The UK government has announced that over 60 businesses have officially joined a new initiative aimed at bolstering the cyber resilience of organizations across the nation. This endeavor is part of a broader strategy to enhance cybersecurity and foster a culture of vigilance within organizations, particularly those of medium and large scale.
The initiative, known as the Cyber Resilience Pledge, was first introduced during the CYBERUK conference held in Glasgow in April. At that event, the government also revealed a significant financial commitment of £90 million (approximately $120 million) to support various cybersecurity initiatives. This move highlights an ongoing recognition of the critical need for robust measures to protect businesses from increasingly sophisticated cyber threats.
Among the initial signatories to the pledge are prominent names such as Marks & Spencer, Nationwide, ITV, Microsoft UK, Cloudflare, Deloitte LLP, Accenture UK, and Vodafone Group. The government emphasized that this is just the beginning of a wider movement intended to engage businesses at all levels in the fight against cyber threats.
The Cyber Resilience Pledge is a voluntary scheme, which sets out specific commitments for organizations that choose to participate. Signatories are required to undertake several key actions, including:
1. Elevating cybersecurity to a board-level responsibility by implementing the Cyber Governance Code of Practice. This also entails ensuring that all board members complete the National Cyber Security Centre’s (NCSC) Cyber Governance Training.
2. Registering for the NCSC’s complimentary Early Warning alert service, which serves to provide businesses with timely information about potential threats.
3. Adopting a risk-based approach that mandates Cyber Essentials certification throughout their supply chain. This includes not only ensuring their own compliance but also encouraging suppliers to adhere to these cybersecurity standards.
While the pledge focuses primarily on medium and large organizations, the ultimate goal is to enhance the general cybersecurity posture across a more extensive range of businesses. By incentivizing suppliers to achieve Cyber Essentials certification, the government hopes to establish a wider safety net that will benefit all. However, the effectiveness of this approach remains to be tested. Previous data has shown that, despite the importance of these measures, only around 35,000 organizations—out of more than five million businesses in the UK—are currently signed up to the Cyber Essentials framework.
Importantly, businesses with an annual turnover of less than £20 million (around $27 million) that achieve Cyber Essentials certification can access complimentary cyber-liability insurance. This insurance package also includes professional incident response support, as highlighted by the NCSC in earlier communications.
### A Strategic Approach to Cyber Resilience
The Cyber Resilience Pledge is just one of several government initiatives aimed at enhancing corporate cyber resilience. The government is also introducing a Cyber Security and Resilience Bill, which will impose new requirements on critical national infrastructure (CNI) providers. Furthermore, a newly established Cyber Action Plan seeks to bolster resilience and accountability across central government entities.
In addition to these legislative efforts, the Cyber Governance Code of Practice stands out as another voluntary initiative aimed at helping board members manage cyber risks in alignment with other critical business risks. Under the auspices of the Cyber Resilience Pledge, the government has launched a Cyber Charter, which is directed at its 39 strategic suppliers, inviting these entities to join the pledge. To date, 20 of these suppliers have signed on.
Microsoft UK’s CEO, Darren Hardman, emphasized the evolving nature of cyber threats as artificial intelligence continues to reshape both the dangers faced and the methods available for response. He noted, “Stronger board-level accountability and supply chain security are essential for the UK to stay ahead in cybersecurity.” He expressed pride in Microsoft’s two-decade partnership with the UK government, reaffirming the company’s commitment to leveraging AI technology to safeguard critical national infrastructure, public services, and businesses against cyber-attacks.
The government’s commitment to cyber resilience has been echoed by technology secretary Liz Kendall, who stated that cybersecurity has transcended its status as solely an IT issue and has now become a fundamental business imperative. “The steps in this pledge are practical, achievable, and proven to make a difference,” she asserted. Kendall encouraged organizations across the UK to take the lead from current signatories and embrace these protective strategies.
As the landscape of cyber threats continues to evolve rapidly, the Cyber Resilience Pledge serves as a crucial step in the UK’s efforts to enhance national security and corporate resilience against potential cyber incidents.