A water utility in Canada recently found itself sitting before a regulatory board, answering for 21 cybersecurity deficiencies identified during an audit. A formal hearing, public scrutiny, and a list of mandatory recommendations. Not a hack that made headlines. Just an organisation that had not kept up, and a regulator that had finally decided to check.
If your first reaction was "that has nothing to do with me," it might be worth pausing on that thought.
Regulators Are Starting to Ask the Cyber Question
In the UK, the direction of travel is clear. The Information Commissioner's Office has steadily increased enforcement activity around inadequate security controls, not just data breaches. The Financial Conduct Authority has built operational resilience requirements that explicitly include cybersecurity. The Network and Information Systems Regulations already place legal obligations on certain sectors. And updated EU rules are shaping how the UK will likely tighten its own framework further.
None of this is sudden. It has been building for years. What the Halifax Water case illustrates is where this trajectory ends: regulators that do not wait for a breach to happen before deciding your cybersecurity was inadequate.
What They Actually Look For
Regulators are not looking for perfection. No serious oversight body expects a ten-person business to run the same security programme as a FTSE 100 company. What they do look for is evidence that you took it seriously, in proportion to your size and the data or systems you handle.
In practice, that typically means being able to show:
- Written policies that staff have actually seen and understood
- Basic access controls, including multi-factor authentication on critical accounts
- A consistent process for applying software updates and patches
- A documented plan for what happens if something goes wrong
- Evidence that these things are reviewed and tested periodically, not set up once and forgotten
The 21 recommendations made to Halifax Water were not exotic or technically advanced. They were the kind of foundational controls that form the basis of any credible security framework. When an organisation cannot demonstrate those basics, it becomes very difficult to argue that risk was being managed responsibly.
The Gap That Keeps Appearing
Most organisations that end up in front of a regulator do not fail because of sophisticated attacks. They fail because the foundations were not there. Unpatched software running for months. Shared passwords on critical systems. Backups that had never been tested. No clear owner for security decisions.
These are not obscure technical failures. They are the gaps that turn up in almost every independent security assessment of a business that has not made cybersecurity part of its operational routine.
The uncomfortable reality is that a regulatory audit does not have to follow a breach to cause real damage. The reputational and operational cost of a public hearing about what you failed to do can be significant in its own right, even if nothing was ever stolen.
Where Many UK SMEs Currently Stand
A large number of small and medium-sized businesses in the UK operate without a formal security framework, without a written incident response plan, and without regular independent assessments of their security posture. That is not a judgement. Most are running lean, focused on the core business, and cybersecurity can feel abstract until something goes wrong.
But the regulatory environment is shifting around them. Sector regulators are raising expectations. Larger customers and public sector procurement processes are increasingly asking suppliers to demonstrate cybersecurity credentials. And the ICO has made clear that not knowing about a widely understood control is not a strong defence when a breach occurs.
A Practical Starting Point
If you are not sure where your business currently stands, a structured assessment against a recognised baseline is the most useful first step. In the UK, Cyber Essentials provides exactly that: five core controls covering the areas most commonly exploited in attacks, assessed by an independent body, with a formal certification that gives you something credible to point to.
It does not cover every possible threat. No single framework does. But it addresses the fundamentals that regulators and customers are increasingly expecting to see, and it gives you a clear picture of where your gaps are before someone else identifies them for you.
The Practical Takeaway
The Halifax Water hearing is a useful prompt, not a reason to panic. Regulators in the UK and beyond are increasingly treating cybersecurity as an operational obligation rather than an IT concern. The businesses that will find this easiest to navigate are the ones that started building the basics before anyone came asking.
If you want to understand where your business stands against current expectations, an independent security assessment or a Cyber Essentials review is a sensible place to begin. It is considerably less uncomfortable than finding out through a formal regulatory process.