The Financial Conduct Authority (FCA) is preparing new guidance for financial institutions on its expectations around cyber resilience according to its head of technology, resilience and cyber, Claire MacArthur.

Speaking at FStech’s CyberSecurity Live event on Wednesday, MacArthur said that the UK finance regulator will begin a joint consultation on the matter alongside the Prudential Regulation Authority and the Bank of England “shortly”, with the aim of helping develop the guidance it will publish early next year.

It is working on the guidance in response to industry demand for “greater clarity about our existing expectations and what good looks like in practice,” MacArthur continued.

Earlier in the day, the FCA had published its latest findings around operational resilience for firms, which also forms part of its efforts to offer more specific guidance to financial institutions.

The document provides examples of good practice for operational resilience self-assessments. The most advanced firms, it said, explain not only their results but also how they calibrate impact tolerances, use both time-based and non-time-based measures and explain how they would prioritise activity and protect customers or market participants during prolonged disruption.

Neither this nor the upcoming guidance create new requirements for firms, MacArthur said, but are instead “intended to help firms learn from what we’re seeing across the sector and strengthen future-self assessments.”

Despite this, MacArthur stressed the importance of “honesty” in self-assessments.

“If testing exposes a vulnerability, understand it,” she said. “If a workaround exists, test whether it genuinely works. And if a scenario produces an uncomfortable answer, don't redesign the scenario until the answer becomes comfortable, which we've also observed.

“That uncomfortable answer will tell you more about your resilience than any test that you know that you can pass.”

---