UK launches cyber severity scale to boost risk management

A new framework to assess the severity of major and systemic cyber events on UK businesses has been launch by the Cyber Monitoring Centre (CMC), in a move to boost cyber risk management. The CMC has rolled out the scale to categorise cyber events from the least severe (one) to the most severe (five). The CMC will monitor cyber events and grade those that have the potential impact to cause more than £100m of losses and affect multiple organisations. The scale takes into account the percentage of businesses impacted as well as the financial impact of a cyber event. The CMC aims to assign a scale for the cyber event within 30 days. The official launch of the scale follows work undertaken by the CMC’s technical committee of cyber experts, chaired by former CEO of the UK’s National Cyber Security Centre Ciaran Martin. The technical committee, which also includes former director general of GCHQ Gaven Smith, will meet to review incident data and determine each event’s category. CMC said the classification scale is a world-first to assess the impact of systemic cyber events, putting in place a consistent and objective framework. This is a “milestone in the UK’s approach to cyber risk management”, it said. Martin said: “Measuring the severity of incidents has proved very challenging. This could be a huge leap forward. I have no doubt the CMC will improve the way we tackle, learn from and recover from cyber incidents. If we crack this – and I’m confident we will – ultimately it could be a huge boost to cybersecurity efforts not just here but internationally too.” The CMC will publish an event report free of charge for every cyber event that is categorised using the scale. It said this will increase the understanding of cyber events while improving cyber mitigation and response plans. Will Mayes, CEO of the CMC, which is an independent body founded on the back of interest from the insurance industry, said: “The risk of major cyber events is greater now than at any time in the past as UK organisations have become increasingly reliant on technology. The CMC has the potential to help businesses and individuals better understand the implications of cyber events, mitigate their impact on people’s lives, and improve cyber resilience and response plans.” Commenting on the launch, Martin Greenfield, CEO of cyber monitoring firm Quod Orbis, said establishing a consistent standard to measure the severity of cyber incidents will bring clarity. “Organisations will hopefully be enabled to provide a standardised method for assessing incidents, identifying patterns and vulnerabilities across their cyber landscape. This not only improves real-time incident response but also strengthens proactive threat hunting and long-term resilience planning,” he said. “The framework’s structured approach enables security teams to prioritise resources effectively, ensuring that the most severe incidents receive immediate attention while lower-tier threats are managed efficiently,” he added. But Greenfield warned that cyber incidents don’t always fit neatly to rigid categorisation, especially when they affect sectors such as healthcare where other factors come into play, like patient safety and operational disruption. “There’s also the risk that such a framework could unintentionally oversimplify the multifaceted nature of cyber threats. Considerations should be made down the line on whether the criteria will account for reputational damage or regulatory repercussions,” Greenfield said.

UK launches cyber severity scale to boost risk management

Move described as ‘milestone in the UK’s approach to cyber risk’

Want to read this article?

Read Next

IQUW launches active assailant cover

Talanx results boosted by HDI Global’s 43% jump in net income

VIG Re confirms Faucret as head of Western Europe

Spike in cloud service outages driven by Google Cloud downtimes

Canopius Group appoints group risk director

IQUW launches active assailant cover

Talanx results boosted by HDI Global’s 43% jump in net income

VIG Re confirms Faucret as head of Western Europe

Spike in cloud service outages driven by Google Cloud downtimes

Canopius Group appoints group risk director

Keep yourself informed

Sign up for Commercial Risk’s newsletters

Want to read this article?

Read Next

IQUW launches active assailant cover

Talanx results boosted by HDI Global’s 43% jump in net income

VIG Re confirms Faucret as head of Western Europe

Spike in cloud service outages driven by Google Cloud downtimes

Canopius Group appoints group risk director

Related Articles

Keep yourself informed

Sign up for Commercial Risk’s newsletters