Pension scheme trustees should ensure they, and their advisors, are reviewing their cyber incident monitoring and reporting frameworks in light of recent changes made by the National Cyber Security Centre (NCSC), Trafalgar House has said.

A change at the end of last year in the reporting framework from the NCSC means that that threat and incident analysis is no longer available from their usual reporting sources.

Given this, Trafalgar House argued that there are some immediate actions schemes could, and should, take, such as confirming that all their advisers are proactively updating and refining their cyber threat analysis reports.

It also encouraged scheme trustees to directly question their advisers on their involvement with intelligence sharing networks, such as the Cyber Information Sharing Partnership, arguing that participation in such frameworks is "essential" for staying informed about imminent threats.

Trafalgar House said that pension scheme trustees should also take steps to gain a clear understanding of the mechanisms advisers use to detect relevant cyber threats and incidents, to ensure a robust defence mechanism is in place.

In addition to this, it said that trustees should insist on receiving frequent, detailed reports covering the spectrum of threat management activities, highlighting ongoing, resolved, and potential threats.

Trafalgar House head of IT, Stephen Wright, said: “The change in NCSC threat reporting frameworks, which came into effect at the end last year, significantly alter the way advisories are issued and reported.

“Cybersecurity has fast become one of the biggest threats to schemes. Data breeches, scamming, ransomware, fraud - these have all become the stuff of trustee nightmares. And the sophistication of those threats is evolving rapidly, so it is important that schemes stay as far ahead of them as possible with comprehensive and proactive defense measures.

“It’s also imperative to check-in regularly with advisors that their measures are robust, and reports are undertaken frequently to demonstrate progression of mitigation of all vulnerabilities. A onetime spot check is simply not enough in this environment.

“Sadly, the issue of cyber security isn’t going anywhere but the good news is there is a lot that schemes can do to stay ahead of the curve and protect members.”

The Pensions Regulator (TPR) also recently stressed the need for trustees to ensure they have robust cyber security and business continuity plans in place, pointing to the recent Capita cyber incident as demonstration of the importance of such preventative measures.

---