On 7 September 2026, the Financial Conduct Authority (FCA) published a new web page, Defence, Security, and Resilience Lab: lessons for firms.
The web page reflects certain discussions following a meeting of around 120 leaders from financial services, government and defence for the Defence, Security, and Resilience (DSR) Lab.
Among other things, the web page sets out questions to help firms think about their exposure to systemic risk and how they can support UK resilience. These are not requirements although they are a starting point for firms to review their own position.
- Have you mapped your firm’s systemic vulnerabilities: are they internal, external or supply chain dependencies? For example, if you rely on public sector databases, cloud services or payment infrastructures operating outside your business. How are your vulnerabilities spread across the technology, service providers, locations and people within your firm?
- Have you tested whether your back-up systems would be resilient if a disruption also affected other firms relying on the same back-up provider or infrastructure?
- Have you considered how your firm’s crisis communications would need to change if disruption or conflict-related events were affecting multiple firms, or the whole sector, simultaneously, rather than just you? How would you sustain your communications over a longer period?
- Does your firm provide a single point of failure, and if so, how quickly could your disruption impact others?
- Can your firm access defence sector expertise to support defence and dual-use clients’ access to finance?
- (For investors) Do you ask investee companies about their resilience measures?