TO BE PUBLISHED December 2026
Starting from:
£99 + VAT
Format: DOWNLOADABLE PDF
This conference will examine next steps for cyber security and resilience in the UK. Areas for discussion include implementation of the expanded regulatory framework, priorities emerging from the forthcoming National Cyber Action Plan, resilience across businesses and public services, supply chain and critical supplier risk. The evolving threat environment and use of AI will also be examined, as well as priorities for investment, skills and cyber capability across the UK.
With the Cyber Security and Resilience (Network and Information Systems) Bill progressing through Parliament, and the Government preparing the National Cyber Action Plan, the conference will bring together stakeholders and policymakers to consider the next phase of cyber policy, implementation, and the impact on organisations across the economy.
Delegates will discuss the implications of extending regulation to managed service providers, data centres and other organisations, as well as arrangements for critical suppliers and incident reporting. We expect a key question to be how regulatory requirements can be applied across sectors with different levels of exposure, capability and resources. The conference will also consider the position of organisations outside the regulated framework, including smaller businesses and suppliers whose resilience can have wider consequences through interconnected services and supply chains.
The agenda will also assess early implementation of the Government Cyber Action Plan, including its implications for public services and the organisations and suppliers that support them. Priorities for the Government Cyber Unit will be considered, alongside the development of preparedness, accountability and assurance across departments and public bodies, including approaches to incident response.
Looking at implications for industry, sessions will also assess sector-specific approaches to resilience, including arrangements between regulators, government and operators in critical infrastructure. This will include what can be learned from recent disruption about organisational readiness, continuity planning and responsibility across interdependent infrastructure and supply chains.
Further sessions will examine priorities for strengthening cyber capability across the wider economy in the context of the National Cyber Action Plan. Discussion will consider board-level responsibility and the Cyber Resilience Pledge, support for SMEs, the use of AI in attack and defence, secure-by-design approaches, and priorities for investment, innovation and commercial growth.
Attendees will also assess workforce requirements and routes into cyber careers, the role of universities, clusters and regional collaboration, and how policy, procurement and private investment can support the development and adoption of cyber capability in different parts of the UK.
Regulation, implementation & oversight
Attendees will consider the practical questions arising as the expanded framework moves towards implementation, including responsibilities for regulators, regulated organisations and suppliers.
Areas for discussion include:
- scope & transition:
- extension of the NIS framework to managed service providers, data centres, large load controllers and other newly regulated organisations - transition and implementation timelines
- whether the expanded framework covers organisations and sectors where disruption can have the greatest wider impact
- identifying responsibilities where services and supply chains overlap
- critical suppliers:
- designation and oversight of suppliers whose failure could create wider systemic risk - impact on contracts already in place
- implications for organisations dependent on shared providers
- incident reporting:
- readiness for new notification requirements - determining when an incident meets the threshold for reporting - handling incomplete information in the early stages
- dual notification to sector regulators and the NCSC - avoiding unnecessary duplication - interaction with proposed ransomware reporting requirements
- regulatory capacity & consistency:
- clarity and consistency of expectations across sectors - capacity and resourcing of regulators - options for improving coordination and oversight
- coordination where responsibilities intersect - engagement with organisations during implementation
- compliance & accountability:
- translating regulatory requirements into governance, assurance and operational practice
- alignment with the Cyber Assessment Framework, Cyber Essentials and existing standards
- costs and burdens for smaller businesses and suppliers
- proportionate requirements: how expectations could better reflect organisational size, exposure, criticality and the potential consequences of disruption
- international alignment: NIS2, DORA and other international requirements - implications for operators across jurisdictions - cross-border information sharing - regulatory interoperability
Public sector resilience, accountability & incident response
Further discussion will consider how responsibility, preparedness and incident response are developing across government and public services, alongside implications for organisations that support their delivery.
