New rules that push IT firms providing “critical” services to the U.K.’s financial sector to share more data about cyberattacks and the measures they have taken to maintain resilience have been broadly welcomed by industry experts. However, concerns remain over how suppliers will be classified and how key data might be gathered and shared.

The U.K.’s three key financial regulators–the Financial Conduct Authority (FCA), Bank of England, and Prudential Regulation Authority–have set out key duties on “critical” third parties to report major incidents like cyberattacks, natural disasters, and power outages. The actions will provide U.K. financial regulators with regular assurance that cyberthreats are being identified and mitigated so that the U.K. financial sector is not at risk.

These companies–yet to be designated by HM Treasury and the regulators, but which are likely to be mainly large tech firms–will also need to conduct resilience testing and scenario-based exercises, which could involve collaborating with financial services firms, payment systems, and other financial market infrastructures (FMIs).