Are we mistaking regulation for resilience? | Computer Weekly

"As security leaders in the UK, we often feel squeezed between an increasingly aggressive threat landscape and a sprawling legislative framework. A new assessment of the UK's cyber security legislative framework confirms what many of us discuss over drinks at industry conferences: we are drowning in compliance obligations, yet the nation's cyber resilience remains alarmingly fragile. For my peers across the UK, this report offers five critical takeaways that should shape our future strategies."

"While the UK General Data Protection Regulation (GDPR) theoretically threatens UK businesses with massive penalties, the Information Commissioner's Office (ICO) issued only three fines in 2024, often favouring reprimands instead. Even more striking is the enforcement void regarding the Network and Information Systems (NIS) Regulations. Despite a significant rise in incident notifications, freedom of information data indicates a near-total absence of formal sanctions by key competent authorities between 2021 and 2024 ( see table)."

"This leads to the second - and perhaps most worrying - trend: the disengagement of the board. The UK has seen a measurable decline in executive ownership. The percentage of businesses with a board member holding explicit responsibility for cyber security has dropped from 38% in 2021 to just 27% in 2025. This knowledge will significantly impact how seriously our executives treat privacy and security moving forward."

UK security leaders face a growing mismatch between extensive compliance obligations and limited regulatory enforcement, leaving national cyber resilience fragile. The ICO issued only three fines in 2024 and NIS enforcement shows a near-total absence of formal sanctions despite rising incident notifications. Weak enforcement undermines internal business cases for security investment and reduces incentives for boards to act. Executive ownership of cyber responsibilities has declined, with board-level accountability falling from 38% in 2021 to 27% in 2025. Legislative efforts like the Cyber Security and Resilience Bill failed to establish statutory board accountability or prevent CISOs from becoming scapegoats.

Read at ComputerWeekly.com