NCSC releases Cyber Assessment Framework 4.0
6 Aug 2025
CAF v4.0 responds to the growing threat, with new emphasis on threat understanding, secure software and AI-related risks.
UK
Insights for the United Kingdom, including the Crown Dependencies.
Data (Use and Access) Act 2025 receives Royal Assent
19 Jun 2025
The DUAA 2025 amends the UK GDPR, DPA 2018 and PECR, with changes commencing in stages.
Software Security Code of Practice published
7 May 2025
A new UK code sets baseline security expectations for software vendors.
Cyber Essentials update: the Willow question set
28 Apr 2025
Updated Cyber Essentials requirements and the new Willow question set apply to assessments from today.
Cyber Governance Code of Practice published for boards
8 Apr 2025
The UK Government has published a Cyber Governance Code of Practice setting out what boards and directors should do to govern cyber risk.
UK operational resilience deadline arrives
31 Mar 2025
UK financial firms must now be able to remain within impact tolerances for their important business services.
Procurement Act 2023 comes into force
24 Feb 2025
The new UK public procurement regime is live, and Cyber Essentials requirements continue under PPN 014.
UK Government publishes the AI Cyber Security Code of Practice
31 Jan 2025
A new voluntary code sets baseline security principles across the AI lifecycle.
UK critical third parties regime comes into force
1 Jan 2025
The Bank of England, PRA and FCA’s regime for critical third parties to the financial sector is now in force.
Council of Europe AI Convention opens for signature
5 Sep 2024
The first legally binding international AI treaty opens for signature, with the UK, EU and US among the first signatories.
UK product security regime for connected products takes effect
29 Apr 2024
The PSTI Act product security requirements now apply to consumer connectable (IoT) products sold in the UK.
Investigatory Powers (Amendment) Act 2024 becomes law
25 Apr 2024
Amendments to the Investigatory Powers Act 2016 introduce notification notices and update bulk data and communications data powers.