FCA cyber security requirements in 2026: what firms must actually do
What the FCA expects on cyber security, the rules behind it, PS26/2 incident reporting from March 2027 and the controls smaller firms need.
8 min read · Reviewed 15 October 2026
Cyber incident response for UK regulated firms: the first 72 hours
What to do in the first hour and who to notify, and by when: FCA, PRA, SRA, ICO, NCSC, Report Fraud, your bank and your insurer.
8 min read · Reviewed 15 October 2026
Cyber security for law firms: SRA expectations, payment diversion and email compromise
What the SRA expects, when to report an attack, how payment diversion works and the controls that stop it.
8 min read · Reviewed 15 October 2026
IT and cyber security for IFAs, wealth managers and brokers: a practical guide
The rules, the real risks, a sensible baseline for a 5 to 50 person firm and what to ask your IT provider.
7 min read · Reviewed 15 October 2026
FCA and PRA IT requirements: what regulated firms need to evidence
A plain-English guide to UK operational resilience (SYSC 15A and SS1/21), outsourcing (SYSC 8 and SS2/21), the new incident and third-party reporting rules, and the evidence a regulated firm should be able to show.
7 min read · Reviewed 25 September 2026
Microsoft 365 governance for regulated firms: a practical baseline
How to govern Microsoft 365 in an FCA-, PRA- or SRA-regulated firm: identity, devices, data, logging and licences, with a 30-day order of work.
4 min read · Reviewed 25 September 2026
Cyber Essentials for UK regulated firms: what changed in 2026 and why it matters
What Cyber Essentials covers, what changed in April 2026, why it matters to FCA- and SRA-regulated firms, and how it compares with ISO 27001 and the regulators’ own rules.
4 min read · Reviewed 25 September 2026
ISO 27001 for regulated firms: how it supports FCA, PRA and SRA expectations
What ISO/IEC 27001:2022 certifies, how its controls map to FCA, PRA and SRA expectations, and how to read a supplier’s certificate.
4 min read · Reviewed 25 September 2026
IT audit readiness for regulated firms: an evidence-first checklist
How to be ready when a regulator, auditor or client asks for proof of your IT and security controls: the evidence pack, a mock audit and a six-week plan.
3 min read · Reviewed 25 September 2026
IT vendor and outsourcing management for FCA, PRA and SRA regulated firms
How to manage IT providers when you are regulated in the UK: a register, tiering, due diligence, contract terms, ongoing oversight and the new third-party reporting rules.
4 min read · Reviewed 25 September 2026
