We share a short weekly roundup of developments in operational resilience, cyber resilience and business continuity, drawn from regulators, standards bodies and respected industry outlets. Check back for the latest.
A cyber incident does not end when the first public statement is issued. Organisations also need a way to revise decisions and communications as the evidence develops.
On 14 October, the Legal Aid Agency published a further update about the cyber-attack identified in April 2025. It said detailed digital analysis had refined its understanding of the date range and types of information exfiltrated. Approximately 250,000 records predated 2007, and some probation data was also identified in the material taken.
The Agency said the attack affected complex digital systems and significant volumes of information, much of it unstructured, fragmented or incomplete. That made analysis complex. It also stressed that falling within a listed group or date range does not, by itself, mean an individual's information was exfiltrated. At the time of the update, it had no indication that the stolen data had been published or shared.
AV Resilience interpretation
For regulated organisations and critical-service providers, the practical lesson is about managing uncertainty, not assuming this incident predicts their own exposure. An initial assessment needs clear ownership, an evidence trail and a route for changing decisions when new facts emerge.
Test these questions in your next incident exercise:
- Who owns the record of what is confirmed, what is provisional and what is still unknown?
- Can teams trace a revised data assessment to the services, suppliers and people potentially affected?
- Who decides whether new evidence changes notifications, customer communications or recovery priorities?
- Can the response team update its message consistently without presenting an earlier assumption as a confirmed fact?
What AV Resilience can do
AV Resilience Consulting can help review incident leadership, decision rights and communications arrangements, then exercise a scenario in which the assessed scope changes during the response. The work can connect business impact analysis and dependency mapping with the decisions leaders need to make under pressure, producing a prioritised improvement plan rather than another untested document.
Primary source
Legal Aid Agency: cyber security incident data update, 14 October 2026
AV Resilience Consulting | 12 October 2026
Scope first: which sectors and businesses would need to comply?
Once its relevant provisions and implementing regulations take effect, the Cyber Security and Resilience (Network and Information Systems) Bill would update duties for organisations already covered by the NIS Regulations 2018 and bring additional categories into scope. Existing NIS duties continue in the meantime.
Existing coverage includes qualifying operators of essential services in energy, transport, health, drinking water and digital infrastructure, alongside relevant digital service providers such as cloud computing services, online marketplaces and online search engines. Coverage depends on the service definitions, thresholds and exemptions, not simply the sector a business operates in.
The proposed new categories are:
- UK data centres with at least 1 MW of rated IT load, or at least 10 MW for enterprise data centres serving only their own undertaking. Ofcom would regulate the new data-infrastructure category.
- Relevant medium and large managed service providers providing ongoing contractual IT management or cyber-security services with access to customers' systems. Overseas providers serving the UK can be covered. The Information Commission, commonly known as the ICO, would regulate them.
- Large load controllers with potential electrical control of at least 300 MW across relevant energy-smart appliances. This is controllable electrical load, not a business's ordinary electricity consumption.
- Critical suppliers designated by regulators where disruption to their systems could have significant consequences for essential, digital or managed services and the UK economy or day-to-day society. Designation would follow statutory criteria; it is not automatic for every supplier.
Who would not automatically be covered?
The Bill would not impose the same duties on every UK business, every IT consultancy or every supplier. It would not bring all financial-services companies, pharmaceutical businesses or AI developers into NIS merely because they operate in those sectors.
Small and micro managed service providers are generally excluded from the direct MSP category, but could potentially be designated critical suppliers. A company's precise service, size and group position need to be assessed against the legal definitions.
Businesses outside direct scope may still feel the effect through their data centres, cloud providers, managed services and other critical dependencies. The Bill sits alongside existing sector-specific regimes, including financial-services resilience regulation.
What is the Bill intended to do?
Its focus is the continuity and security of services that society and the economy depend on, including the infrastructure and suppliers behind them. It would expand the NIS regime, broaden incident reporting, strengthen enforcement and give government powers to update the framework and respond to national-security risks.
As at 12 October 2026, it is still before Parliament. The latest text is HL Bill 49, as amended in Grand Committee on 7 September. Lords Report stage is scheduled for 26 October, subject to changes in parliamentary business. The Bill is not yet an Act, and there is no verified general compliance start date.
Incident reporting and enforcement
Qualifying incidents would require an initial notification within 24 hours of awareness, followed by a full notification within 72 hours, to the relevant regulator and NCSC. These are reporting deadlines, not recovery targets.
