In short
Cyber security compliance in the UK is a mix of law (UK GDPR, the NIS Regulations 2018), sector rules (FCA operational resilience, the NHS DSPT), contracts (Cyber Essentials) and standards (ISO 27001). Almost all of them expect you to detect incidents, respond, report within set deadlines and keep evidence. A managed detection and response service helps with each step.
Not sure where to start?
Tell us what you need to achieve and we will point you to the right option.
What UK compliance asks of security monitoring
There is no single UK cyber security law. What applies to you depends on what you do, who you work with and the data you hold. A care provider, a payments firm and an IT services company will each answer to different rules, but read side by side the regimes ask remarkably similar questions:
- Can you detect an incident? That means collecting the right logs and having someone look at the alerts, including out of hours.
- Can you respond? That means a plan, people who know what to do and the authority to contain a threat quickly.
- Can you report on time? Several regimes set clocks that start when you become aware of an incident: 72 hours under UK GDPR and the NIS Regulations, and a proposed 24-hour initial notice under the Cyber Security and Resilience Bill.
- Can you prove it? Auditors, regulators and customers want evidence: log retention, alert handling records, incident timelines and lessons learned.
A managed security service provider (MSSP) cannot make you compliant, because the duties stay with your organisation. What the right services can do is close the practical gaps: someone watching around the clock, a team ready to act, and records that stand up when you are asked for them. Forever Systems does not run its own security operations centre. The 24/7 monitoring and response comes from the vendor services we resell, such as Sophos MDR, Check Point MDR or WatchGuard MDR; we recommend one, set it up, manage it and handle escalation with you.
UK regimes and what they ask for
| Regime | Who it applies to | What it asks for on detection, response and reporting | Our guide |
|---|---|---|---|
| UK GDPR | Any organisation processing personal data | Appropriate security for personal data; report a personal data breach that poses a risk to the Information Commission (formerly the ICO) within 72 hours where feasible | Covered on each guide below |
| NIS Regulations 2018 | Operators of essential services and relevant digital service providers | Appropriate and proportionate security measures; operators notify their competent authority of a NIS incident within 72 hours of becoming aware | NIS Regulations |
| Cyber Security and Resilience Bill (not yet law) | Would add medium and large managed service providers, data centres and designated critical suppliers | Initial notification within 24 hours and a full report within 72 hours, with the NCSC informed at the same time | What the Bill means for MSPs |
| ISO/IEC 27001:2022 | Organisations choosing certification, often because customers ask for it | Annex A controls including 8.15 Logging, 8.16 Monitoring activities and 5.24 to 5.28 on incident management | ISO 27001 logging and monitoring |
| NHS Data Security and Protection Toolkit | Every organisation with access to NHS patient data and systems | An annual assessment; the CAF-aligned version for larger organisations covers security monitoring, threat hunting and incident response | DSPT and security monitoring |
| FCA operational resilience and PS26/2 | Banks, insurers, payments firms, enhanced scope SM&CR firms and others in scope | Stay within impact tolerances for important business services; operational incident and third party reporting rules from 18 March 2027 | FCA operational resilience |
| NCSC Cyber Assessment Framework v4.0 | Used by NIS regulators and the CAF-aligned DSPT | Objective C (C1 Security monitoring, C2 Threat hunting) and Objective D (response, recovery and lessons learned) | NCSC Cyber Assessment Framework |
| Cyber Essentials | Any organisation; a common requirement in government and public sector supply chains | Five technical controls; it does not require security monitoring | Cyber Essentials |
This table summarises duties for orientation only; it is not legal advice. Check the current text with your regulator, your auditor or your own advisers, because several of these regimes are changing during 2026 and 2027.
Not sure which option fits? Ask us
Tell us what you need and we will help you choose the right option.
The evidence auditors and regulators look for
Whatever the regime, the questions in an audit or after an incident tend to be practical. Typical requests include:
- Log coverage: which systems send security logs, from endpoints and servers to Microsoft 365, identity, firewalls and email
- Retention: how long logs are kept, and whether they are protected from tampering
- Alert handling: who looks at alerts, how quickly, and what happened to each one
- Incident records: timelines, actions taken, who was told and when
- Response plans and testing: a written plan, playbooks and exercises with lessons learned
- Supplier oversight: what your managed service providers do, and how you check it
A vendor-run managed detection and response service produces much of this as a by-product, because investigations are written up as cases with a timeline, actions and recommendations. A SIEM as a service adds central log retention and searchable history. An incident response retainer gives you a tested route to expert help when a reporting clock has started. Our job is to set these up so the evidence lands where you need it, and to review it with you.
