Cyber security · Ransomware
The UK is rewriting the rules on paying a ransom. What that means for a small practice.
The government has set out how it wants ransomware handled: a payment ban for some organisations, a notification step for everyone else, and mandatory reporting. None of it is law yet, and the scope is not settled — but the direction is clear enough to plan around.
Until now, whether to pay a ransom has been a private decision. Awful, expensive and usually made at two in the morning — but private. The Home Office's response to its consultation on ransomware legislative proposals would change that, and it changes the paperwork as much as the payment.
Here is what is actually on the table, what is not, and the one question a small practice can usefully act on today.
Three measures are proposed
The response sets out three distinct things, and it helps to keep them separate because they apply to different organisations.
A targeted ban on paying
All public sector bodies — including local government — and owners and operators of critical national infrastructure that are regulated or have competent authorities would be prohibited from making a ransom payment at all. This is a ban, not a process. It does not extend to private businesses generally.
A payment prevention regime for everyone else
Every other victim would have to notify government of an intent to pay before paying. Government could then block the payment where the money would reach a sanctioned entity or breach terrorism financing law. The point is not to stop every payment — it is to stop the ones that are already unlawful for reasons most victims have no way of checking at speed.
Mandatory incident reporting
An initial report within 72 hours of an incident, and a fuller report within 28 days.
Read this before anyone tells you otherwise
None of the above is law. It is a government response to a consultation, which is the stage before legislation. The scope of the reporting duty in particular is explicitly not settled — economy-wide reporting attracted 63% net agreement in the consultation but was not adopted as the final position. Anyone telling a small practice it has a new legal duty today is ahead of the facts.
The Cyber Security and Resilience Bill is a separate thing
These two get conflated constantly, so it is worth being precise. The Cyber Security and Resilience (Network and Information Systems) Bill is a different piece of legislation, at House of Lords report stage and without Royal Assent. It contains no ransom payment ban. It brings medium and large managed service providers into regulatory scope with the ICO as their regulator, sets an initial notification within 24 hours and a fuller report within 72 hours — different numbers from the ransomware proposals, which is exactly why people muddle them — and requires providers in scope to tell customers likely to be affected by an incident.
For transparency: iKORE is a small provider and is not in scope of that Bill, and we would not pretend otherwise. We are writing about the landscape, not about an obligation we carry.
What changes for your practice today
Legally, nothing. No small accountancy, legal or healthcare practice acquires a duty from a consultation response.
Practically, the direction matters. The whole shape of these proposals is to make quiet payment harder — slower, visible to government, and in some cases prohibited outright. If the option to pay becomes less available, the weight shifts onto the other route out of a ransomware incident: recovering from your own data without paying anyone.
That is not a new idea. The NCSC's position has never moved. Its guidance states plainly that "The NCSC and UK law enforcement do not encourage, endorse nor condone the payment of ransom demands", and warns that "There is no guarantee that you will get access to your data or computer" even if you do pay. Its standing advice is the unglamorous one: "It is important that you always have a recent offline backup of your most important files and data."
The question worth asking this week
Most practices have a backup. Far fewer can answer the question underneath it, which is how long a full recovery would actually take, and who could run it.
- Is there a copy offline? A backup reachable from the same network, with the same credentials, is reachable by ransomware too.
- How long is a full restore? Not how long the backup job takes — how long until the practice is working again. These are very different numbers, and only one of them matters in January.
- Has anyone tested it? A backup report confirms a copy was made. It says nothing about whether the copy opens.
- Could anyone else run it? If the recovery lives in one person's head and that person is on leave, you have a single point of failure no report will ever flag.
- Who decides? If paying were ever on the table, who in the practice makes that call, and on what information? Under these proposals that moment would also involve notifying government. Better decided now than at 2am.
Common questions
Is it illegal to pay a ransom in the UK?
There is no general prohibition today. Payments can already breach sanctions or terrorism financing law in particular circumstances, which is precisely what the proposed payment prevention regime is designed to catch before the money moves. The proposed outright ban would apply only to the public sector and to regulated critical national infrastructure.
Would my practice have to report a ransomware incident?
Not today, and not under any settled rule. Mandatory reporting is proposed, but the final scope of who it covers has not been decided. If it is eventually set economy-wide, the proposed timings are an initial report within 72 hours and a fuller one within 28 days.
Where does the 72-hour figure come from?
The ransomware proposals. The Cyber Security and Resilience Bill uses 24 hours for initial notification and 72 hours for the fuller report, which is a common source of confusion. They are different regimes with different timings and different people in scope.
Does the Cyber Security and Resilience Bill regulate my IT provider?
Only if they are a medium or large managed service provider. Smaller providers, iKORE included, fall outside it. If your provider is in scope, the Bill would require them to notify customers likely to be affected by an incident.
What should we actually do now?
Nothing legal, and one practical thing: establish how long a full recovery would take if paying were not an option, and make sure at least two people could run it. That answer is useful whatever happens to the legislation.
Not sure how long your recovery would take?
We can walk through your current backup and recovery setup with you and give you a straight answer on how long a full restore would take, where the offline copy sits, and who else could run it. No obligation, and no assessment to sell you at the end of it.
Book a free consultation →