From policy to proof: the cost of failure after PS26/2

Financial services firms understand risk. Not just how to identify it, but how to quantify and mitigate it in a way that adds up. When it comes to cyber security, the latest FCA requirements have made this more forensic – less about the art of policy, more about the science of practice.

This highlights what was true all along: the calculation that really matters is not the cost of service, but the cost of failure.

What this means for financial services firms is being able to show that their cybersecurity policies are backed by evidence. Provable controls, tested in the real world, with data demonstrating that both prevention and response measures are fit for purpose.

Unfortunately, this information is needed most urgently when it’s least convenient – following a cybersecurity incident. At short notice, when you need to be focusing on competing priorities and the last thing you need is to pull together piecemeal evidence of a policy with your name on it. PII insurers, the FCA and the board are all demanding different answers to the same question: can you prove your policy translated into practice?

 

The importance of showing your workings

Cybersecurity incidents happen. In a post-incident scenario, the question is less “how was this allowed to happen?” but more “had you taken reasonable steps to mitigate this risk and can you prove it?” Why you invested where you did, why not more in other areas, and how you justify your confidence in those investments being the right ones.

The wrong answers mean higher premiums, operational disruption, and unhappy clients.

You need to be able to clearly answer whether an incident was within your identified highest risk areas. This means having a documented, prioritised view of where budget and attention are focused.

Without this, you’re having to reconstruct priorities and decisions under pressure. The questions are likely being asked by people looking to you for reassurance that all reasonable steps have been taken.

The bar for this is rising. Cyber Essentials declares policies that meet a recognised baseline, but more firms are looking to Cyber Essentials Plus. The reason for this is proof-based: CE+ involves an independent technical audit that proves operational reality matches the promises of your policies.

The value of both of these is they go some way towards justifying your promise to your customers, your insurers, your regulators and your board.

 

Checking your answers

The importance of regular testing and regular re-certification is that it identifies gaps. These might be things that were missed or have emerged since you last checked, but they could equally be areas where something you have identified and planned for isn’t working as intended.

From March 2027, the regulatory notification obligations of PS26/2 kick in. Your business does not want to find itself in a situation where it is responding to an incident, rushing to meet these new requirements, and discovering that your plan didn’t survive contact with reality.

This is something occupying the minds of many industry CISOs. When an insurer or regulator comes knocking and the dust still hasn’t settled, what can your business produce – on demand – to minimise the damage? That means being able to answer:

• What was your risk-ranked cybersecurity strategy, and does it predate the incident?
• Do you have certificates proving independent audit of the measures that strategy outlines?
• Can you prove you’d tested those measures operationally prior to having to use them in anger?

The cost of being unable to answer these questions can be significant. Reputational damage, FCA and ICO financial penalties, and extended business disruption mean inaction is never the cheapest option. Spending now isn’t an overhead, it’s an investment – one made at your own pace, rather than in the frantic aftermath of an incident.