Guide

Cyber security requirements for UK businesses

How to protect your business from cyber threats and comply with UK cyber security requirements. Includes Cyber Essentials certification, data breach notification rules, and sector-specific obligations for financial services and healthcare.

UK-wide

Cyber security is no longer optional for UK businesses. With cyber attacks at record levels and significant regulatory requirements in place, all organisations must take steps to protect themselves, their customers, and their data.

The National Cyber Security Centre (NCSC) states: "The question is no longer if your organisation will face a cyber incident, but when." Understanding the threat landscape and your obligations is the first step to building resilience.

The current threat landscape

The UK is experiencing unprecedented levels of cyber attacks. Understanding the scale of the threat helps you prioritise cyber security investment and preparedness.

These statistics underscore why cyber security must be a business priority, not just an IT concern. Small businesses are particularly vulnerable - they're targeted in 71% of ransomware attacks because criminals assume they have weaker defences.

Cyber Essentials certification

Cyber Essentials is the UK government's baseline cyber security standard. It's designed to protect against approximately 80% of common cyber attacks and is mandatory for certain government contracts.

Even if not required, certification demonstrates to customers and insurers that you take security seriously. Many cyber insurance policies now require or offer premium discounts for Cyber Essentials certification.

Which level is right for your business?

  • Basic Cyber Essentials - Good for most small businesses, required for many government contracts, affordable entry point (£320-£600 depending on size)
  • Cyber Essentials Plus - For businesses handling sensitive data, required for higher-risk government contracts, includes technical verification of your controls (£1,500-£3,000)

Key changes from April 2025: The new "Willow Question Set" includes strengthened requirements for multi-factor authentication (now mandatory for administrator accounts, remote access, and cloud services handling sensitive data) and updated security patch timescales (within 14 days for critical vulnerabilities).

The five technical controls

Cyber Essentials certification addresses five core areas of cyber security. Implementing these controls significantly reduces your attack surface.

Getting started: If you're not ready for certification, implementing these five controls yourself is an excellent first step. The NCSC provides free guidance on each control area.

Common gaps: The most frequent failures in Cyber Essentials assessments are:

  • Not enabling multi-factor authentication on administrator accounts
  • Missing security updates on older devices or software
  • Using default passwords on routers or network equipment
  • No malware protection on some devices (especially Macs or mobile devices)

Data breach notification requirements

If you process personal data (which almost all businesses do), you must comply with UK GDPR breach notification rules. This includes a strict 72-hour deadline for reporting certain breaches.

Why this matters: Failure to report a breach within 72 hours is itself a UK GDPR violation, with potential fines of up to £8.7 million or 2% of global turnover. Beyond the fine, late reporting damages trust and can escalate regulatory scrutiny.

Practical steps for breach preparedness

Don't wait for a breach to understand your obligations. Prepare now:

  1. Designate a response lead - Who makes the decision whether to report?
  2. Document the process - Create a one-page breach response plan
  3. Save the ICO reporting link - ico.org.uk/for-organisations/report-a-breach
  4. Understand your data - What personal data do you hold? Where is it? Who has access?
  5. Practice scenario planning - "What if our customer database was accessed by an attacker?"

Common myth: "We need to finish investigating before reporting." False. The clock starts when you become aware of the breach. Report within 72 hours with available information, then update the ICO as your investigation progresses.

UK GDPR penalties and enforcement

Understanding the penalty framework helps you grasp the seriousness of cyber security and data protection obligations. However, the ICO's approach is proportionate and focused on improvement, not punishment.

What this means in practice: The ICO prefers to work with organisations that demonstrate genuine efforts to comply. If you:

  • Recognise shortcomings when they're identified
  • Take ownership of the issue
  • Develop and implement performance improvement plans
  • Cooperate with ICO investigations

...you'll often avoid formal enforcement action. Fines are typically reserved for serious, persistent, or intentional breaches by organisations that ignore warnings.

Recent enforcement trends (2025): The ICO has increased focus on technical and organisational measures following cyber incidents. Both the Capita plc (£14m) and Advanced Computer Software (£6.1m) fines involved failures to implement basic security controls like multi-factor authentication and patch management.

Reporting cyber incidents

When a cyber incident occurs, you may need to report it to multiple authorities depending on the nature of the incident and your sector. Having these contacts readily available saves critical time.

Who to report to:

  • Crime (fraud, extortion, ransomware): Report Fraud (0300 123 2040) or Police Scotland 101 if in Scotland
  • Data breach: ICO within 72 hours if risk to individuals
  • Phishing emails: Forward to report@phishing.gov.uk (NCSC)
  • Under active attack: Contact NCSC and use a CIR Assured Service Provider

Why report even if police can't investigate: Every report builds the national intelligence picture. Your report might be the piece that connects multiple attacks and leads to identifying criminal infrastructure or patterns.

PROFESSIONAL & FINANCIAL… Requirement

Financial services firms face enhanced operational resilience requirements

If your firm is regulated by the FCA or PRA (banks, insurers, electronic money institutions, payment institutions, investment firms), you must comply with operational resilience requirements by 31 March 2025.

