If you work for a financial services firm and experience a security breach event, you must report it to the Financial Conduct Authority.
A breach event must be reported if:
- Results in significant loss of data, or the availability or control of its IT systems
- Impacts a large number of victims
- Results in unauthorised access to, or malicious software on, your information and communication systems
The FCA specifically recommends board-level NCSC-certified training to mitigate the risk of security breaches.