The reporting tests would cover significant effects on system operation or security and likely impacts, rather than only service disruption already experienced. Data centres have a distinct test that also includes incidents which could have had significant impact. Relevant providers would need to identify and notify customers likely to have been adversely affected.
For undertakings, proposed maximum NIS penalties would be the greater of £10 million or 2% of worldwide turnover in the standard band, and £17 million or 4% in the higher band. These are ceilings for breaches, not automatic fines for suffering an attack. Severity, proportionality, mitigation and further turnover rules matter.
Where does AI fit?
The current Bill does not expressly add all AI products and services to the regulated categories. Nor does it create a general AI licensing regime or a standalone AI "kill switch" law.
Its approach is technology-neutral. If an essential service relies on AI within its systems, relevant risks still need to be managed. In the Lords debate on 1 September, the minister explained that national-security directions could require a regulated entity to cease using and isolate an AI model where the legal conditions are met.
Peers proposed wider AI controls, including explicit AI-service coverage. That amendment was withdrawn. Proposed amendments and government discussion must not be presented as duties already in the Bill.
Timeline and preparation
Introduced in November 2025, the Bill completed its Commons stages in June 2026 and was amended in Lords committee in September. The next scheduled stage is Lords Report on 26 October.
After Royal Assent, commencement would be phased. Many operational duties would depend on secondary legislation, consultation, technical detail and an adjustment period. Businesses should monitor that process rather than treat a parliamentary date as their compliance deadline.
Preparation should begin with the services and dependencies: identify possible scope, review system and supplier risks, test recovery arrangements and rehearse incident assessment and notification.
At AV Resilience Consulting, we help organisations assess whether the Bill could cover their services or suppliers, map the dependencies that would become critical, and rehearse incident assessment and notification against the proposed 24-hour and 72-hour windows. Once duties take effect, we test whether the recovery and reporting evidence regulators would expect can actually be produced under pressure.
Discuss your priorities and how we work: https://www.avresilienceconsulting.com/how-it-works
Could your organisation identify a serious incident, assess its wider impact and notify the right people within 24 hours?
Primary sources
DSIT summary and implementation
Resilience this week: exploited edge systems, CNI threats and electricity restoration
29 September 2026 | AV Resilience Consulting
Three developments from 22-28 September show why cyber response, physical security and service restoration need to be planned together.
Actively exploited Citrix vulnerabilities. On 28 September, the UK's National Cyber Security Centre (NCSC) warned organisations to promptly mitigate vulnerabilities in on-premises Citrix NetScaler ADC and Gateway. It said two, CVE-2026-88771 and CVE-2026-88772, are being actively exploited. The US Cybersecurity and Infrastructure Security Agency (CISA) has added both to its Known Exploited Vulnerabilities catalogue. NCSC advises affected organisations to read the vendor bulletin and indicators of compromise, consider isolation where possible, investigate for compromise, update and keep monitoring. Isolation can interrupt service, so response teams should coordinate security action with continuity and recovery plans rather than treating patching as a purely technical change.
Government briefings for critical infrastructure. On 25 September, the Cabinet Office and Ministry of Defence announced plans for closed-door briefings with industry bodies representing Critical National Infrastructure (CNI) providers and defence companies on threats posed by Russia. The announcement names cyber attacks and sabotage among the risks. This is an announcement of planned briefings, not a claim that a specific new incident has affected an operator.
Learning from electricity restoration. On 25 September, the National Energy System Operator (NESO) described an exchange with Portugal's transmission operator REN on system resilience, severe weather, restoration planning and the challenges of the energy transition. This is a useful example of operators testing assumptions against real operational experience; NESO did not announce a change in the UK restoration standard.
AV Resilience interpretation: The common test is whether an organisation can protect its essential service while it contains a threat, loses a dependency or restores a complex system. Boards and response teams should know which externally exposed systems and suppliers support their important services, who can authorise emergency isolation, what manual or alternative capacity exists, and how restoration will be rehearsed with operators and partners. For energy organisations, that means linking cyber incident playbooks to operational technology, control-room and system-restoration arrangements rather than keeping each plan in a separate silo.
On the policy radar: Ofgem opened a call for input on gas connections and access arrangements on 24 September (responses due 21 October), and consultations on electricity connections data and the connections experience on 25 September (responses due 6 November). They are proposals and evidence-gathering, not final rules.
A telegram once felt almost miraculous. In 1858, a cable across the Atlantic let Queen Victoria and President James Buchanan exchange greetings without waiting for a ship to carry their words. The line failed within weeks. Engineers tried again, and a lasting link was established in 1866. By 1902, a cable network connected parts of the British Empire around the world. The "All-Red Line" was an instrument of commerce and power, planned around its routes and landing points. In the opening days of the First World War, Britain cut German transoceanic cables. The route a message takes has never been politically neutral.
