Premier League Cybersecurity Rules: Why the Wider Football Ecosystem Should Pay Attention

Cybersecurity is now part of the Premier League rulebook

The Premier League officially published its 2026/27 Handbook on 31 July 2026.^[2] Within that Handbook are formal Information Security provisions and the associated Premier League Information Security Baselines.^[1]

This is an important distinction. The requirements are not a new Act of Parliament specifically regulating football, nor do they mean that Premier League clubs have suddenly been classified as UK critical national infrastructure. They are rules established through the Premier League’s own governance framework.

Yet describing them simply as “internal football rules” would understate their significance. For the clubs that are subject to them, the requirements create a formal cybersecurity compliance programme with phased deadlines, assessment obligations and evidence requirements.^[1]

The direction is clear: cybersecurity is moving away from being treated purely as recommended technical practice and towards becoming part of the governance framework of professional football.

Assessment, enforcement, and why now

The measures were approved by all 20 clubs at the Premier League’s Annual General Meeting in June 2026, and are being introduced proactively — ahead of any single high-profile breach at a Premier League club, rather than in response to one.^[6]

The evidence base for acting now is straightforward: NCSC research found that at least 70% of UK sports organisations surveyed had experienced a cyber incident in the previous year, more than double the rate across general UK business.^[3] Incidents elsewhere in European football — including a 2024 ransomware attack that exposed player contracts and financial records at Italian club Bologna FC — underline that the risk is not hypothetical.^[8]

Why football presents an unusual concentration of cyber risk

Football organisations are sometimes discussed as though they were conventional sports businesses with an IT department attached. That is no longer an adequate description.

A modern professional football organisation can depend on an extensive digital operating environment encompassing corporate systems, cloud infrastructure, ticketing, payments, communications, supporter platforms, scouting and recruitment systems, player-performance technology, medical systems, stadium access controls, broadcast infrastructure and specialist analytical platforms.

Around the club sits an equally important supplier ecosystem. Data providers, software developers, sports-science businesses, agencies, payment providers, consultants, infrastructure operators and other specialists may all process information or operate systems that clubs rely upon.

This creates a distinctive risk profile. Football combines high-value transactions, commercially sensitive information, time-critical decisions, personal data and increasing dependence on digital infrastructure. For a cybercriminal, that is an attractive environment.

The threat is not theoretical

The National Cyber Security Centre has warned about cybersecurity risks within sport for several years.^[3] Its 2020 report identified business email compromise, fraud and venue security among the recurring risks affecting the sector.

One case described by the NCSC involved a Premier League club during a transfer negotiation. The club’s managing director was targeted through a spear-phishing attack and entered credentials into a fraudulent Microsoft Office 365 login page. Attackers then used access to the account to monitor communications surrounding a transfer worth almost £1 million and attempted to manipulate the payment process.^[3]

The lesson matters because the attack did not depend on some highly specialised football technology. It exploited identity, email and business process. Those same weaknesses exist in organisations across the football supply chain.

Football holds information whose value goes beyond GDPR

Much cybersecurity discussion still gravitates towards personal data and regulatory consequences. Those risks matter, but football organisations frequently hold information whose commercial or competitive value extends far beyond conventional data-protection considerations.

• Scouting assessments and player recruitment strategy
• Contract negotiations and commercial agreements
• Medical, performance, training and sports-science information
• Proprietary analytics and supporter information
• Internal strategic planning

The compromise of this information could cause significant harm even where the incident does not become a major personal-data breach. A stolen recruitment strategy may have competitive significance without producing the same regulatory consequences as the loss of a supporter database. Unauthorised alteration of performance information could create an integrity problem rather than a confidentiality problem.

Cyber risk in football therefore has to be understood through three dimensions: confidentiality, integrity and availability.

When cyber becomes an operational football problem

The availability question becomes particularly significant where digital systems interact with physical operations. Modern stadiums increasingly depend upon interconnected technology: ticketing, turnstiles, access controls, payments, communications, surveillance, network infrastructure and numerous third-party platforms may all contribute to match-day operations.

An attacker does not necessarily need to steal anything to cause serious disruption. A system that becomes unavailable shortly before kick-off can rapidly turn a cybersecurity incident into an operational incident.

