CyberCQR Top 10 · Regulation
Regulator-ready boards: ten cyber actions for any UK sector
Whether your firm answers to the FCA, the SRA, ICAEW or only the ICO, the board is asked the same things: who owns cyber risk, what you decided, how you know it is working, and how fast you would find out. These ten actions cover that ground for any regulated firm of up to 2,000 people, with the source behind each one.
Summary
The point for boards. Regulators judge a board by what it can show, not by what it bought. Each action below produces a piece of evidence: a named owner, a minuted decision, a quarterly report, an exercise record. Together they answer most of what any UK regulator will ask about cyber security.
Why one list works across sectors
The detailed rules differ. FCA-regulated firms may have operational resilience duties and, from 18 March 2027, new incident reporting rules [3] [4]. Law firms answer to the Solicitors Regulation Authority (SRA) on governance, confidentiality and client money [5]. Accountancy practices mostly face guidance from their professional body, such as ICAEW [6]. Every firm that holds personal data has duties under the UK General Data Protection Regulation (UK GDPR) [7].
Underneath, they share a pattern. None of them lists the controls you must buy. They all expect the board to know its risks, own them, check that controls work, and act quickly when something goes wrong. The Cyber Governance Code of Practice, published by the government and the National Cyber Security Centre (NCSC) in April 2025, sets that pattern out as board actions [1]. It is guidance, not law, and it is aimed at medium and large organisations, but it is the best single checklist we know for a board of this size. The ten actions below follow it, and show where each sector's rules point the same way.
The ten actions
1. Write down which rules apply to you
Why it matters. The Code asks the board to make sure senior executives understand the firm's regulatory duties [1]. Many boards could not list, on one page, which regulators expect what of them on cyber, or which reporting clocks they are on.
What to do.
- Ask for a one-page register: each regulator or code, the duty, the deadline, and the owner.
- Include the ICO for every firm, your sector regulator, and any European Union (EU) business that brings in the Digital Operational Resilience Act (DORA) [8].
- Review it each year, and when the Cyber Security and Resilience Bill becomes law [9].
Evidence. The register, with the date the board last saw it.
2. Name an executive owner and a board owner
Why it matters. The Code asks for senior ownership of cyber risk, and for clear roles at both executive and non-executive level [1]. The sector rules say the same in their own terms. For FCA firms in scope of the operational resilience rules, the FCA looks to the Chief Operations Function (SMF24) holder, or the most appropriate senior manager where there is none [10]. Law firms have a Compliance Officer for Legal Practice (COLP) and a Compliance Officer for Finance and Administration (COFA) [5]. The ICO expects someone with day-to-day responsibility for security, and the authority to act [7].
What to do.
- Name one executive who owns cyber risk, and one director or partner who challenges it.
- Write both into the board's terms of reference or the firm's responsibilities map.
- Give both some training. The Code asks directors to build their own cyber knowledge, and the NCSC offers free board material [11].
- Hold directors' and partners' own accounts to the firm's highest standard, with no exemptions from multi-factor authentication, lockouts, time-outs or monitoring. They control the assets, so they are the ones attackers target.
- Make that easy: move the board, and anyone who approves payments, to passkeys. These use a fingerprint, face or device PIN instead of a password and a code. The NCSC rates them at least as secure as the strongest password with a second step, and recommends them wherever available [12]. Cyber Essentials already counts them as multi-factor authentication [13].
Evidence. The names, the written roles, training records, and a report showing no security exemptions for directors.
3. Set and minute a cyber risk appetite
Why it matters. Action A3 of the Code asks the board to define and communicate its cyber risk appetite, and to check there is a plan to stay within it [1]. Without it, nobody can say whether a risk is acceptable, so decisions drift.
What to do.
- Agree a one-page statement: what the firm will not accept (for example, client data held without multi-factor authentication) and what it will tolerate for a time.
- Minute the approval, and review it every year.
- Use our board reporting guide for an example statement.
Evidence. The approved statement and the minute.
