1. Executive summary
The NCSC reports that FCA guidance now clarifies when publicly listed organisations may share cyber incident information with the NCSC, government bodies, law enforcement, regulators and trusted information-sharing communities while meeting UK Market Abuse Regulation obligations. Sharing with the NCSC may be compatible with those obligations where it occurs in the normal exercise of employment, profession or duties, but each organisation remains responsible for assessing its circumstances. EMEA financial services firms with UK-listed entities should update incident-response and disclosure procedures so uncertainty over inside information does not delay approved operational sharing. No CVE, CVSS score, CISA KEV state, technical compromise or threat-actor attribution applies to this policy item.
2. Regulatory framing
No specific DORA/NIS2 article is directly engaged by this item.
3. Technical analysis & attack chain
This is regulatory and operational guidance, not a cyberattack or vulnerability disclosure. No attack chain, affected product, malware, persistence mechanism, command-and-control channel, lateral movement method or data-exfiltration activity is reported.
The issue arose because publicly listed organisations may need to decide whether cyber incident information is market-sensitive or inside information. Some organisations were uncertain whether they could share such information with the NCSC or trusted communities while continuing to meet UK Market Abuse Regulation obligations. That uncertainty could delay the circulation of information about common technologies, suppliers, digital supply chains and mitigations during an incident.
The NCSC states that it worked with the FCA and industry to address this problem. The resulting FCA guidance covers disclosure obligations for inside information relating to cyber incidents. It also addresses sharing with government departments, law enforcement, regulators and trusted information-sharing communities.
According to the NCSC, sharing incident information with the NCSC may be compatible with an organisation's regulatory obligations when it is consistent with the normal exercise of employment, profession or duties. The guidance also recognises NCSC-led information-sharing communities where information can help other organisations prevent or mitigate cyber threats.
This does not create blanket permission to distribute market-sensitive information. Each organisation must assess the incident, the proposed recipient, the purpose of disclosure and its own legal obligations. Incident-response teams therefore need an agreed route to legal, compliance and disclosure specialists during active incidents.
The account is single-sourced to the NCSC publication supplied for this advisory. The related material duplicates the same publication and provides no independent corroboration.
4. Mitigation & containment
- P1, within 24 hours: Identify active cyber incidents involving a publicly listed UK entity where concerns about inside information are delaying sharing with the NCSC, regulators, law enforcement or an approved community. Escalate each decision to the designated legal, compliance and incident-command owners.
- P1, within 24 hours: Issue an internal instruction that the FCA guidance permits a case-specific assessment of NCSC sharing. Staff must not interpret it as automatic permission for unrestricted disclosure.
- P1, within 24 hours: Record the information proposed for sharing, its recipient, operational purpose, approving functions and decision time. Preserve this record with the incident chronology.
- P2, within 72 hours: Update incident-response and market-disclosure procedures to define who assesses whether incident information may constitute inside information and who approves disclosure to each external recipient.
- P2, within 72 hours: Establish an expedited consultation path between the security operations centre, incident response, legal, compliance, company secretariat and corporate communications functions. Define named deputies for out-of-hours incidents.
- P2, within 72 hours: Review membership and access controls for trusted information-sharing communities. Confirm that participants know which channels are approved and how sensitive submissions must be handled.
- P3, within seven days: Run a tabletop exercise in which a cyber incident affects a shared supplier or technology and may contain market-sensitive information. Test whether the organisation can reach, document and execute a sharing decision without delaying incident containment.
- P3, within seven days: Review recent incidents where legal or regulatory uncertainty prevented or delayed external sharing. Determine whether updated procedures would change those decisions and retain the analysis for governance review.
5. Indicators of compromise
No indicators of compromise available in the source material.
The item contains no atomic or behavioural indicators. This assessment is single-sourced to the NCSC publication.
6. Detection
Insufficient indicators to author detection rules.
7. Sources
- National Cyber Security Centre, “From industry concern to practical action: the value of working with regulators”, https://www.ncsc.gov.uk/blogs/industry-concern-practical-action-value-working-regulators, 27 October 2026.
8. Adverse Trace position
We assess this as a procedural clarification with no applicable technical severity, CVSS score or CISA KEV status. Its client impact is concentrated in incident governance for publicly listed UK financial services entities, particularly where uncertainty about inside information may delay useful sharing during a supplier or sector-wide incident. The substantive account is single-sourced to the NCSC publication, so legal and compliance teams should verify the FCA guidance before changing approval controls. Adverse Trace will monitor further FCA or NCSC material and update this position if implementation detail or independent clarification is published.
Published via PulseTrace — Adverse Trace threat intelligence.