client-confidentiality - [26]ICAEW, Practice Assurance Monitoring Report 2026, 2026.
https://www.icaew.com/-/media/corporate/files/regulations/practice-assurance/practice-assurance-monitoring-report-2026.ashx
Security is the outcome, not a solution.
CyberCQR is an independent UK cyber security consultancy and fractional CISO practice. We help boards of regulated firms build the evidence in this guide, check what their IT provider can and cannot see, and make the most of the controls they already own, without vendor commissions or product resale. See our vCISO and advisory service.