NCSC highlights clearer routes for sharing cyber incident information

01What changed

On 27 October 2026, the NCSC described its work with industry and the Financial Conduct Authority to reduce uncertainty about sharing cyber incident information. The focus includes organisations concerned that incident details may be market-sensitive.

The NCSC points to the FCA’s existing Primary Market Bulletin 66. Its cyber section explains that sharing information with the NCSC in connection with the agency’s functions may be consistent with an issuer’s duties. Organisations must still assess their own circumstances and relevant disclosure obligations.

02Why it matters

Our practical interpretation: deciding who can approve an incident update during an outage wastes valuable response time. Smaller suppliers working with listed customers can also benefit from knowing who receives technical facts, who decides contractual notifications and who authorises wider statements. A named contact and agreed route make that coordination easier.

03What to do

CyberScan practical checklist: apply these steps to your own services and responsibilities.

1. Identify the person responsible for incident coordination and the people who assess legal, regulatory and customer-notification obligations.
2. Prepare a short factual incident record: what is confirmed, what remains uncertain, affected services, timestamps and the next review point.
3. Use the relevant authority’s verified reporting route and an agreed secure channel for sensitive detail.
4. For an issuer considering sharing inside information, the FCA encourages telling recipients about its status and confidentiality. Record what was shared and the justification for disclosure.
5. Revisit decisions as the incident develops; an early assessment may need to change when new facts emerge.

04Limits

The FCA material concerns issuers’ market-disclosure obligations and does not establish a universal reporting rule for every small business. A report to one organisation does not settle other duties. Obtain advice on the circumstances before deciding whether information can be withheld, delayed or shared more widely.