Trust: cyber resilience, safety, accessibility, identity

Teams usually approach digital regulation by asking which box the organisation falls into. The question has no answer, because these regimes are not alternatives to each other. Each one attaches to a specific fact: what you operate, what you supply, what your users can do on your service, who you are, and what you check about people. A single organisation routinely answers yes to several of those facts at once. An energy retailer with a customer app, a public sector contract and an EU subsidiary is inside four supervisory relationships before anyone opens an editor.

So the reliable method is a list of independent yes or no tests, run every one of them, and record the answer with the reason. That record is what a regulator, an auditor or an incoming architect will ask for, and it is cheaper to keep it as you go than to reconstruct it under time pressure.

The second habit is harder. Scope is inherited as well as held. Supply chain risk is the risk an organisation takes on from its suppliers and from their suppliers in turn, and several of the regimes below deliberately follow that chain. The Cyber Security and Resilience Bill would let a regulator designate a critical supplier to an essential service. EU DORA creates oversight of critical information and communications technology third party providers. In both cases a duty can arrive because of what a customer of yours does, which means procurement and contract review are part of the scope test rather than a separate workstream.

Where a regime does bind you, the work splits across the three lines of defence: the delivery teams that own the risk, the specialist functions that monitor and challenge, and internal audit giving independent assurance to the governing body. A common failure is putting all of it in the second line, which produces a compliance team writing controls that no delivery team has agreed to operate.

The Network and Information Systems Regulations 2018 (SI 2018/506) are the operative UK instrument. Their structure is worth knowing because it tells you where duties live: Part 3 covers the identification of operators of essential services, their security duties and the duty to notify incidents; Part 4 covers relevant digital service providers and registration with the Information Commissioner; Part 5 covers enforcement and penalties. Schedules set the threshold requirements that decide who is an operator in each subsector.

The Cyber Security and Resilience Bill would amend that regime. GOV.UK records that the Bill was introduced to Parliament on 12 November 2025 and that it has completed its second reading and committee stage in the House of Commons. It is a Bill. The planning question it raises is scope readiness, not compliance, and the honest way to brief a board on it is to describe what it would do rather than what it requires.

Its factsheets set out three pillars of reform: expanded scope, more effective regulators, and enabling resilience. On scope, the Bill would bring in data centres with a rated IT load of one megawatt or more, with Ofcom named as the operational regulator for data infrastructure; enterprise data centres at ten megawatts or more; managed service providers that are not small or micro enterprises; large load controllers; and suppliers a regulator designates as critical to an essential service. The summary factsheet describes twelve sectoral regulators overseeing implementation, with the Information Commissioner covering managed and digital service providers.

On incidents, the reporting factsheet describes a light touch initial notification within 24 hours and a full report within 72 hours, with the NCSC informed at the same time as the regulators, and a duty on affected providers to notify the customers they consider likely to have been affected, with reasons. The reportable set is defined by three tests together: the incident has adversely affected the operation or security of network or information systems, the impact is or is likely to be significant, and the impact relates to the whole or part of the UK. The factsheet is explicit that this includes ransomware and pre-positioning attacks likely to have significant UK impacts even before any impact has landed.

On enforcement, the factsheet describes replacing the current three penalty bands with two. The higher band would be up to GBP 17 million, or 4% of a regulated entity's worldwide turnover, whichever is higher. The standard band would be up to GBP 10 million, or 2% of worldwide turnover, whichever is higher. It also records that the precise definition of turnover is to be set out in secondary legislation, which is the detail that decides what those percentages actually cost a group with international revenue.

The NCSC describes the Cyber Assessment Framework as a tool to help organisations assess and improve their cyber security and resilience and protect essential services, built from a set of objectives with underlying principles, outcomes and indicators of good practice. The current version is 4.0, which NCSC announced on 6 August 2025 in a blog post titled "Cyber Assessment Framework v4.0 released in response to growing threat". The collection page itself carries an earlier publication date of 18 April 2024, so reading that date as the version date puts the framework more than a year out. Its stated audiences are organisations subject to the NIS Regulations, organisations within UK critical national infrastructure, organisations managing cyber-related risks to public safety, public sector organisations supporting core government functions, and any other organisation that finds it useful.

The design decision that matters is that the framework states outcomes rather than controls. NCSC says the aim is to keep the outcome-focused approach of its cyber security and resilience principles and to discourage assessments being carried out as tick-box exercises, that assessment of contributing outcomes is primarily a matter of expert judgement, and that the indicators of good practice are important examples an assessor will normally need to consider rather than a list to tick. That is why a CAF assessment can fail a control that exists: the question is whether the outcome is achieved, not whether the product was bought.

The same property makes it portable. Because the NIST Cybersecurity Framework also states outcomes, and its Govern function is defined as establishing, communicating and monitoring the organisation's cybersecurity risk management strategy, expectations and policy, with categories running from organisational context, risk management strategy, roles and policy through to cybersecurity supply chain risk management, an organisation can hold one control set and report it through either frame. Teams that instead maintain a separate control library per framework end up maintaining evidence three times and reconciling it never.

For a delivery team, the practical translation of an outcome-based assessment is that evidence has to be produced by the system rather than assembled for the assessor. Monitoring that nobody watches, a recovery plan that has never been executed and an asset register nobody updates all pass a document review and all fail an outcome question.

DORA, the EU Digital Operational Resilience Act, is Regulation (EU) 2022/2554. EIOPA records that it entered into application on 17 January 2025 and that it applies to 20 different types of financial entity and to their information and communications technology third party service providers. Its requirements are grouped into six areas: ICT risk management, ICT third party risk management, digital operational resilience testing, ICT-related incident management and reporting, information sharing on cyber threats, and oversight of critical third party providers.

