You are in the
right place.

The FCA does not accept "the IT team handled it" as a defence. If your firm's Chief Operations Officer, Chief Technology Officer, or equivalent is the Senior Manager responsible for systems and resilience, they carry personal liability for infrastructure failures — including those caused by inadequate cyber controls, unpatched systems, or absent backups.

• Documented allocation of IT governance responsibility to named Senior Managers
• Regular board-level reporting on cyber risk posture and infrastructure health
• Evidence of proactive oversight — not reactive response after an incident
• Third-party IT contracts with clearly defined responsibilities and SLAs

The FCA requires you to know what would break your firm, how long you could survive it, and to have tested and documented that you can recover within your stated tolerance. A firm that has set tolerances but never tested them is non-compliant.

• A documented mapping of important business services and their technology dependencies
• Defined maximum tolerable disruption periods for each service
• Tested recovery scenarios with documented outcomes — not theoretical plans
• Annual self-assessment submitted to the FCA where required

CASS compliance is not just an accounting function. It depends on your systems being able to maintain accurate, reconciled records of client positions at all times. A ransomware attack, database corruption, or unrecoverable backup can render a firm unable to demonstrate CASS compliance — triggering immediate FCA notification obligations and potential enforcement.

• Immutable, isolated backups of all client position and reconciliation data
• Recovery testing that validates CASS records can be restored accurately and quickly
• Access controls ensuring only authorised users can modify client asset records
• Audit trails sufficient to reconstruct positions in the event of a dispute or investigation

Until now, firms could certify by answering yes/no questions about their controls. From April 2026, you must provide configuration logs, serial numbers, and documented evidence for every control — every firewall, every device, every cloud service in scope.

• Cyber insurance increasingly requires Cyber Essentials at renewal — without it, premiums rise or cover is declined
• The FCA references Cyber Essentials as a baseline within its operational resilience guidance
• Government contracts and some institutional counterparties now require certification as a condition of engagement

The ICO's 72-hour notification window and the FCA's prompt notification requirement run concurrently. Firms that are slow to detect, slow to scope, or slow to report face enforcement action from both regulators simultaneously.

• Active breach detection — not just perimeter controls
• Encrypted storage of all client personal and financial data
• Endpoint activity records that allow rapid scoping of what was affected
• A clear incident response process with technically supported detection and scoping

• MFA enforced on all email, remote access, and cloud accounts — universally, not selectively
• Immutable backups tested and isolated from the primary network
• Patch currency — all systems within the 14-day critical patch window
• Endpoint protection active and monitored on all devices accessing firm or client data

A refused insurance claim during a cyber incident leaves a financial firm simultaneously managing: FCA notification, ICO notification, client communication, system recovery — and funding the entire response out of its own capital. For firms of 10–100 people, this is frequently existential.