We’re now officially a signatory of the UK Government’s Cyber Resilience Pledge, committing our board to formal cyber security training, signing up for early threat warnings from the National Cyber Security Centre (NCSC) and auditing Cyber Essentials coverage across our supply chain.
The pledge is a voluntary UK Government initiative that encourages organisations to take practical steps to strengthen their defences and improve their resilience to cyber attacks. It treats cyber security as a business-critical responsibility, one that needs leadership, awareness of emerging threats and a clear understanding of the risks posed by suppliers and other third parties.
We have signed the pledge to highlight the importance of taking a proactive, joined-up approach to cyber security. It also supports the wider objective of improving resilience across the UK, recognising that the security of individual organisations is connected to that of their customers, partners and suppliers.
MARTIN WALSHAM, DIRECTOR OF CYBERSECURITY, UK
The Three commitments, three deadlines
The pledge goes beyond good intentions. Every signatory commits to three concrete actions, each within a set timeframe:
1
Make cyber security a board-level responsibility.
Signatories implement the Government’s Cyber Governance Code of Practice. All board members complete the NCSC’s Cyber Governance Training within three months of signing, then every year after.
2
Make cyber Stay ahead of emerging threats.
Within one month, signatories register for the NCSC’s Early Warning service, which flags potential threats and vulnerabilities so organisations can act before they escalate.
3
Secure the supply chain.
Within two months, signatories register for the Cyber Essentials Supplier Check Tool, audit Cyber Essentials coverage across their supply chain and take a risk-based approach to requiring suppliers to hold the certification.
Signatories also agree to:
- encourage the same steps across their own supply chains
- publish their signed pledge declaration on their website
- share a public progress update once a year.
Why the supply chain matters
Cyber attacks rarely stay contained. A weakness in one supplier’s systems can quickly become a problem for its customers and partners, which makes resilience something businesses can only build together.
The pledge doesn’t guarantee protection against cyber attacks. What it does provide is a practical framework that keeps cyber risk on the leadership agenda, year after year.
By signing, we join the UK Government’s push to raise security standards across the UK economy.
“Cyber resilience is an ongoing commitment, not a one-off effort,” said Martin Walsham. “By signing the pledge, we want to reinforce the importance of making cyber security a business priority and encourage organisations to take practical steps to protect themselves, their customers and their supply chains.”
Holding ourselves to the standard we test against
For our cybersecurity team, the pledge reflects work they already do every day. Our UK team is a Cyber Essentials and Cyber Essentials Plus certification body, holds NCSC CHECK, CREST and STAR accreditations, and is one of only four organisations in the UK authorised by the NCSC to deliver independent cyber resilience testing of connected products and services.
From governance, risk and compliance to penetration testing and red teaming, the team helps organisations understand where their real risks sit, including the ones hiding in their supply chains. Signing the pledge means applying that same rigour to ourselves.
Not sure how resilient your organisation, or its suppliers, really is? Talk to our cybersecurity team.