This physical contest is the subject of two new books: Katja Bego's Deep Connections: The Hidden Battles to Control Subsea Cables, published by Polity this month, and Elisabeth Braw's forthcoming The Undersea War: The International Battle for Supremacy at the Bottom of the World. Bego describes her book as examining cable geopolitics, from the technology race to state power. Braw's publisher says her forthcoming book also covers subsea energy cables and pipelines. Both point to a timely issue. Neither book's title should make us treat every break as an act of war.
Today we talk about the cloud as if information floats free of geography. It does not. Data centres sit on land, draw power and exchange traffic through fibre. More than 99% of international data traffic runs through submarine telecommunications cables, according to the International Telecommunication Union. They are the main routes for a video call, bank instruction or government service crossing a border. A cloud service can be beautifully designed and still rely on a physical landing station, a power supply and a cable repair ship.
Cable faults are common without any hostile actor. The ITU reports roughly 150 to 200 a year worldwide. Fishing gear and dragged anchors are leading causes; earthquakes, underwater landslides, ageing equipment and abrasion also matter. Near shore, where ships and fishing boats work, cables are especially exposed. The question is whether a second route, enough capacity and a repair plan are ready when one fails.
Recent events show different forms of the problem. In March 2024, multiple failures off West Africa disrupted internet connectivity across several countries. Cloudflare also recorded problems reaching Microsoft Azure and Office 365 services. Damage at sea can be felt at a desk hundreds of miles inland. In the Red Sea that year, four communications cables were damaged; operator HGC said it rerouted traffic and estimated the cuts affected a quarter of traffic through that corridor. The cuts occurred amid attacks on shipping, but that does not establish their cause. Repair can be slower when ships cannot safely reach the site.
The Baltic has raised a harder security question. In late 2024, investigators found long anchor-drag marks near damaged power and telecommunications cables after the tanker Eagle S passed through. Other incidents prompted suspicion of deliberate interference. NATO launched Baltic Sentry in January 2025, adding ships, aircraft and other surveillance to protect undersea infrastructure. Yet suspicion is not a verdict: a Swedish prosecutor concluded that the Vezhen's January 2025 damage to a Sweden-Latvia cable was accidental, and a Swedish accident inquiry found no conclusive evidence that the Yi Peng 3 deliberately damaged two cables in November 2024. An anchor can be an accident, negligence or a weapon; evidence must decide which.
There is a genuine state-threat dimension nonetheless. In January 2025, the UK defence secretary said the Russian vessel Yantar was gathering intelligence and mapping critical underwater infrastructure near Britain. Monitoring a ship is not proof that it cut a cable. It is a reason to understand where critical routes converge, who can reach them and how quickly suspicious activity can be detected. Attribution matters, both to hold a perpetrator to account and to avoid escalating on the basis of rumour.
Islands and places with fewer routes are particularly exposed. When both main cables linking Taiwan's Matsu islands were broken in January 2025, Taiwan's digital ministry activated microwave backup and satellite capacity, prioritising government, banks and hospitals. It described the failure of one cable as likely related to ageing, not an attack. Taiwan's wider assessment identifies anchor damage near shore and natural hazards offshore. Geography, shipping patterns and a small number of landing points can matter as much as hostile intent.
Who pays when connectivity is lost? The obvious answer is network operators, but the effects spread. A payment may not settle; a trader may not see a price in time; a manufacturer may lose access to a supplier's system; a student or patient may be unable to reach a service; a family may not reach someone abroad. Governments and emergency responders need trusted communications. Disruption is rarely evenly shared. A densely connected country can often reroute, perhaps with slower service and higher cost. A remote community, an island or a smaller economy may have little spare capacity. One cut need not "take down the internet" to cause serious local harm.
Protection is therefore a matter of layers, not one naval patrol or one stronger cable. Map the routes and landing points on which essential services actually depend. Put genuinely separate paths in place, rather than buying two services that meet at the same beach or exchange. Bury and mark cables where appropriate, work with mariners and fishers, monitor vessel activity, and protect landing stations. Make repair agreements, spare parts and permits ready before a fault. Diversify with terrestrial, microwave or satellite links where they can carry the priority traffic, but test their real capacity. NATO's patrols and Taiwan's backups tackle different parts of the same problem; neither makes failure impossible.