These requirements go significantly beyond Cyber Essentials and UK GDPR:

What this means for your firm:

By 31 March 2025, you must have:

  • Completed mapping of all Important Business Services (IBS) and their dependencies
  • Set impact tolerances (maximum acceptable downtime) for each IBS
  • Conducted scenario testing proving you can stay within impact tolerances
  • Implemented robust third-party risk management with contractual security requirements
  • Documented all of the above with evidence of board-level oversight

Common gaps FCA has identified: Many firms struggle with comprehensive third-party mapping (including sub-contractors and cloud dependencies) and realistic scenario testing. Don't rely on desktop exercises alone - test with live simulation where safe to do so.

Baseline expectation: The FCA expects all regulated firms to implement the NCSC's "10 Steps to Cyber Security" as a foundational minimum. Cyber Essentials Plus is recommended but not mandatory for all firms (sector-specific requirements may apply).

HEALTHCARE & SOCIAL CARE Requirement

NHS and healthcare organisations must complete Data Security and Protection Toolkit

If your organisation provides NHS services or has access to NHS patient data (including GPs, pharmacies, social care providers, and IT suppliers), you must complete the Data Security and Protection Toolkit (DSPT) annually.

DSPT is more comprehensive than Cyber Essentials and includes both information governance and cyber security requirements:

What changed in Version 7 (September 2024):

The adoption of the NCSC Cyber Assessment Framework (CAF) as DSPT's foundation represents a significant uplift in cyber security expectations. Key changes include:

  • Network security: More rigorous requirements for network segmentation and monitoring
  • Access control: Strengthened requirements for identity verification and least-privilege access
  • Vulnerability management: Enhanced expectations for vulnerability scanning and patch management
  • Incident management: Clearer requirements for incident response plans and testing

If you're an NHS supplier: Your contract likely requires "Standards Met" status on DSPT. Failure to achieve this can result in contract termination or loss of access to NHS systems.

NIS Regulations coverage: If you're a designated Operator of Essential Services (OES) in the health sector (NHS trusts, ICBs, certain independent providers), you must also comply with Network and Information Systems (NIS) Regulations, including incident reporting to NHS England within 72 hours for incidents affecting security or service continuity.

Building a cyber security programme

Compliance with formal requirements is essential, but effective cyber security requires embedding security into your business operations. Here's a practical roadmap:

Foundation (0-3 months)

  • Complete NCSC's free "Cyber Action Plan" tool to assess your current posture
  • Register with ICO and understand your breach notification obligations
  • Implement basic hygiene: unique passwords, anti-malware, firewalls, software updates
  • Designate someone responsible for cyber security (can be external advisor)
  • Create a simple incident response plan (one page is fine to start)

Intermediate (3-12 months)

  • Achieve Cyber Essentials (basic) certification
  • Deploy multi-factor authentication for all cloud services and remote access
  • Conduct cyber security awareness training for all staff
  • Review and document your data inventory (what personal data, where stored, who accesses)
  • Implement regular backup testing (can you actually restore from backups?)
  • Review cyber insurance options

Advanced (12+ months)

  • Consider Cyber Essentials Plus if handling sensitive data
  • Implement security monitoring and logging
  • Conduct penetration testing or vulnerability scanning
  • Review and test incident response plan with realistic scenarios
  • Assess third-party and supply chain cyber risk
  • Benchmark against NCSC "10 Steps to Cyber Security" or CAF

Common myths about cyber security

Myth 1: "We're too small to be targeted"
Reality: 71% of ransomware attacks target small businesses. Criminals use automated tools that scan for vulnerabilities regardless of business size.

Myth 2: "We don't have anything worth stealing"
Reality: You have customer data, employee records, banking details, and access to business systems. Even if you don't store payment cards, your data has value to criminals.

Myth 3: "Cyber security is too expensive for us"
Reality: Basic cyber security costs very little. Free tools and built-in security features (Windows Defender, router firewalls, automatic updates) provide significant protection. Cyber Essentials costs £320 for micro businesses.

Myth 4: "We've never been attacked so we're doing fine"
Reality: Most organisations don't know they've been attacked until months later. Attackers often gain access and lurk silently, stealing data or preparing ransomware deployment.

Myth 5: "Cyber security is just an IT problem"
Reality: 90% of successful attacks begin with phishing - a human problem, not a technical one. Cyber security requires business-wide awareness and leadership commitment.

Respond to a ransomware attack

Emergency response guide for ransomware attacks. Covers immediate containment, recovery options, reporting requirements, and ransom payment decisions. For businesses currently under attack or preparing for potential incidents.

Read guide

Report a cyber incident

Emergency response guide for reporting cyber attacks and data breaches. Covers who to contact (Report Fraud, ICO, NCSC, Police Scotland), what information to provide, legal deadlines, and what happens after you report.

Read guide

Get Cyber Essentials certified

How to achieve Cyber Essentials certification for your business. Covers the five technical controls, certification levels and costs, the assessment process, and requirements for government contracts.

Read guide