Areas for discussion include:
- Government Cyber Action Plan:
- building phase priorities - implementation milestones to 2027 - Government Cyber Unit remit and authority
- assessing the proportionality of the £210m committed to the scale of the task - translating objectives into practical improvements across government
- public sector capability:
- accountability and assurance across departments and arm's-length bodies - understanding exposure of legacy systems
- whether support reaches organisations facing the greatest risks - vacancy rates and reliance on contingent labour
- leadership: senior responsibility for cyber risk - integrating resilience into wider organisational decision-making - accountability and assurance
- public service resilience:
- third-party dependencies and concentration risk - continuity where essential services rely on shared providers
- approaches and responsibilities for managing risks to continuity of services beyond immediate suppliers
- incident response & recovery:
- continuity planning and decision-making during significant incidents - maintaining operations without IT for extended periods
- proposed ban on ransomware payments by public bodies and CNI operators - information sharing and organisational learning - applying lessons from recent cyber disruption
Threat environment, AI & secure-by-design
The conference will also consider what will be needed to enable defensive capability to keep pace with the speed at which vulnerabilities are now found and exploited.
Areas for discussion include:
- threat preparedness: implications of the evolving threat environment - application of NCSC guidance and assurance frameworks - preparedness for severe and prolonged disruption
- AI-enabled threats: use of generative AI to increase the speed, scale and accessibility of attacks - implications for organisational preparedness and defensive capability
- automated defence: use of AI for detection, analysis and response - appropriate human oversight - risks arising from increasingly autonomous decision-making
- secure-by-design: integrating security into digital services and infrastructure - expectations for default protections - Software Security Code of Practice adoption - challenges with legacy systems
- operational technology: convergence of IT and OT environments - safety-critical and industrial systems - availability of specialist skills
- assurance: assessment of rapidly changing technologies and third-party systems - governance and responsibility for deployment - maintaining effective oversight as capabilities develop
Investment, skills & cyber capability across the UK
Sessions will examine priorities for investment, workforce development and regional capability, including how funding, skills and specialist support align with changing regulatory requirements, and whether they are reaching the organisations and parts of the UK where capability is most needed.
Areas for discussion include:
- SME support: delivery of the £90m committed over three years - barriers to accessing funding, advice and specialist capability - whether smaller suppliers can meet expectations
- organisational practice:
- Cyber Resilience Pledge uptake and expectations for signatories - evidence of changes in board-level behaviour
- approaches to addressing barriers to wider adoption - cost and complexity - access to expertise - competing priorities - integration with legacy systems and existing processes
- role of commercial and reputational incentives
- investment: attracting private investment - routes from early-stage innovation to commercial scale - regulatory certainty and investor confidence
- sector development: supporting sustainable growth and scale-up - public procurement as route to market for smaller firms - forthcoming National Cyber Action Plan
- skills & workforce: specialist and cross-disciplinary workforce needs - recruitment and retention - entry-level routes - changing requirements across public services and industry
- regional capability:
- role of cyber clusters, universities and anchor institutions - developing capability outside London and the South East
- differences in local capacity and access to specialist support
- R&I: translating research into operational capability - links between academia, industry and public-sector requirements - supporting development of new cyber technologies
- competitiveness: export opportunities for UK cyber firms - implications of international standards for market access and competitiveness
All delegates will be able to contribute to the output of the conference, which will be shared with parliamentary, ministerial, departmental and regulatory offices, and more widely. This includes the full proceedings and additional articles submitted by delegates. As well as key stakeholders, those already due to attend include officials from Department for Business, Innovation, Science and Trade; Department of Health and Social Care; Department for Digital, Culture, Media and Sport; Department for Energy Security and Net Zero; Department of Agriculture, Environment and Rural Affairs, NI; Department of Education, NI;; HM Revenue and Customs; HM Treasury; National Cyber Security Centre; Information Commission; HM Prison and Probation Service; Medicines and Healthcare products Regulatory Agency; Ofcom; Health and Safety Executive; Home Office; the Welsh Government; and The Scottish Government.