4. Know your critical services, data and systems
Why it matters. The Code's first action is to know which technology, data and services matter most to the firm [1]. The FCA's operational resilience rules ask firms in scope to identify important business services and map the people, technology and suppliers behind them [3]. The ICO expects security to start from a risk assessment of the personal data you hold [7].
What to do.
- List the five to ten services clients would notice first if they stopped, and the systems and suppliers each depends on.
- Note where client personal data and client money sit.
- Ask what share of those systems your monitoring can actually see. If you cannot detect it, you cannot protect it.
Evidence. The list, signed off, with a coverage figure.
5. Require quarterly reporting with measures and tolerances
Why it matters. Action E2 of the Code asks the board to require formal cyber reporting at least quarterly, with suitable measures and agreed tolerances for each [1]. In its 2026 review the FCA found weaknesses in board engagement and approval trails at some firms [3]. Regular reporting is how a board shows it was paying attention.
What to do.
- Agree six to eight measures, each with a tolerance that triggers a decision.
- Make the first line of every report "what we can and cannot see".
- End each report with the decisions the board is being asked to take.
Evidence. Four reports a year, and the decisions minuted against them.
6. Decide in advance who reports what, to whom, and how fast
Why it matters. The Code asks the board to take ownership of regulatory reporting during an incident [1]. The clocks differ. A notifiable personal data breach goes to the ICO within 72 hours of becoming aware [2]. From 18 March 2027 the FCA expects a first report within 24 hours of deciding an incident is reportable [14]. The SRA expects cyber attacks that affect a firm or its clients to be reported promptly [15].
What to do.
- Name a decision-maker and a deputy for each clock, with written authority to report without calling a meeting.
- Put a "who do we tell?" step in the incident plan, with times recorded.
- Record every breach, reported or not, as the ICO requires [2].
Evidence. The decision rights, the plan step, and the breach log.
7. Make your suppliers tell you fast, and do not rely on one pair of eyes
Why it matters. The Code asks the board to check supplier security in proportion to risk [1]. Under UK GDPR, a processor must tell you about a breach without undue delay, and you remain responsible for what it does with your data [2] [7]. The Cyber Security and Resilience Bill would make larger managed service providers report significant incidents and tell affected customers [16]. That is welcome, but their duty to a regulator does not replace your need to know. The FCA's outsourcing rules put it plainly: a firm stays fully responsible for its regulatory obligations when it outsources, and senior people cannot delegate that responsibility [17]. You can outsource the service, but never the responsibility or the accountability.
What to do.
- Require your IT provider and key software suppliers to tell you within hours of finding an incident that affects you, without waiting for internal sign-off or a service-level check.
- Where one company both runs and monitors your IT, have serious alerts reach a named person at your firm at the same time.
- Ask each critical supplier for evidence each year, scaled to the risk.
Evidence. Contract terms, an alert route that has been tested, and supplier reviews.
8. Rehearse an incident once a year, including the reporting decision
Why it matters. The Code asks for the incident plan to be exercised at least once a year, with lessons fed back [1]. FCA firms in scope must test their important business services against severe but plausible scenarios [3]. A plan that has never been run will be slow when it matters.
What to do.
- Run a 90-minute exercise on an incident that starts at a supplier out of hours.
- Time three things: when the firm knew, when it decided, and when it would have reported.
- Give the actions an owner and a date, and report progress to the board.
Evidence. The exercise record, the timings, and closed actions.
9. Ask for proof that controls work, not a list of tools
Why it matters. The ICO expects firms to test, assess and evaluate their security measures regularly [7]. The Code asks for cyber to be built into internal and external assurance [1]. The FCA's 2026 review warned about self-assessments that claimed more than their testing showed [3]. A certificate or a tool licence is not proof that a control is switched on.
What to do.
- Before buying anything new, ask which security features the firm already pays for and has not turned on. In Microsoft 365, the list is often long.
- Ask for test results: restores from backup, phishing exercises, and multi-factor authentication coverage.
- Have someone independent of the IT provider check the results once a year.
Evidence. Test results, and an independent review.
