UK Incident Reporting Rules: What UK CISOs Must Build by 2027

New FCA and PRA rules requiring UK financial firms to report serious operational incidents and material third-party arrangements take effect March 2027 — CISOs must build the infrastructure now.

On 16 April 2026, the FCA and PRA published a joint policy statement introducing a new UK framework for operational incident and third-party reporting. The rules take effect on 18 March 2027, giving firms just under a year to build the data collection, escalation, and reporting infrastructure the new regime requires. The framework is designed to give regulators better visibility of operational disruption — including cyber incidents — and of firms’ dependencies on third-party service providers that could amplify systemic risk. For UK CISOs, this is not a compliance administrative exercise. It is a fundamental change to the operational resilience reporting obligations that require both technical infrastructure and board-level governance to be in place before the deadline.

What Exactly Do the New FCA and PRA Incident Reporting Rules Require?

The new rules establish mandatory reporting obligations across two pillars. The first covers serious operational incidents: firms must report to the FCA and PRA when an incident materially disrupts an important business service, breaches an impact tolerance, or has the potential to cause widespread harm to customers or financial stability. The reporting timeline is graduated — an initial notification must be made within two hours of the incident being classified as serious, with interim updates required at defined intervals and a final root-cause report submitted within a specified number of days after resolution.

The second pillar covers material third-party arrangements: firms must register with the FCA and PRA all material third-party service providers — including cloud providers, data processors, and outsourced IT infrastructure suppliers — and notify regulators of changes to these arrangements. This directly intersects with the FCA’s existing operational resilience framework under Policy Statement PS21/3, which required firms to map important business services and set impact tolerances by March 2022. CISOs who completed that mapping exercise now need to extend it to include incident classification logic and third-party dependency mapping at a level of granularity the new rules require. Use INFORMD’s operational resilience assessment tools to benchmark your current reporting readiness.

• Review your existing important business service mapping against the new incident classification criteria — not all disruptions will qualify as reportable serious incidents, and misclassification in either direction carries regulatory risk.
• Establish a two-hour incident classification and notification capability — this requires automated detection, triage tooling, and a pre-agreed escalation chain to the CISO, CEO, and board before notification is sent.
• Build a material third-party register that captures service criticality, impact tolerance dependency, and contractual notification rights for each provider.

Executive Action: complete incident classification criteria mapping and two-hour notification design by Q3 2026.

How Do the Third-Party Reporting Obligations Change the CISO’s Vendor Strategy?

The third-party reporting pillar of the new framework has significant implications for how CISOs manage vendor relationships. Under the rules, firms must be able to identify material third parties — defined as those whose failure or disruption could cause a firm to breach its impact tolerance — and report changes to those arrangements within defined timescales. This requires CISOs to maintain a continuously updated map of third-party dependencies, not a point-in-time inventory produced for audit purposes.

The practical implication is that every significant cloud migration, outsourcing decision, or technology vendor change must now be assessed against the materiality threshold before implementation — not just for procurement and legal review, but for regulatory notification purposes. According to Sidley Austin’s April 2026 analysis of the rules, firms should expect regulators to scrutinise the completeness of their third-party registers and the quality of their change notification processes in supervisory reviews from March 2027 onwards. CISOs who cannot demonstrate a real-time view of their material third-party landscape will face supervisory challenge. Access INFORMD’s cybersecurity and resilience briefing library for further guidance on third-party risk governance.

• Implement a continuous third-party monitoring programme that triggers materiality assessment for any new or changed vendor relationship — integrate this into the technology procurement governance process.
• Update supplier contracts to require immediate notification of the supplier’s own operational incidents, cyber events, or subcontractor changes that could affect service delivery — the rules require firms to report changes, but firms need data from suppliers to do so.
• Brief the Risk Committee on the top 10 material third parties by impact tolerance dependency — these are the relationships that carry the highest regulatory reporting risk and require the deepest due diligence.

Executive Action: integrate third-party materiality assessment into procurement governance before Q4 2026.

What Technical Infrastructure Do CISOs Need Before March 2027?

The two-hour initial notification requirement is the most operationally demanding element of the new framework. It assumes that a serious incident can be detected, classified as reportable, escalated to appropriate senior management, and formally notified to the FCA within two hours of classification. For most UK financial firms, this is a tighter operational window than current incident management processes are designed to meet. The average detection-to-classification time for a major cyber incident typically exceeds two hours in organisations without mature security operations centre (SOC) capabilities.

CISOs must invest in detection and triage automation that can compress the classification timeline. This means integrating threat intelligence feeds, automated impact tolerance breach detection, and pre-configured regulatory notification drafts into the SOC workflow. The FCA and PRA have indicated they will provide notification templates, but firms should not wait for final template publication before designing their notification workflow. The March 2027 deadline does not allow for a late-stage implementation sprint. Explore INFORMD’s technology strategy review templates to help frame the business case for SOC capability investment.

• Invest in SOC automation tooling that integrates impact tolerance thresholds into real-time monitoring — enabling automated classification of potential serious incidents as they develop, not after the fact.
• Design and test the end-to-end notification workflow — from detection to FCA notification — before the end of Q4 2026, running tabletop exercises that validate the two-hour capability under realistic incident conditions.
• Appoint a named regulatory reporting owner within the CISO function who is responsible for FCA and PRA notifications and who has pre-delegated authority to make the initial report without requiring CEO sign-off in the first two hours.

Executive Action: complete SOC automation investment and conduct end-to-end notification testing before year-end 2026.

How Should CISOs Brief the Board on the New Reporting Framework?

The new FCA and PRA reporting framework has board-level governance implications that go beyond the CISO’s operational brief. When a serious incident triggers a regulatory notification, the board must be informed — both because they carry fiduciary responsibility for operational resilience and because post-incident regulatory engagement may involve direct board-level accountability questions. The FCA’s Senior Managers and Certification Regime (SM&CR) assigns personal accountability for operational resilience to named Senior Managers. A regulatory notification made under the new framework may initiate a supervisory review that reaches the board directly.

CISOs should frame the new incident reporting rules not as a technical compliance exercise but as a change to the board’s accountability landscape. Board members need to understand what constitutes a reportable serious incident, how they will be informed when one occurs, and what their individual SM&CR responsibilities are in the response. Present the new framework at the next Risk Committee meeting with a clear governance map that identifies which SM&CR Senior Manager owns each element of the reporting obligation. Access INFORMD’s advisory team to discuss board-level SM&CR briefing support for incident reporting readiness.

• Present a board-level briefing on the new FCA/PRA incident reporting framework at the next Risk Committee meeting, covering what triggers a reportable incident, who is responsible for notifications, and how the board will be kept informed in real time.
• Map the new reporting obligations against SM&CR Senior Manager responsibilities — confirm which individual carries personal accountability for each element of the notification process.
• Conduct a full regulatory readiness review against the new framework by Q1 2027 — with documented evidence that all required capabilities are in place before the March 2027 effective date.

Executive Action: brief the Risk Committee on the new framework and assign SM&CR accountability before Q3 2026.

INFORMD provides intelligence briefings, tools and frameworks for senior business leaders across technology, finance, strategy and compliance. Based in Milton Keynes, UK, we help executives stay informed and act with confidence. Explore our full briefing library or access our free assessment tools.

Stay ahead. Subscribe to INFORMD’s weekly executive briefing at informd.co.uk.