Question to the Department for Transport:

To ask the Secretary of State for Transport, pursuant to the answer of 15 July 2026 to question 17243, what the threshold is for transport operators to report cyber security incidents involving them.

Mandatory thresholds for reporting cyber security incidents under the Network & Information Systems Regulations 2018 can be found on gov.uk at the following link (Annex E, p42 onwards):

Implementation of the NIS directive: DfT guidance version 1.1 (https://assets.publishing.service.gov.uk/media/5ee3a21ae90e0704315ecf32/implementation-of-the-nis-directive-dft-guidance-document.pdf)

No thresholds are set for voluntary reporting outside of the regulatory requirements.