Illustrative image - not a photograph of Jaguar Land Rover facilities.
Cyber incidents can disrupt services as well as compromise data. When a service stops, the damage shows up as work that does not get done. For each service that matters, leaders face a decision: how much disruption would the organisation accept, and what evidence shows it could cope for that long?
Vehicle production at Jaguar Land Rover stopped. The Cyber Monitoring Centre, which analysed the incident, records a suspension of approximately five weeks across the company's major UK plants after a late August 2025 cyber incident in its internal IT environment led to an IT shutdown and a halt in global manufacturing. While it lasted, UK manufacturing output was down by close to 5,000 vehicles a week.
In its October 2025 statement the Centre models the UK impact at £1.9 billion, within a range of £1.6 billion to £2.1 billion, and says the vast majority of it was lost manufacturing output at JLR and its suppliers. That is a scenario model with its own range, not a confirmed final bill and not an annual statistic. Affected suppliers, the Centre records, took measures including reducing pay, banking hours and in some cases laying off staff.
A second UK case sits in a different register. The government's written ministerial statement on the June 2024 ransomware attack on Synnovis, a pathology supplier to the NHS, records disruption to services at five NHS Trusts and local care providers across several London boroughs, over 11,000 delayed outpatient and elective procedure appointments, and that the attack contributed to the death of a patient.
The service disruption in these cases is consequential in its own right. It points to a decision for leaders: for each service that matters, how much disruption would this organisation accept, and what evidence shows it could cope for that long? E2E Security Consulting helps clients organise and challenge the evidence behind such decisions. Experienced consultants can make the work clearer and more manageable; accountability for the answer stays with the organisation.
There is no universal safe duration. For one service, establish what harm losing it causes, what obligations apply, how long workarounds could hold and what restoration has demonstrated. Accountable leadership can then agree and record the position.
The NCSC's guidance on disruptive cyber attacks, reviewed in October 2026, opens its business continuity section by asking organisations to understand which technology and business services are most important to them, how long they can operate without them, and which systems support them, and to capture that in the business continuity plan. In its severe-threat guidance for organisations delivering the UK's critical services, the NCSC also frames digital disruption as a business continuity and national resilience issue.
No single role sets the answer alone. Each brings different knowledge and judgement; leadership owns the agreement.
Harm to customers, patients, revenue and staff, and which services come first.
Dependencies mapped, and what recovery can realistically deliver, including the backlog.
The risk position within legal, safety, regulatory and contractual obligations. Appetite shapes how a duty is met; it cannot excuse it.
The National Audit Office defines cyber resilience as the ability to maintain key functions and services and protect data in the face of an adverse cyber event. It says effective oversight does not require deep technical expertise: it calls for asking the right questions and collaboration between audit committees, senior leaders and technical teams.
The NCSC says understanding business-critical services and their dependencies helps an organisation assess feasible workarounds, prepare resources, prioritise additional protection and sequence restoration. An agreed disruption position can help leaders weigh those choices. The NCSC also says many severe-threat measures are complex and potentially costly and may be disproportionate today, yet cannot be improvised under pressure. Planning needs to address both constraints.
Each answers a different question. The first two do not, by themselves, demonstrate recovery capability.
How much disruption the organisation would accept, against a stated scenario.
Usually set inside that limit, to leave headroom.
What restoration and the workaround delivered under the conditions tested.
Four questions make the abstract testable.
| The question | Grounded in | A usable answer |
|---|---|---|
| Which single service would hurt most if it stopped? | NCSC business continuity guidance; Cyber Governance Code action A1 - identified, prioritised and agreed | One named service, not a system and not a list |
| How much disruption would we accept before the harm is unacceptable? | NCSC's middle consideration | A stated period, with the scenario and obligations it assumes, agreed by leadership |
| Who is accountable for cyber security risk to it? | UK Government Secure by Design principle 1 | A named senior person with the authority to lead, and appropriate resources made available |
| What have restoration and the workaround achieved in an exercise? | NCSC technical recovery guidance; Code actions D1 and D2 | A date, a measured result, and what it changed |
Secure by Design principle 1 asks for senior risk owners with the experience, knowledge and authority to lead throughout the service's life cycle, and appropriate resources made available. It does not require the owner personally to hold a budget.
“All our systems are critical” prioritises nothing. “As quickly as possible” restates the wish. “It is covered in the plan” does not show how the plan performs: many plans fail in practice, the NCSC says, which is why it asks for regular testing and a full exercise where possible.
The Cyber Governance Code of Practice is guidance for directors, not a statutory obligation. It asks boards to gain assurance that critical technology, processes, information and services have been identified, prioritised and agreed. It also asks for an incident response and recovery plan, at least annual exercising with relevant internal and external stakeholders, and lessons reflected in the plan and risk assessments. Its assurance section asks boards to set suitable metrics and agree tolerances for each. It does not prescribe a permitted service outage duration; that requires the organisation's judgement within applicable obligations.
