Member

I note that the noble Viscount’s central concern is the possibility that this reporting could be followed by enforcement action and that this would disincentivise reporting. In that context, where a regulated entity has taken appropriate and proportionate steps to manage the risks in its system and has experienced a ransomware attack despite these precautions, there is unlikely to be any reason for enforcement action under the regulations. Regulators would always take into account the security measures that an organisation has put in place.