#incident reporting

For the first time, UK managed service providers face statutory security duties and a two-stage incident reporting regime. The Cyber Security and Resilience Bill has cleared the Commons and is progressing through the Lords. Here is what MSPs should be doing now.

The European Supervisory Authorities have published the first annual report on major ICT incidents under DORA: 3,383 reports in 2025, most from the credit and payments sectors. Here is what the numbers show, and why the 4-hour reporting clock depends on people as much as process.