UK: offering cybersecurity services — is the industry regulated, who do we register with?

From a legal standpoint, the most critical issue is the Computer Misuse Act 1990. Accessing a client's system without explicit authorization, even for testing purposes, constitutes a criminal offense. Therefore, before every test, you must have them sign a written authorization agreement clearly defining the scope, targets, testing windows, and boundaries.

We set up with a similar structure two years ago. Company registration cost around 50 sterlin. Our Information Commissioner's Office registration fee was about 40 sterlin per year at SME tier. For professional indemnity and cyber risk insurance with 2,000,000 sterlin coverage, we paid an annual premium of 850 sterlin in our first year. We were fully operational within two weeks.

Under data protection legislation, you must sign a data processing agreement with your clients. Since penetration testing might expose third-party personal data, having your data security protocols and data breach notification procedures documented in advance will be your legal safeguard.

Follow this order to get started: 1) Incorporate the company. 2) Register with the Information Commissioner's Office and pay the fee. 3) Get a professional indemnity policy from a solid insurance broker. 4) Have a service agreement and a rules of engagement/authorization form drafted under English law. Then you're ready to submit quotes.

Will your client base consist solely of private-sector small businesses, or are you planning to bid on public tenders and local government contracts as well? Because things change on the public sector side where holding government-approved cybersecurity assurance certifications becomes practically mandatory.

Licensing and accreditation shouldn't be confused. The government won't say "you can't conduct tests without a license." However market players and auditing bodies might say "we don't trust your report if you're not accredited." To avoid burning through your budget at the setup stage, the most sensible approach is to launch the service first and apply for voluntary industry accreditations with your initial revenue.

welcome to London; the market is very vibrant, but the trust barrier is high. tbh even in the absence of strict regulations British SMEs pay close attention to your insurance certificates. as long as you have your policy in place and a rock-solid contract, you won't run into any official roadblocks starting out. best of luck!

There's no mandatory official license; paying your data protection fee and getting solid professional indemnity insurance is enough.

I'd appreciate it if you shared the outcome.

I'd say don't rush. Your time to detect an issue directly determines its cost.

Proven by experience.

We got stuck at the same point for a while. When we decide without measuring, we always end up in the same place.

Thanks, this was very helpful.

i have a question. if the notification path is long, notifications dont arrive; missing notifications mean delayed incident detection.

corretc me if I'm wrong.

Noted thanks. If you get three different answers on a topic, the question was asked wrong.

Of course, it varies if your situation is different.

We got stuck at the same point for a while. Mistakes made on the cybersecurity services regulation side are usually reversible but expensive.

Proven by experience.

Could you elaborate on that? People defend habits, not processes. Resistance comes from there.

Mistakes made on the cybersecurity services regulation side are usually reversible but expensive. Good luck with that.

I'll try it. The real issue isn't the number, but what it's based on.

When making decisions, write down the worst-case scenario too, not just the best. If you have questions write them; I'll answer as best I can.

Here's how it went for us. If you get three different answers on a topic, the question was asked wrong.

Hope this helps.