Matching services to obligations
- Reporting deadlines of 24 or 72 hours: managed SOC or MDR from a vendor SOC so incidents are found and triaged quickly, plus an incident response retainer
- Logging and retention requirements: SIEM as a service with a retention period chosen to match your policy
- Continuous monitoring expectations: cyber security monitoring services across endpoints, identities, email, network and cloud
- Vulnerability management controls: vulnerability management as a service to scan, prioritise, patch and verify
- Identity and access controls: managed ITDR to spot and contain account takeover
- Supplier assurance: questions to put to any provider in how to choose an MSSP
For organisations that need a recognised baseline first, Cyber Essentials covers five technical controls and is often a contract requirement in its own right.
Need help choosing?
We will recommend what fits your organisation and explain why, in plain English.
Where an MSSP fits, and where it does not
It helps to be clear about the limits, because compliance projects go wrong when responsibilities are assumed rather than agreed.
- What a managed service can do: monitor, investigate and respond within the limits you approve; keep logs for the period you choose; produce case reports; help you assemble facts quickly when a regulator or customer needs to be told.
- What stays with you: deciding whether an incident is reportable, making the report, your policies, your risk assessment and your board's oversight.
- What we are not: Forever Systems is not a law firm, an ISO 27001 certification body or an NCSC-assured Cyber Incident Response provider. Where you need those, we can work alongside the people you appoint.
Who does what (including which actions a vendor SOC can take without asking you first) is set out at quote and written into the service description, so roles are agreed before an incident rather than during one.
How we help
- Talk through which regimes apply to you and what your auditors, regulators or customers have asked for.
- Review the security tools you already own, so we build on them rather than replace them.
- Recommend a vendor MDR, SIEM or retainer option that fits, with the coverage and retention it would give you.
- Set it up, connect your log sources and agree response permissions and escalation contacts with you.
- Review cases and reports with you on an agreed schedule, and adjust coverage as your obligations change.
Costs depend on users, devices, data volumes and the service tier, so ask us for a quote. Contact us to map your obligations to the right services.
Explore Compliance
How Forever Systems helps with managed security
We do not run our own security operations centre. The round-the-clock monitoring, investigation and response come from managed detection and response services that established security vendors already run at scale. Our part is choosing the right one for you, setting it up properly and staying involved.
- Independent recommendation: we supply several vendor MDR, XDR and SIEM services, including Sophos MDR, Check Point MDR and Cisco XDR, so we can suggest the one that fits the tools you already own
- Setup and onboarding: we can deploy agents, connect integrations such as Microsoft 365 and work with the vendor through tuning
- Clear responsibilities: escalation contacts, response permissions and who does what are agreed with you in writing and confirmed at quote
- Ongoing management: we help with policy changes, exclusions, renewals and regular service reviews
- Wider security too: security awareness training, Cyber Essentials and cloud security advice
We work with businesses, schools, charities and public sector organisations across the UK.
Frequently asked questions
What are the cyber security regulations in the UK?
The main ones are UK GDPR and the Data Protection Act 2018 for personal data, the NIS Regulations 2018 for essential and certain digital services, and sector rules such as FCA operational resilience and the NHS Data Security and Protection Toolkit. The Cyber Security and Resilience Bill would extend the NIS regime to managed service providers and data centres.
Is cyber security compliance a legal requirement in the UK?
Some of it is. UK GDPR applies to almost every organisation handling personal data, and the NIS Regulations and FCA rules apply by law to the organisations in scope. Standards such as ISO 27001 and Cyber Essentials are voluntary, although contracts and customers often require them.
Does using an MSSP make us compliant?
No. An MSSP can provide monitoring, response and evidence that support compliance, but the legal duties, reporting decisions and policies remain yours. Agree in writing what the provider does and what stays with you.
Do UK regulations require 24/7 security monitoring?
Most regimes set outcomes rather than hours. The NCSC Cyber Assessment Framework expects effective security monitoring, and short reporting deadlines are hard to meet without monitoring out of hours. Some buyers go further: NHS England's cyber security charter for suppliers asks signatories to commit to effective 24/7 cyber monitoring and logging of their own critical IT infrastructure.
What is the difference between Cyber Essentials and ISO 27001?
Cyber Essentials certifies five technical controls, through a self-assessment or, for Cyber Essentials Plus, an independent technical audit. ISO 27001 certifies a whole information security management system, including risk management, logging, monitoring and incident management. Many organisations hold both.
Still have a question about managed security for compliance?
Ask us and a member of our team will reply by email.