UK official and regulatory guidance
Prioritise current Cabinet Office, HSE, ICO, NCSC and other relevant public bodies. Determine which UK nation and business activities they apply to.
SOURCE GOVERNANCE // 12 OCTOBER 2026
KNOW THE SOURCE.
KNOW ITS LIMITS.
UK official guidance comes first. We distinguish maintained guidance, voluntary standards, historical material and non-UK methodology. An older publication is not automatically obsolete, and a government label does not make every paragraph current.
THE RULEAUTHORITY FIRST.
AUTHORITY FIRST.
SCOPE ALWAYS.
Current UK regulator or government information anchors advice. ISO and EU resources may inform methodology; EU law is not automatically UK law. Specialist cyber guidance does not replace incident responders or individual business risk assessment.
Voluntary methodology
ISO 22301 is a current published continuity standard with a 2024 amendment, not a GPN certification or guarantee of legal compliance.
European or international practice
EU preparedness, critical entity and ENISA materials can inform methods. They are never presented as blanket UK SME legal duties.
Retired, not erased
Sources removed from primary guidance remain recorded with a reason and a modern successor or contextual replacement.
Review on relevant change
Regulatory amendments, new standards and replacement publications prompt checks; raw age alone does not downgrade a maintained page.
2026 SOURCE SELECTION
IMPORTANT VERIFIED REFERENCES.
These are sources explicitly investigated for this release. Date unknown means not confirmed, not assumed out of date. The full structured registry also includes unverified watchlist entries.
Cabinet Office // CURRENT PRIMARYNational Risk Register 2026Current assessment for practitioners and businesses. Risk context, not specific regulatory duty. Date: 2026-08-12. Checked by GPN: 12 October 2026.Cabinet Office // CURRENT PRIMARYUK Government Resilience Action PlanStrategic policy context; not an individual SME compliance checklist. Date: 2025-07-14. Checked by GPN: 12 October 2026.Cabinet Office // CURRENT PRIMARYResilience Guidance and DoctrineDirectory for UK public sector resilience doctrine and thematic guidance; distinguish public responder obligations from voluntary SME practice. Date: Update date not confirmed. Checked by GPN: 12 October 2026.NCSC // CURRENT SPECIALISTPrepare your business continuity2026 guidance for disruptive cyber incidents including critical services, workarounds and testing; proportionate to organisation. Date: 2026-10-01. Checked by GPN: 12 October 2026.HSE // CURRENT SPECIALISTEmergency proceduresLive HSE guidance; publication/update date not visible. Workplace duties depend on risk and circumstances. Date: Update date not confirmed. Checked by GPN: 12 October 2026.ICO // REVIEW REQUIREDPersonal data breaches - advice for small organisationsLive SME guidance, but the ICO explicitly says it is under review following the Data (Use and Access) Act. Use live page for decisions. Date: Update date not confirmed. Checked by GPN: 12 October 2026.Cabinet Office // STILL VALID / OLDERLocal resilience forums: contact detailsOriginally published 2013, actively updated in 2026. Regional response organisations and devolution vary. Date: 2026-02-11. Checked by GPN: 12 October 2026.International Organization for Standardization // CURRENT SUPPLEMENTARYISO 22301:2019 + Amd 1:2024Current published ISO 22301:2019 with 2024 climate action amendment. Replacement edition in development: review publication status. GPN does not certify compliance. Date: 2024-02. Checked by GPN: 12 October 2026.European Commission // CURRENT SUPPLEMENTARYEU Preparedness Union StrategyAll-hazards and whole-of-society preparedness; no implied UK statutory requirement. Date: 2025-05-23. Checked by GPN: 12 October 2026.European Commission // CURRENT SUPPLEMENTARYCommission guidance to strengthen critical infrastructure resilienceNon-binding 2026 resilience-enhancing guidance intended for EU Member States and designated critical entities. Not directly SME law in the UK. Date: Update date not confirmed. Checked by GPN: 12 October 2026.ENISA // CURRENT SUPPLEMENTARYNIS2 Technical Implementation GuidanceTechnical implementation for particular NIS2-related sectors, not general mandatory requirements for UK small businesses. Date: Update date not confirmed. Checked by GPN: 12 October 2026.
RETIRED // HISTORICAL RECORD
WHY WE CHANGED ONE.
The Cabinet Office's 2013 guidance on resilience in society was last updated in December 2014. It still treats BS25999 as a present-day standard. GPN no longer cites that page as a primary Business continuity authority; its historical value is preserved in the register. A broader strategy reference cannot by itself replace practical workplace, cyber or sector-specific guidance.
HOW TO USE THIS AUDIT
REVIEW IS CONTINUOUS.
Source status reflects editorial evidence, not a guarantee that a link will never change. The machine-readable register records publisher, URL, topic, jurisdiction, publication and review dates where available, check date, status, scope and replacement rationale.
CURRENT PRIMARY / SPECIALIST: Explicitly checked official material, with different roles. STILL VALID / OLDER: Maintained or valid older material with a recorded reason. REVIEW REQUIRED: An unverified or changing source, not falsely marked current. RETIRED / HISTORICAL: Preserved for transparency, not the current operating basis.
FRESHNESS: Review regulatory and standards references at least quarterly or after significant changes; core editorial guidance at least every six months; live emergency decisions must follow official sources at the time. A failed feed never means an all-clear.
DATA: Structured source register (JSON). Baseline external-link inventory (JSON). Inventory capture is not the same as manual verification of every URL.