From industry concern to practical action: the value of working with regulators

Sharing cyber incident information quickly, while responding to an incident, is an important contributor to UK cyber resilience.

High-profile incidents in the retail sector highlighted the value of timely cyber incident information sharing, not just within the retail sector but with other sectors too. Organisations often rely on the same technologies, suppliers, and digital supply chains, meaning an incident affecting one organisation or sector may expose similar vulnerabilities elsewhere. Sharing information enables organisations to learn, adapt, and defend themselves against common threats before they cause further harm.

Organisations can share cyber incident information with the NCSC and through trusted information-sharing communities. However, information sharing often takes place under significant operational, legal, and commercial pressures. For some organisations, questions about regulatory obligations can create hesitation at exactly the point where timely information may be most valuable to others.

This blog describes how industry, the NCSC, and the Financial Conduct Authority (FCA) worked together to better understand one such challenge, and how that collaboration helped provide greater clarity for organisations seeking to share cyber incident information responsibly.

Source: UK NCSC (Cyber) (2026-10-27)