Five places worth watching, and what a board should actually do with each. We have kept this deliberately short. A longer list would be easier to write and less useful to read.
National Cyber Security Centre
Alerts and advisories
The UK Government’s own warnings about vulnerabilities and campaigns affecting British organisations. Updated as things happen, with a feed you can subscribe to, and written to be acted on rather than admired.
Who should watch it: whoever is accountable for cyber, or the person who would have to answer if something on the list turned out to be running in your business.
The board question: do we know whether we run the affected product, and who decides on emergency patching?
Information Commissioner’s Office
Breach reporting, enforcement and DUAA guidance
What the UK GDPR actually requires when something goes wrong, the ICO’s published enforcement action, and its guidance on the Data (Use and Access) Act 2025. Worth reading before you need it, not after.
Who should watch it: whoever would make the 72-hour call, and the person who signs the privacy notice.
The board question: who decides whether we report, and could they reach that decision inside 72 hours on a Saturday?
European Data Protection Board
EU GDPR guidance and the AI Act
Where the UK and the EU have diverged, this is the side you cannot read off UK guidance. It matters the moment you have EU customers, an EU entity, or you place an AI system on the EU market — and the AI Act reaches you on that last basis alone, wherever your office is.
Who should watch it: anyone holding personal data of people in the EU, or selling software into it.
The board question: have we established whether EU law reaches us at all, and written the answer down?
Prudential Regulation Authority and FCA
SS2/21, outsourcing and operational resilience
SS2/21 sets the expectations on outsourcing and third party risk: a register of arrangements, due diligence proportionate to materiality, exit plans that could actually be executed, and attention to concentration risk.
Who should watch it: PRA- and FCA-regulated firms, and anyone who sells to one — these obligations get passed down the supply chain in contracts.
The board question: could we produce our outsourcing register today, and does it include the cloud regions underneath our suppliers?
CISA
Known Exploited Vulnerabilities catalogue
A list of vulnerabilities known to be exploited in the wild, not merely known to exist. It is American, and it is still the single most useful patching prioritisation list published anywhere.
Who should watch it: whoever decides what gets patched first when everything cannot be patched at once.
The board question: do we patch by severity score, or by what is actually being exploited?
The part that matters
Watching is not the same as deciding
Every organisation we assess already has access to all of this. Almost none of them can show what they did about any of it. The advisory gets read, or it does not, and either way nothing is written down.
The gap is never the information. It is that nobody owns the question of what to do with it, on what timescale, at the expense of what else. That is a governance problem, and it is the one we work on.
Links open on the publishers’ own sites. We do not mirror or summarise them, and we have no affiliation with any of these bodies.
Turn watching into evidence
If you want to know whether your organisation could show what it did about any of the above, the ten-question self-check takes five minutes and asks for no email address.