This is why cyber resilience is more useful than thinking exclusively about cyber defence. Security asks whether an organisation can prevent and detect attacks. Resilience asks the additional question of what happens when prevention fails. For football, that may ultimately be the more important question.

What the Premier League is requiring

The Information Security Baselines cover a broad range of security disciplines, including governance, risk management, personnel security, identity and access management, asset management, network security, endpoint protection, email security, vulnerability management, data handling, backups, incident response, supplier security, protective monitoring and independent assurance.^[1]

• 30 April 2027 — Phase OneFoundational controls become mandatory.
• 30 April 2028 — Phase TwoAdditional requirements build on the first phase.
• 30 April 2029 — Phase ThreeFull baseline compliance is required.

The timetable is not a three-year grace period for cybersecurity. Material requirements begin in the first phase, with later phases progressively increasing the expected level of maturity. The model is one of staged improvement rather than deferred compliance.

Phase One: establishing a defensible security foundation

The initial phase concentrates heavily on controls that should form the foundation of a credible modern security programme: security governance and documented risk management, security policies, staff awareness, appropriate user-access processes and multi-factor authentication. Technical expectations extend across networks, endpoints, email, backups, asset management and incident response.^[1]

Poorly controlled privileged accounts, weak email authentication, unmanaged assets, vulnerable endpoints and inadequate recovery arrangements are not obscure technical problems. They are recurring causes of real-world incidents. The Premier League’s approach establishes that such controls should no longer be seen as optional signs of an advanced programme. They form part of the baseline.

Later phases move towards demonstrable resilience

The later stages move into stronger access governance, formal vulnerability management, security exercises, recovery testing, supplier assurance and more developed security monitoring.^[1] This changes the nature of the exercise.

Evidence may be the most important part of the new approach

One of the most consequential aspects of the Premier League framework is its emphasis on assessment and evidence.^[1] Cybersecurity can otherwise become surprisingly subjective: an organisation may have invested in recognised technologies, a board may receive assurances, and a supplier may describe its programme as mature. None of these statements necessarily establishes that important controls operate effectively.

Consider multi-factor authentication. A simple compliance response might be: “We have MFA.” A meaningful assurance process asks which systems require it, which accounts are covered, whether privileged accounts are treated differently, how exceptions and legacy systems are managed, what happens if authentication fails and who reviews the exceptions.

The control may be straightforward. Understanding whether it operates consistently across the organisation is considerably harder. This is where compliance begins to overlap with assurance.

The implications extend beyond Premier League clubs

Member clubs are directly subject to the rulebook. Their suppliers are not automatically subject to the same rules simply because they provide services to a club. That distinction should not be blurred.

Nevertheless, the practical influence of the requirements is likely to extend beyond the clubs. As organisations strengthen their own security programmes, they inevitably start examining the third parties upon which those programmes depend. A club cannot meaningfully claim to understand its cyber risk while ignoring a critical supplier that stores sensitive data or operates an important service.

Technology providers and other football-sector organisations may increasingly encounter questions about how they manage security risk; control access to sensitive systems; detect and escalate incidents; manage vulnerabilities; recover important systems; protect data; govern their own suppliers; and evidence their security claims.

Cybersecurity can become a commercial differentiator

There is a tendency to regard security questionnaires, audits and due diligence as administrative burdens. That view misses an important commercial dimension. A specialist technology company capable of demonstrating robust governance, effective access controls, tested incident response and credible resilience may be easier for a major club to onboard than a technically capable competitor that cannot evidence the same controls.

Cyber maturity can influence procurement, contractual negotiations, due diligence, investor and insurer confidence, and a supplier’s credibility when handling particularly sensitive football information. For businesses serving professional sport, cybersecurity is increasingly part of the proposition being sold, whether or not the organisation describes it that way.

Third-party risk deserves particular attention

The Premier League’s focus on supplier security reflects a broader reality: organisations increasingly outsource technology without outsourcing accountability for the consequences of failure.^[1] A club may depend upon a specialist provider; that provider may depend upon cloud, identity, software and infrastructure services operated by other organisations. The dependency chain can become complex very quickly.