10. Protect client money from cyber-enabled fraud
Why it matters. For a law firm, money lost from a client account through theft or a cyber attack must still be replaced, and the managers are responsible [18]. The SRA has found that email is the usual way in [19]. ICAEW's 2026 practice assurance report recommends call-back checks and controls on any change of payment details [6]. The same fraud hits financial advisers and their clients.
What to do.
- Never accept a change of bank details by email alone: call back on a number you already hold.
- Tell clients, in writing, that your bank details will not change by email.
- Protect the mailboxes that handle payments with multi-factor authentication and alerts on new forwarding rules.
Evidence. The written procedure, client letters, and mailbox settings.
The actions mapped to the sources
| Action | Cyber Governance Code | All firms (ICO) | FCA | SRA | ICAEW |
|---|---|---|---|---|---|
| 1. Rules register | E5 | Yes | Yes | Yes | Yes |
| 2. Named owners | A2, E1, C3 | Security responsibility | SMF24 or chosen senior manager | COLP, COFA | Guidance only |
| 3. Risk appetite | A3 | - | Impact tolerances (firms in scope) | Material risks (2.5) | Guidance only |
| 4. Critical services | A1 | Risk assessment | Important business services | Material risks (2.5) | Guidance only |
| 5. Quarterly reporting | E2 | - | Board approval trail | Governance (2.1) | Guidance only |
| 6. Reporting decisions | D3 | 72 hours | 24 hours from decision (from March 2027) | Promptly (3.9, 3.10) | ICO only |
| 7. Suppliers | A4 | Processor duties | Outsourcing (SYSC 8); mapping; third-party rules | Risk outlook advice | Supplier checks |
| 8. Yearly exercise | D2 | - | Scenario testing | - | Incident response testing |
| 9. Proof controls work | E4 | Regular testing | Self-assessment | Governance (2.1) | Guidance only |
| 10. Client money | - | - | Principles | Accounts Rules | Payment checks |
Table 1. CyberCQR's mapping of each action to its sources, as an illustration, not a legal analysis. Code references are to action numbers in the Cyber Governance Code of Practice [1]; SRA numbers are paragraphs of the Code of Conduct for Firms [5]. "Guidance only" means the professional body recommends rather than requires it [6].
Five questions for your next board meeting
- Can we see, on one page, every regulator and code that expects something of us on cyber, and who owns each?
- When did the board last approve our cyber risk appetite?
- Which of our cyber measures has a tolerance, and what happens when one is breached?
- When did we last rehearse an incident, and how long did the reporting decision take?
- Who, other than our IT provider, can see a serious alert at the moment it fires?
Glossary
| Term | Meaning |
|---|---|
| COFA | Compliance Officer for Finance and Administration: the person in a law firm responsible for compliance with the SRA Accounts Rules. |
| COLP | Compliance Officer for Legal Practice: the person in a law firm responsible for compliance with the SRA's other rules. |
| Impact tolerance | The most disruption to an important business service a firm will accept, set under the FCA's operational resilience rules. |
| Important business service | A service to clients or the market which, if disrupted, could cause intolerable harm. |
| Multi-factor authentication | A sign-in that needs a second proof of identity, such as a code on a phone, as well as a password. |
| Passkey | A sign-in that replaces the password with a cryptographic key held on your device, unlocked by a fingerprint, face or PIN. It cannot be phished like a password. |
| Processor | Under UK GDPR, a supplier that handles personal data on your behalf, such as an IT provider or cloud service. |
| Risk appetite | The amount and type of risk a board is willing to accept to meet its goals. |
| SMF24 | The Chief Operations Function, a senior management role under the Senior Managers and Certification Regime (SM&CR). |
| Tolerance | The level of a measure at which the board expects to be told and to make a decision. |
Table 2. Terms used on this page (alphabetical).
