When you need us: new regulation
New regulation: what applies, by when, and the evidence the board can sign.
DORA, NIS2, the CAF, the FCA and PRA resilience rules. You want to know what actually applies, by when, and what the board is being asked to sign.
The moment
A rule has a date against it. Advice arrives in jargon, most of the people briefing you are selling something, and the cheapest reading of the rule and the most expensive one are both on the table.
What changes
You learn what applies to your firm, what does not, and by when. The work is delivered as a better way of operating rather than a mapping exercise, so that the evidence exists because the work happened. You spend on what the rule requires and on nothing else.
Where to read the rules
We advise on DORA, NIS2, operational resilience and the NCSC CAF. The frameworks page says what we advise on and what we do not claim.
What we have written about this
DORA isn't your problem. Your operating model is.
Firms treating DORA as a compliance-mapping exercise are building a paper fortress. It's really a test of how your firm behaves under stress, and most operating models fail that long before the ICT register does.
Why is the King obsessed with cyber?
The 2026 King's Speech carried far more cyber legislation than anyone expected — from the Cyber Security and Resilience Bill to reform of the Computer Misuse Act. What it contains, why now, and what it means in practice.