What happened
The UK National Cyber Security Centre (NCSC) and the Financial Conduct Authority (FCA) collaborated with industry groups to address uncertainty around sharing cyber‑incident information by publicly listed firms. High‑profile retail breaches demonstrated that timely sharing can protect other organisations that share technology and supply‑chain dependencies. The joint effort resulted in practical guidance that outlines when and how companies can disclose threat intelligence to the NCSC or trusted information‑sharing communities without violating the UK Market Abuse Regulation (MAR). The guidance emphasizes operational realities, regulatory obligations, and the need for clear decision points within incident‑response processes.
Why it matters for trust and compliance
- This guidance validates the control objective of coordinated incident response and regulatory communication, a single control that maps to governance requirements across frameworks such as NIST CSF 2.0.
- Documented evidence of compliant information sharing can be used as audit‑ready proof of governance controls.
- Continuous monitoring of disclosure decisions helps demonstrate ongoing regulatory alignment.
Who is affected
Retail organisations Publicly listed companies subject to UK MAR
Recommended actions
- Update incident‑response playbooks to embed the NCSC‑FCA guidance and record disclosure decisions.