Further reading
From CyberCQR
- Who is asking? What UK regulators expect of your board on cyber
- What UK regulators expect of boards on cyber: a sector guide
- FCA incident reporting: ten actions before 18 March 2027
- Cyber risk reporting: ten actions for boards
- How much of your estate can the board see? (interactive self-assessment)
External
References
- [1]Department for Science, Innovation and Technology and National Cyber Security Centre, Cyber Governance Code of Practice, 8 April 2025.
https://www.gov.uk/government/publications/cyber-governance-code-of-practice/cyber-governance-code-of-practice - [2]Information Commissioner's Office, Personal data breaches: a guide, updated 20 August 2025.
https://ico.org.uk/for-organisations/guide-to-dp/guide-to-the-uk-gdpr/personal-data-breaches - [3]Financial Conduct Authority, Operational resilience: insights and observations one year on, 27 March 2026.
https://www.fca.org.uk/publications/good-and-poor-practice/operational-resilience-insights-observations-one-year - [4]Financial Conduct Authority, PS26/2: Operational incident and third party reporting, March 2026.
https://www.fca.org.uk/publications/policy-statements/ps26-2-operational-incident-third-party-reporting - [5]Solicitors Regulation Authority, Code of Conduct for Firms.
https://www.sra.org.uk/solicitors/standards-regulations/code-conduct-firms/ - [6]ICAEW, Practice Assurance Monitoring Report 2026, 2026.
https://www.icaew.com/-/media/corporate/files/regulations/practice-assurance/practice-assurance-monitoring-report-2026.ashx - [7]Information Commissioner's Office, A guide to data security, UK GDPR guidance.
https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/a-guide-to-data-security/ - [8]European Union, Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA), 14 December 2022, applying from 17 January 2025.
https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng - [9]UK Parliament, Cyber Security and Resilience (Network and Information Systems) Bill: bill page and stages, checked 30 October 2026 (House of Lords third reading set for 2 November 2026).
https://bills.parliament.uk/bills/4035 - [10]Financial Conduct Authority, PS21/3: Building operational resilience, March 2021.
https://www.fca.org.uk/publication/policy/ps21-3-operational-resilience.pdf - [11]National Cyber Security Centre, Cyber Security Toolkit for Boards.
https://www.ncsc.gov.uk/collection/board-toolkit - [12]National Cyber Security Centre, NCSC: Leave passwords in the past, passkeys are the future, 23 April 2026.
https://www.ncsc.gov.uk/news/ncsc-leave-passwords-in-the-past-passkeys-are-the-future - [13]National Cyber Security Centre, Cyber Essentials: Requirements for IT Infrastructure v3.3, April 2026.
https://www.ncsc.gov.uk/files/cyber-essentials-requirements-for-it-infrastructure-v3-3.pdf - [14]Financial Conduct Authority, FG26/3: Operational incident reporting, finalised guidance, March 2026.
https://www.fca.org.uk/publication/finalised-guidance/fg26-3.pdf - [15]Solicitors Regulation Authority, SRA Update 123: Reporting cybercrime incidents, 11 January 2024.
https://www.sra.org.uk/news/news/sra-update-123-cybercrime/ - [16]Department for Science, Innovation and Technology, Cyber Security and Resilience Bill factsheet: incident reporting, updated 30 June 2026.
https://www.gov.uk/government/publications/cyber-security-and-resilience-network-and-information-systems-bill-factsheets/incident-reporting - [17]Financial Conduct Authority, FCA Handbook, SYSC 8.1: General outsourcing requirements.
https://www.handbook.fca.org.uk/handbook/SYSC/8/1.html - [18]Solicitors Regulation Authority, Warning notice: money missing from client account.
https://www.sra.org.uk/solicitors/guidance/money-missing-client-account/ - [19]Solicitors Regulation Authority, Risk Outlook report: information security and cybercrime, 1 June 2022.
https://www.sra.org.uk/sra/research-publications/risk-outlook-report-information-security-cybercrime/
Security is the outcome, not a solution.
CyberCQR is an independent UK cyber security consultancy and fractional CISO practice. We help boards of regulated firms put these ten actions in place, starting with the controls you already own, without vendor commissions or product resale. See our vCISO and advisory service.