Is your business ready for 24-hour cyber incident reporting?
Many UK organisations are not, and the proposed rules would make that gap hard to ignore.
The Cyber Security and Resilience Bill, which at the time of writing is still moving through the House of Lords, would require covered organisations to notify their regulator within 24 hours of becoming aware of a significant incident, followed by a fuller report within 72 hours. The details and timetable may still change before it becomes law.
Early research suggests readiness is low. A survey of 156 IT, compliance and security professionals carried out in September 2026 found that only 10% were confident they could meet the proposed deadlines. A further 38% said they could in theory, but had never tested the process.
The technical side is only part of the challenge. Reporting within 24 hours means deciding quickly who is responsible, what is known, what is not yet known and what is said, to whom and in what order.
That is a communications question as much as a compliance one. In the first hours of an incident, a business may need to speak to a regulator, staff, customers, suppliers and, if the story becomes public, the media. If those conversations are being improvised, mistakes are likely.
Some practical questions every board and leadership team should be able to answer:
— Who decides that an incident is significant, and how quickly?
— Who speaks to the regulator, and who speaks to everyone else?
— Who is the named spokesperson if the story becomes public?
— Have we rehearsed this, or only written it down?
The organisations that will handle this best are those that treat communications as part of incident response, not a task for after the fact.
For cyber security specialists, there is also a real opportunity. As the rules approach, journalists and business audiences will want clear, practical explanations of what they mean. Experts who can provide them, accurately and without scaremongering, will be the ones people turn to.