Organisations need to ask a less comfortable question of their cloud providers and themselves. If a region, landing station or international route fails, where does the workload run, where is the data, and what does it cost in time and service to switch? Does an application require a foreign identity service to let a local worker sign in? Can staff keep a minimum service running with delayed data? A diagram of duplicate servers is not a test of the whole chain. Exercise the loss of a route, including payment, authentication, suppliers, customers and communications. Decide what must come back first.
The telegram became an email, a transaction and a video call. The physical dependency survived. We do not have to regard every damaged cable as sabotage, or pretend that more cables make us invulnerable. But we should stop describing digital life as weightless. Which links would your household, service or country miss first? And have you tried living without them for an afternoon, before the sea makes the choice for you?
Ofgem has put electricity network supply-chain resilience firmly on the agenda. In an update published on 16 September, the regulator said the expansion of Great Britain's electricity network cannot be delivered without a resilient supply chain.
Responses to Ofgem's call for evidence pointed to several recurring issues: credible long-term demand visibility, clear treatment of risk and cost recovery, greater transparency in how network companies allocate supply-chain spend, and proportionate reporting used as a diagnostic tool rather than a target.
Ofgem does not currently see a case for prescriptive local-content targets or broad new procurement rules. Instead, it plans guidance to help network companies consider growth, resilience and long-term consumer benefit in procurement decisions, alongside further work on the design of reporting.
That direction is reinforced by new government guidance to the Gas and Electricity Markets Authority. It asks Ofgem to consider how regulation can support domestic capability, energy security and resilience in supply chains and skills, while maintaining value for money and delivery confidence. The guidance also points directly to the potential cost of delay, shortage, outage and future supplier concentration.
What this means for network operators and their suppliers: the issue is wider than where equipment is manufactured. A resilient supply chain depends on understanding which suppliers, components, specialist skills and logistics routes are critical to the continued delivery and recovery of essential services.
Organisations should be able to answer:
- Which assets and services have long replacement or repair lead times?
- Where are there single suppliers, geographic concentrations or limited substitutes?
- Which supplier failures could disrupt an important service or breach an impact tolerance?
- What stock, alternative sourcing, contractual rights and recovery arrangements are genuinely usable during disruption?
- Can procurement, engineering, operations and crisis teams access the same dependency information under pressure?
AV Resilience view: Ofgem's direction suggests supply-chain resilience evidence will become more visible in electricity-network procurement and reporting. The practical opportunity is to connect procurement data with operational resilience: map critical dependencies, assess concentration and failure scenarios, set recovery assumptions, and test the response before an outage or shortage exposes the gap.
A supplier register is useful. A tested view of how a critical asset or service can be sustained and recovered is what makes it resilient.
The countdown to the UK's new operational incident and material third-party reporting regime is now well under way. The FCA, PRA and Bank of England rules take effect on 18 March 2027, giving affected firms roughly six months to complete their preparation.
The direction is clear: reporting should be faster, more consistent and less fragmented across regulators. Under the new regime, firms will use a standardised process and a single submission route. For operational incidents, reports will be triggered where defined thresholds are met. Most FCA solo-regulated firms will use a standard report, while a smaller group will follow enhanced reporting requirements.
The third-party requirements are also significant. Firms in scope will need to notify the FCA when entering into, or significantly changing, a material third-party arrangement. They will also maintain and submit an annual register of material arrangements. The definition extends beyond outsourcing to other third-party services whose disruption could cause serious harm or threaten a firm's resilience or the wider financial system.
The case for preparation is not theoretical. The FCA says that over 40% of cyber incidents reported to it in 2025 involved a third party. That makes accurate service mapping, clear ownership and usable supplier information part of incident readiness, not simply procurement administration.
What firms should do now:
- Test the thresholds using realistic cyber, technology failure and supplier disruption scenarios.
- Clarify who makes the materiality judgement, approves the submission and keeps regulators updated.
- Map parallel duties under UK GDPR and, where relevant, DORA, so teams do not produce conflicting assessments or duplicate evidence under pressure.
- Check third-party registers link providers to important business services, dependencies, concentration risks and exit or continuity arrangements.
- Rehearse evidence capture so incident teams can collect the required facts while still managing recovery.
AV Resilience view: the new forms matter, but this should not be treated as a forms project. The real test is whether governance, incident management, operational resilience and third-party risk teams can make a sound threshold decision quickly, using consistent evidence, during a live disruption. A short scenario exercise before March 2027 can expose unclear decision rights, missing supplier data and competing notification timelines while there is still time to fix them.
Occasional plain-English updates on PS26/2, DORA, Ofgem and other UK operational resilience rules, and what they mean in practice. No sales emails. Unsubscribe at any time.