This example is hypothetical. Every figure is invented, not a benchmark or a client result. None should be copied as a safe tolerance, workaround capacity or deadline for another service.
A distributor names order dispatch as the service that would hurt most. Under one specifically agreed scenario - loss of the dispatch platform on a normal weekday - leadership agrees eight hours as an upper planning limit, beyond which the contractual and customer harm would be unacceptable. The recovery lead sets a four-hour restoration target, inside the limit so there is headroom. Operations expects a manual workaround to handle around 25% of normal volume for the first four hours, dependent on trained people being on shift and records being accessible.
Then they exercise it, and record a six-hour restoration result.
Six hours is inside the eight-hour planning limit, but that alone does not establish acceptability. It misses the four-hour target and leaves two hours of margin rather than the planned four. The workaround's stated coverage ends at four hours, two hours before restoration, and its capacity remains an assumption unless tested. Even that assumed 25% capacity is only partial service. The exercise exposes a planning gap; the remaining margin does not close it.
The exercise also has to test what “recovered” means. The NCSC asks organisations to document dependencies and restart sequencing, and to plan and test bringing systems online and reconciling data, including validating and integrating records from manual workarounds. Shared identity, networking, storage and cloud connectivity belong in that test, alongside supplier dependencies. For dispatch, agree what safe service resumption requires and how the backlog will be handled. If six hours measures only a responsive platform, it does not establish service recovery; clearing the backlog may take longer than resuming dispatch.
The service owner and recovery lead agree corrective actions and retest them within 30 days, then report the result. That deadline is illustrative too. A gap needs an owner and a date.
GovAssure assesses government critical systems against the NCSC's Cyber Assessment Framework. It is designed for OFFICIAL government systems, including government-sector critical national infrastructure, and assesses government organisations and their critical systems, not suppliers directly. Suppliers should ask what assurance and contractual expectations follow from their customer's assessment.
UK Government Secure by Design principles are mandatory for government departments and arm's length bodies, optional for other parts of the public sector. Third-party suppliers should liaise with their security contacts to understand which requirements apply.
Where your own critical services rely on suppliers, the NCSC says continuity planning should involve them, including planning for abrupt loss of supplier services and understanding key suppliers' resilience arrangements. Those dependencies need to inform the agreed disruption position.
Start with one service and establish what the organisation can currently evidence about it.
E2E Security Consulting's published UK Government Secure by Design work covers obligations and risk appetite, service scope and dependencies, risk and threat assessment, proportionate controls, decision rights, evidence and owned actions. For one service, useful outputs can include:
We help organise and challenge the evidence. The organisation keeps the decision.
Not a product demo - a conversation about one service and the decision and evidence it needs. Our Secure by Design consultancy is a good place to start.
Deciding in advance what to do while a service is unavailable gives the response a starting point. When a severe cyber incident hits, the NCSC warns, it will be too late to start working out roles, responsibilities and decision-making thresholds for the first time.
A first meeting can start this work; it need not settle every answer. Leaders do not need deep technical expertise to ask the questions. Pick one service, discuss acceptable disruption and record the scenario and obligations behind the proposed position. Ask what restoration and workarounds have been shown to achieve, and assign gaps to owners with dates. Service owners bring the impact, technical teams bring dependencies and recovery evidence, and advisers can help challenge both. Leadership owns the agreement.
Both, but the consequence is a business one. The NCSC frames disruption to the digital operations of organisations delivering critical services as a business continuity and national resilience issue. The damage is usually measured in services that stop and work that is not done.
There is no universal safe duration. It is a business decision for leadership, taken against a stated scenario and the organisation's legal, safety, regulatory and contractual obligations. A security function can model recovery and cost options; only leadership can agree how much disruption is acceptable, and the plan still has to be exercised to show it can be met.
The Cyber Governance Code of Practice, guidance for directors rather than a statutory obligation, asks boards to gain assurance that critical services have been identified, prioritised and agreed, to hold an incident response and recovery plan exercised at least annually, to set metrics and to agree tolerances. It does not prescribe a permitted outage duration.
Not directly. GovAssure assesses government organisations and their critical systems against the NCSC CAF, not their suppliers. A supplier is reached through its customer's assessment and the assurance and contractual expectations that follow from it.
It depends who you are. The Secure by Design principles are mandatory for UK government departments and arm's length bodies, optional for other parts of the public sector, and for third-party suppliers the requirements are set by the customer's security contacts.
More from the E2ERisk team on operational resilience, recovery and continuous supplier assurance.
Occasional, practical notes on UK public-sector cyber risk and resilience. No spam, unsubscribe anytime.
A conversation about one business-critical service - the decision and the evidence it needs. Our consultants lead it; it is not a product walkthrough.