When the UK Cyber Security and Resilience Bill takes effect, organisations in scope will have 24 hours to tell their sector regulator (Ofcom, the Information Commissioner’s Office, and Ofgem among them) and the National Cyber Security Centre (NCSC) about a significant incident affecting their services, and 72 hours to file a full report. Data centres and managed service providers will report for the first time, and designated critical suppliers will follow once secondary regulations set their duties. Nothing in the Bill requires regulators to share those reports with insurers.

The NCSC used to share incident intelligence with industry through its Connect Inform Share Protect (CISP) platform, until it decommissioned CISP on 28 November 2025. So the Bill will collect more detailed incident data from more kinds of organisations than current UK rules require, and it says nothing about insurers, who turn loss data into risk management for a living. Peers return to the Bill at report stage, scheduled for 26 October, and that’s the next chance to change it.

Cyber Essentials already links certification to insurance

Cyber Essentials, the government’s certification scheme, comes with cyber liability insurance free for UK businesses with an annual turnover of less than £20 million. According to the NCSC’s November 2024 post marking the scheme’s 10th anniversary, data from the provider of that insurance shows certified organisations are 92% less likely to make a cyber insurance claim than organisations without certification, and the Minister repeated the figure at second reading. That evidence came from an insurer’s claims records, and it’s the kind of evidence the Bill’s incident reports could add to.

Most small businesses go without cyber cover

The Association of British Insurers (ABI), the insurance industry’s trade body, told Parliament in written evidence in 2026 that estimates of cyber insurance take-up among UK small and medium-sized businesses range from 10% to 40%, depending on how penetration is calculated. At second reading, Baroness Paul of Shepherd’s Bush, who is also chief strategy and communications officer at the terrorism reinsurer Pool Re, argued that structured, anonymised incident data should be shared with the insurance sector. Insurers could use it to model and price cyber risk more accurately, she said, and sell more cover as a result.

Some large organisations go without cover too. Redcar and Cleveland Borough Council lost its IT and phone systems to ransomware in February 2020, and it took eight and a half months to get them back. Its leader, Mary Lanigan, told Parliament’s Joint Committee on the National Security Strategy in 2023 that the council hadn’t been insured, because cover would have been “astronomical.” She said a minister had promised to meet the cost, whatever it was. Central government paid £3.68 million of what she put at £11.3 million, and the council covered the rest from reserves it had been trying to rebuild. Once Redcar’s loss was large enough, the state and local taxpayers split it, on terms worked out after the attack.

Insurers have already asked for the data

The ABI and PwC UK made the data argument in their 2026 joint report, the UK Cyber Insurance Market Assessment, which recommends enhancing data sharing to support better risk management. The ABI published it alongside its good practice guide, “From Prevention to Resilience,” which draws on insurers’ claims data to set out the controls that help organisations limit and recover from attacks.

The NCSC already publishes counts of nationally significant incidents in its annual review. Counts like that help with situational awareness, but they aren’t built for actuarial modelling, which needs structured records covering severity, sector, attack vector, duration, and recovery cost.

The access model already exists

The Office for National Statistics (ONS) gives accredited researchers access to de-identified, unpublished data through its Secure Research Service, and it’s accredited for that work under the Digital Economy Act 2017. The service runs on the Five Safes framework of trained and accredited people, approved projects, secure settings, de-identified data, and checked outputs. Incident data is commercially sensitive, and a determined analyst can sometimes re-identify anonymised records. That’s why insurers should get aggregated records only, and why checking outputs before release matters most.

The Bill already accepts that onward sharing has value. In the Commons committee in February, the government explained that Clause 15 sets out how regulators and the NCSC can share the information they receive to manage an incident’s wider impacts or prevent future ones. What’s missing is any mention of insurers, the gap Baroness Paul called “a significant omission.” The NCSC switched off CISP when its priorities changed, and that’s the case for writing a route to insurers into legislation.

The change to make at report stage

The Bill, or the secondary legislation that follows it, should create an accredited-access scheme for aggregated, anonymised data from the incident reports organisations will file under the new rules. The ONS, or a body modelled on it, would run the scheme on Five Safes lines. The legislation should name insurers and their risk-modelling teams as eligible applicants, and they’d pay fees to cover the cost of access. None of this adds a reporting burden, because organisations will already file every one of those records under duties the Bill creates.

Parliament should judge the scheme by whether more small businesses end up insured. That will be harder to show than it sounds, because the ABI’s own estimates already span 10% to 40% depending on method. A single agreed measure of take-up would let Parliament see whether the scheme is working.

Nothing here should be taken as legal, financial, or security advice for your specific situation — see the full disclaimer at cyberresilience.com/disclaimer.