NCSC highlights how cyber incident sharing can meet market disclosure duties
NCSC explains how cyber incident information sharing can meet market disclosure obligations, with organisations responsible for case-by-case decisions.
The independent UK GRC reference desk
See the risk.
Own the decision.
Governance, risk and compliance (GRC) connects your responsibilities, risks and control evidence. Use practical UK guidance and a working review space for the decisions that matter.
Your notes stay in your browserHow the tools work ↗
YOUR GRC WORKSPACEIllustrative example
Quarterly reviewThe decisions.
The decisions.
The evidence behind them.
OverviewRisksControlsBoard pack
03Open actions
02Controls to review
01Connected record
RISK 01Review needed
Critical supplier disruption
Connect the risk to a control, its evidence and an accountable next step.
CONTROLRecovery exercise↳ACTIONConfirm recovery evidence
Fictional illustration · Your workspace starts empty
Built around primary sourcesReferences, not affiliations
FRCGovernanceHM TreasuryRisk managementICOData protectionNCSCCyber resilienceView source directory ↗Choose your next task
A useful route into the work.
Build the foundations
A clear starting point for your organisation.
Establish what applies, who is responsible and where the most important gaps sit. Work at a scale that fits your activities and resources.
- 1Set your scope
- 2Review your readiness
- 3Own the next actions
Follow the foundations playbook
Your working outputReadiness review → scoped action plan
Review a process
See whether the control works in practice.
Start with the risk, describe the expected control and identify evidence from actual operation. Keep what is missing as visible as what is working.
- 1Identify the risk
- 2Test the control
- 3Record the outcome
Plan a control review
Your working outputRisk → control → evidence → finding
Prepare a board pack
Give the next decision the right context.
Bring the material risks, evidence gaps and open actions together. Explain uncertainty and make the decisions requested from the board clear.
- 1Select the material issues
- 2Explain the assurance
- 3Record the decision
Open the board review playbook
Your working outputConnected records → board summary
The reference library
Connect the disciplines.
Keep the context.
01
Governance
Who decides, how decisions are made, and what supports effective oversight.
- Record a board decision that can be explained ↗
- Set risk appetite people can actually use ↗
- From a control list to board assurance ↗
02
Risk
What could affect your objectives, how you respond, and what the controls show.
- Build a risk register that supports decisions ↗
- Review suppliers across the whole relationship ↗
- Test controls and keep an evidence trail ↗
03
Compliance
What applies to your activities, who owns it, and how it becomes part of the work.
- Build an obligations register that changes the work ↗
- UK GDPR accountability and DPIA triage ↗
- AML scope and assurance: start with the activity ↗
From separate lists to a connected review
Keep the risk.
The control.
And the next step.
A working register is more useful when you can see what it connects to. Link risks, controls, obligations and actions, then bring them into a board pack that shows the gaps as well as the progress.
- Linked records with accountable owners
- Evidence gaps and untested controls made visible
- Reusable working copies and printable board packs
Browser-local working environment. No evidence uploads or independent verification.
ONE REVIEW. CONNECTED EVIDENCE.
01 / THE RISKWhat could affect your objective?
Define the exposure, its owner and your response.
02 / THE CONTROLWhat should happen in practice?
Connect operation, ownership and evidence.
03 / THE ACTIONWhat needs to happen next?
Bring the record into your board pack ↗Assign a specific outcome, owner and review.
Choose the working aid
Read. Review. Record.
A clear place for each part of the job.
Review your readiness
24 questions that make the evidence, gaps and uncertainties visible.
Start the readiness review ↗Start with a control
18 illustrative controls with operating prompts, evidence and sample tests.
Explore the control library ↗Keep a useful record
Twelve guided templates you can edit, reopen, export and print.
Open the template library ↗News & analysis
The development.
The decision it changes.
↗
FRC revises auditing standards for legal and regulatory non-compliance
Revised auditing standards set a risk-based approach, with application tied to financial periods beginning from 15 December 2027.
FCA consults on a second phase of SM&CR reforms
The regulator proposes changes to certification and senior management processes; responses are due by 22 January 2027.
Start with your context
Different organisations.
Relevant starting points.
Business owners & SMEs
Build proportionate controls around the work you actually do.
Your starter pack ↗Legal & notarial practices
Connect professional duties, client risk and matter evidence.
Your starter pack ↗Clinics & care organisations
Connect patient information, suppliers and operational continuity.
Your starter pack ↗Technology & service providers
Manage change, supplier dependencies and assurance requests.
Your starter pack ↗Our editorial promise
Read our standards ↗Visible sources. Clear limits. Useful records.
We separate the law, official guidance and suggested practice. Read with the scope, source date and evidence in view.
A useful place to begin
Know what needs attention.
Give it an owner.
Bring your responsibilities, risks and controls into one practical review. Leave with a clear next step.