ICO and NCA sign Memorandum of Understanding on cyber security

The Memorandum of Understanding reaffirms the ICO’s commitment to provide relevant and up-to-date information sharing on cyber security-related matters, support improved cyber security and also provide detailed and salient guidance on how change can be implemented.

Specifically, the ICO is working more closely with the NCA to ensure that organisations are signposted to relevant bodies, such as the National Cyber Security Centre, and are empowered to report cyber crime at the earliest possible opportunity.

Boosting resilience

Stephen Bonner, deputy Information Commissioner at the ICO with responsibility for regulatory supervision, said: “Unfortunately, we’ve seen cyber crime costing UK firms billions over the past years. That’s why it’s crucial that relevant bodies work together to boost the UK’s cyber resilience.”

Bonner added: “This new Memorandum of Understanding builds on our existing relationship with the NCA and will help to improve cyber security standards right across the board, while respecting each other’s remits.”

NCA deputy director Paul Foster, head of the National Cyber Crime Unit, responded: “The NCA leads a whole-system response to cyber crime, disrupting cyber criminals and putting them before the courts wherever possible. Organisations who are vulnerable to imminent attack or otherwise find themselves to be the victim also need support and guidance. We work closely with our partners to provide that help.”

Foster concluded: “We’re pleased to be making this commitment with the Information Commissioner’s Office. This agreement signifies our common goal of establishing and maintaining a secure and resilient cyber ecosystem for all.”

Essential commitments

The Memorandum of Understanding reaffirms the following commitments:

*The ICO will encourage organisations to engage appropriately with the NCA on cyber security matters, including the response to cyber crime

*The NCA will never pass information shared with it in confidence by an organisation to the ICO without having first sought the consent of that organisation 

*The ICO will support the NCA’s visibility of UK cyber attacks by sharing information about cyber incidents with the NCA on an anonymised, systemic and aggregated basis (and on an organisation-specific basis where appropriate) to assist the NCA in protecting the public from serious and organised crime

*Where both organisations are engaged on a cyber incident, they will endeavour to deconflict in order to minimise disruption to an organisation’s efforts to contain and mitigate harm

*The ICO and the NCA will work together to promote learning, provide consistent guidance and improve standards on cyber-related matters