01 / 03
Outages customers notice instantly
An attack on payments, online banking, trading or claims is felt straight away. In-scope firms must be able to keep important business services within impact tolerances.
Protect customer money and keep services running
For banks, building societies, insurers, wealth managers, payments and lending firms of 50 to 5,000 people. Clear findings for CISOs, security teams, finance and the board, and independent specialists for FCA and PRA operational resilience, DORA, ISO 27001 and PCI DSS.
Business Cyber Check introduces you to authorised insurers and brokers. We are not an insurer or broker and do not provide quotes or advice. Your enquiry may be shared with up to 3 of them.
What keeps financial services leaders up at night
02 / 03
Regulators want clear evidence
New FCA and PRA rules on operational incident and third party reporting come into force on 18 March 2027. Boards need confidence in what they report, and when.
03 / 03
Fraud and account takeover
Stolen credentials and fake payment instructions can lead to customer losses and complaints. Strong authentication, monitoring and staff awareness help stop them early.
How we help
01 / 03
Vetted security providers
Specialists who can close gaps, prepare you for assessments and run incident response.
02 / 03
Authorised insurers and brokers
Explore cyber cover with authorised specialists. We don't give quotes or advice ourselves.
03 / 03
Breach lawyers
Legal support on reporting duties, notices and regulators after an incident.
Standards and frameworks we can help you work towards
We don't certify, accredit or assess. We connect you with independent specialists who can help you work towards these.
01 / 06
FCA and PRA operational resilience
Help mapping important business services, setting impact tolerances and testing them, if you're in scope of SYSC 15A or the PRA's rules.
02 / 06
Operational incident and third party reporting
Help preparing for the FCA and PRA reporting rules that come into force on 18 March 2027.
03 / 06
DORA, if you operate in the EU
Help with ICT risk, incident reporting and third-party requirements for your EU entities, or for EU financial clients you serve.
04 / 06
PRA SS2/21 outsourcing and third parties
Help with due diligence, written agreements and exit plans for outsourcing and third-party arrangements, where SS2/21 applies to you.
05 / 06
ISO 27001
Help scoping and preparing an information security management system.
06 / 06
PCI DSS
Help reducing card data scope and preparing for assessment, if you store, process or transmit card data.
How it works
- 01
Book a 20-minute briefing
Tell us about your setup, deadlines and main concerns.
- 02
Get a clear picture
Understand what to prioritise for your security team, board, auditors and insurers.
- 03
Meet the right specialists
We introduce security providers, authorised insurers or brokers, or breach lawyers. You decide whether to go ahead.
Questions
Do the FCA operational resilience rules apply to our firm?
Only if your firm is in scope. SYSC 15A covers banks, building societies, designated investment firms, Solvency II firms, enhanced scope SM&CR firms, payment and e-money institutions, and some others. Independent specialists we introduce can help you map important business services, set impact tolerances and test that you can stay within them.
Can you help a regulated firm find cyber insurance?
Yes. We can introduce you to up to 3 authorised insurers or brokers who can explain cyber cover options for financial services firms. We are not an insurer or broker, and we don't quote or give advice. Any quotes, terms or recommendations come from the insurers or brokers, not from us.
Is the briefing free?
Yes. The 20-minute briefing is free and there is no obligation to go ahead with anyone we introduce. We are paid by the specialists, insurers or brokers we introduce, not by you, and we only share your details with those you agree to hear from.
Does DORA apply to UK financial services firms?
Not to a purely UK firm. DORA has applied to EU financial entities since 17 January 2025, so it matters if you have EU-regulated entities, or if you provide ICT services to EU financial firms that pass its requirements on through contracts. Specialists we introduce can help you work out what applies and close the gaps.
What are the new FCA and PRA incident reporting rules?
They are new rules on reporting operational incidents and material third party arrangements, which come into force on 18 March 2027. Firms will report incidents that meet set thresholds through a single report, and some firms must also keep and submit a register of material third party arrangements. Specialists we introduce can help you prepare.
Financial services
Talk it through in 20 minutes
A free, no-obligation briefing with clear next steps.