Read with the right scope
UK market disclosure obligations for issuers affected by cyber incidents. This is not a universal permission to share sensitive information.
Status: Official explanation of existing obligations and guidance; no new commencement date.
What the NCSC highlighted
The NCSC has highlighted how work with industry and the FCA is helping listed organisations share cyber incident information while meeting market disclosure duties. Its 27 October post points to FCA guidance in Primary Market Bulletin 66, first published on 30 September.
The guidance explains that sharing incident information with the NCSC, or NCSC-led communities, may be compatible with UK Market Abuse Regulation obligations. The circumstances still matter: organisations remain responsible for assessing whether information is inside information and whether sharing it is lawful.
The status of the guidance
The FCA encourages issuers to alert recipients when information is or could be inside information and consider documenting what was disclosed and why.
This is guidance on applying existing obligations, not a blanket exemption from disclosure requirements. The new development is the NCSC’s explanation and continued engagement with industry.
Practical implication — editorial
For GRC teams, the practical priority is to connect incident response with legal, compliance and investor communications.
Part of the risk guidance hub. See how the GRC framework connects the disciplines.
Connect this to your review
Link the risk, control, obligation and next action in the review workspace. Record what is known, what needs checking and which decision follows. The workspace organises your records; it does not inspect or independently verify evidence.
Sources & verification
- NCSC — From industry concern to practical action: the value of working with regulators ↗Source published 27 October 2026 · Source checked 2 November 2026 · Primary source
- FCA — Primary Market Bulletin 66, section 4 on cyber incidents ↗Source published 30 September 2026 · Source checked 2 November 2026 · Primary source
The source list records when each reference was checked. AI-assisted research and drafting; no independent human legal review is claimed. Check for later changes and advice appropriate to your circumstances.