For a digitalisation practitioner the sixth area is the structural one. Oversight of critical ICT third party providers puts a supervisor into the relationship between a financial entity and its cloud or software provider, which is a different arrangement from a supervisor examining the bank alone. Once that exists, concentration risk and the ability to leave a provider stop being procurement preferences and become design constraints. An exit strategy that has never been tested is not evidence of anything.

The lesson generalises beyond EU finance. Wherever a regime starts supervising the provider rather than only the customer, the architectural consequences land on data portability, on interface standards and on whether the second provider can be brought up without a rewrite. Those are the same properties that make a platform choice reversible in the first place, which is why resilience regulation and lock-in avoidance tend to ask for the same engineering work.

The Online Safety Act 2023 is 2023 chapter 50 and received Royal Assent on 26 October 2023. Its long title provides for regulation by Ofcom of certain internet services and for communications offences. Part 3 sets duties of care on providers of regulated user-to-user services and regulated search services, Part 5 sets duties about certain pornographic content, and Part 7 gives Ofcom its powers.

The duties arrived in phases, and Ofcom published the dates. On illegal content, Ofcom stated that every site and app in scope had until 16 March 2025 to complete an assessment, and that from 17 March 2025 services would need to start implementing safety measures. On children, Ofcom's age checks guidance gave services three months to complete their children's access assessments, required children's risk assessments by July 2025, and said that all services which allow pornography must have highly effective age assurance in place by July 2025 at the latest, with Part 5 services taking steps immediately.

The design consequence is specific. Ofcom names open banking, photo ID matching, facial age estimation, mobile network operator age checks, credit card checks, digital identity services and email-based age estimation as approaches that can be highly effective, and states that self-declaration is not. It also states that pornographic content must not be visible to users before or during the age check. Those are product requirements: they change what the sign-up flow collects, what the content delivery layer is allowed to render before a check completes, and which third party the service now depends on.

Notice where that last requirement leads. A safety duty has just made the service an identity-checking service, and identity checking carries a regime of its own.

The Public Sector Bodies (Websites and Mobile Applications) (No. 2) Accessibility Regulations 2018 (SI 2018/952) place the obligation to make websites and mobile applications accessible at regulation 6 and the accessibility statement duty at regulation 8. GOV.UK guidance states that public sector bodies need to meet the WCAG 2.2 AA standard, and that since 23 September 2018 all public sector websites and apps need to meet accessibility standards and publish a statement explaining how accessible the site or app is.

Two bodies do different jobs. The Government Digital Service monitors compliance by examining a sample of public sector websites and mobile apps every year. The Equality and Human Rights Commission in England, Scotland and Wales, and the Equality Commission for Northern Ireland, enforce, and GOV.UK records that they can use legal powers including investigations, unlawful act notices and court action. Monitoring finds the problem; enforcement is a separate route with separate consequences.

Outside the public sector the pressure now comes from the market. The European Accessibility Act sets common accessibility requirements for a defined list of products and services placed on the EU market, including computers and operating systems, smartphones, banking services, e-books and e-commerce. That turns accessibility from a public sector duty into a condition of selling, which changes who inside a company has to own it.

For delivery, the useful framing is that accessibility criteria are component-level requirements. Focus visibility, target size, alternatives to dragging, consistent help and redundant entry are decisions taken once in a design system and inherited by every service built on it. An organisation that fixes them in the shared components fixes them everywhere; one that fixes them per service pays for the same audit repeatedly, and Service Standard assessments keep finding the same failures.

Part 2 of the Data (Use and Access) Act 2025 put digital verification services on a statutory footing. The Office for Digital Identities and Attributes recorded that the majority of the Part 2 measures came into force on 1 December 2025, and that the statutory register went live and replaced the non-statutory register on the same day.

The chain has four links before a buyer ever looks at it. First, published rules: GOV.UK lists two current versions of the trust framework, the UK digital verification services trust framework 1.0 and the UK digital identity and attributes trust framework 0.4, both published on 9 June 2026, and states that services can be independently certified against at least one of them. Second, certification: an approved conformity assessment body certifies the service and submits the certificate of conformity to OfDIA. Third, the register: OfDIA verifies the certificate, the provider applies with details pre-filled from it, and OfDIA maintains the list on behalf of the Secretary of State. Fourth, a trust mark, which certification against the 1.0 publication makes a provider eligible to display.

What that architecture buys is a single check. A relying party asks whether the provider is on the register instead of running a bespoke assurance exercise against every candidate, which is the same substitution that makes any accreditation scheme worth building. The scheme only pays back while the certification behind it is genuinely independent and the register is genuinely current, so the interesting question to ask a provider is not whether it claims to meet the framework but which body certified it and against which version.

Two neighbouring schemes sit alongside. GOV.UK One Login is the sign in and identity checking route for government services, and GOV.UK states that over time it will replace all other ways to sign in to services on GOV.UK including Government Gateway, while noting that it does not work with all government accounts and services yet. In the EU, eIDAS 2.0 is Regulation (EU) 2024/1183, and the European Commission states that it mandates member states to provide EU Digital Identity Wallets to citizens by the end of 2026, and that service providers legally obliged to identify their customers unequivocally will be obliged to accept the wallet for authentication. An acceptance obligation is the part that changes commercial behaviour, because it removes the option of ignoring the scheme.

Building identity checks in house remains possible and is almost always the wrong call. It commits a team to holding the most sensitive category of data it will ever process, to the fraud arms race that comes with it, and to an assurance burden that a certified provider has already paid for. The privacy by design answer is usually to ask for the narrowest attribute the service actually needs, such as whether someone is over eighteen, rather than for an identity document that answers far more than the question posed.