Professor Kai London on the UK Cyber Security and Resilience Bill: What Boards Must Do Now

The forthcoming UK Cyber Security and Resilience Bill will significantly widen the scope of regulated entities and tighten incident-reporting obligations. According to Professor Kai London — a Chief Information Security Officer, board cyber security advisor and Honorary Professor at UCL — the organisations that wait for the legislation to be enacted before acting will be the ones caught short.

"Boards keep asking me whether this is another compliance refresh," says Professor London, Founder and CEO of Quantum AI Systems Security LLC. "It is not. It moves cyber resilience from an IT concern to a governance obligation that sits squarely with the board. Directors will be expected to demonstrate that they understand their exposure, not simply that a control framework exists somewhere in the organisation."

Professor London advises executive teams to begin by mapping their regulated footprint and their critical supply chain now. Much of the new exposure, he argues, comes through third parties and managed service providers — precisely the area boards have least visibility over. He recommends a board-level cyber risk register that connects security investment to enterprise value, expressed in the language directors actually use.

On incident reporting, his guidance is blunt: rehearse before you are required to. "The first time a board exercises its reporting obligation should not be during a live incident. Tabletop the scenario, agree who speaks, and know your regulatory deadlines cold." He points to DORA and NIS2 in Europe as a preview of where UK obligations are heading.

Author of five board-level books including Trustquake and The Last Login, Professor London frames the Bill as an opportunity rather than a burden. "Regulators are asking boards to be able to answer a simple question — are you in command of your cyber risk? The organisations that can answer it credibly will earn trust, win confidence and turn resilience into competitive advantage."