This is not a hypothetical scenario. In August 2026, Dutch club Ajax was caught up in a cyberattack on CEVA Logistics, the shipping and warehousing firm it relies on. The same incident disrupted eight European warehouses and exposed customer data belonging to other CEVA clients including banking giant ING, retailer Bol and Valve’s Steam hardware business.^[7] Ajax was not itself attacked; its customers’ shipping details were exposed through the breach at a supplier it shared with dozens of unrelated businesses. That is precisely the dependency chain the questions below are designed to surface.

These are resilience questions rather than procurement-box-ticking questions. They are also questions that football organisations and their technology partners increasingly need to answer together.

Cyber risk cannot remain solely with the IT team

Many of the decisions required for effective cyber resilience are not fundamentally technical. Management has to determine which services are genuinely critical, which information is commercially sensitive, how much disruption the organisation can tolerate, what level of risk is acceptable, where investment should be prioritised, which suppliers create strategic dependencies and who has authority to accept risk that cannot immediately be eliminated.

An IT or security team can provide the evidence. It cannot make all of those decisions on behalf of the organisation. That is why cybersecurity increasingly belongs within organisational governance rather than being treated simply as an IT operational discipline.

Could your organisation demonstrate its security maturity today?

For organisations across the professional football ecosystem, the framework offers a useful prompt even where the rulebook does not apply directly. Imagine an important club customer asks for detailed assurance before renewing a contract. Could your organisation demonstrate its current cyber-risk posture?

• Can you provide a reliable inventory of important systems and data?
• Can you demonstrate how privileged access is governed?
• Can you show that important vulnerabilities are identified and remediated?
• Can you explain how a serious incident would be managed?
• Have senior executives tested decisions through a realistic cyber scenario?
• Can critical systems be restored after ransomware or a destructive attack?
• Can you evidence appropriate governance of your own critical suppliers?

These questions move the discussion away from cybersecurity products and towards organisational capability.

Assess first, then prioritise

The answer is not necessarily to launch immediately into a large certification programme. Security maturity and risk profiles vary considerably between organisations. A company handling sensitive player analytics may require a different control emphasis from a business supplying non-critical marketing services.

A sensible starting point is an independent cybersecurity maturity and compliance assessment: establish what capabilities already exist, where material weaknesses remain and which improvements would reduce the greatest amount of business risk. For organisations operating in or supplying professional football, the Premier League Information Security Baselines provide a useful reference point alongside recognised frameworks and established cybersecurity standards.

Test the organisation, not only the technology

A maturity assessment can establish whether controls exist. A realistic exercise can establish whether the organisation knows how to use them. Cyber tabletop exercises are particularly valuable because they expose dependencies that are difficult to identify through documentation alone.

A simulated ransomware incident, compromised supplier or loss of a critical match-day system forces practical questions: who takes control, who decides whether operations continue, who contacts customers and regulators, how are technical teams prioritised, which external suppliers are required, who can make financial decisions, and what happens if communications systems are unavailable?

It is considerably better to discover ambiguity during an exercise than during an actual attack.

Where virtual security leadership can help

Not every football-sector organisation requires, or can justify, a full-time senior cybersecurity executive. That does not remove the need for senior-level security governance.

For organisations with capable IT teams but limited specialist security leadership, a virtual CISO or independent security adviser can help bridge that gap. The value is not simply technical expertise: effective leadership translates technology into business risk, challenges assumptions, establishes priorities, coordinates assurance activities and gives management an independent view of whether its security posture is proportionate to the risks it faces.

Compliance should not become the objective

There is an inevitable danger when detailed cybersecurity frameworks are introduced. Organisations can start optimising for the framework rather than for the underlying risk: a control is implemented because an auditor expects it, a document exists because a checklist requires it, and an annual exercise is performed because the policy says so.

Those activities can be useful. But they are not the objective. The objective is to protect the organisation’s ability to operate, make decisions, serve customers and recover when something goes wrong.

The Premier League’s new requirements are therefore best understood not merely as a compliance story for 20 clubs. They are an early signal of a broader shift: in connected, high-value ecosystems, organisations will increasingly be expected to demonstrate—not simply assert—that cyber risk is being governed.

The question is no longer “Do we take cybersecurity seriously?” Almost every board will answer yes. The more difficult question is “Can we demonstrate that our organisation would continue to function when its cyber defences are tested?”