What information security rules do Premier League clubs have to meet?

Premier League clubs must meet information security baselines in three phases by 30 April 2027, 2028 and 2029, with two assessments each season.