Cyber attacks are no longer just a problem for large enterprises or household name brands. Increasingly, small and medium-sized businesses are being targeted, either directly or as a route into larger supply chains.

To help improve the UK’s overall cyber resilience, the government has introduced a new voluntary initiative called the Government Cyber Resilience Pledge. While it was initially aimed at larger organisations and FTSE companies, the guidance makes it clear that businesses of all sizes are encouraged to adopt the principles.

For SMEs, this is likely to become increasingly important over the next 12–24 months, especially for businesses that work with larger organisations, public sector bodies, or supply chains where cyber security requirements are tightening.

What Is the Government Cyber Resilience Pledge?

The pledge is a voluntary commitment designed to improve cyber resilience across UK organisations.

Businesses signing the pledge commit to three key actions:

1. Make Cyber Security a Board Level Responsibility

This means ensuring cyber security is treated as a business risk, not just an IT issue.

Organisations are expected to:

• Follow the Cyber Governance Code of Practice
• Ensure board members complete cyber governance training from the NCSC (National Cyber Security Centre)
• Review cyber risks regularly at leadership level

For SMEs, this doesn’t necessarily mean creating a large governance structure. It means business owners and directors understanding:

• What cyber risks exist
• How those risks could impact the business
• What plans are in place if something goes wrong

2. Sign Up to the NCSC Early Warning Service

The NCSC Early Warning service is a free tool that alerts organisations to suspicious activity affecting their domains and networks.

It can identify:

• Compromised credentials
• Malware activity
• Vulnerabilities
• Potential attacks targeting your systems

The service is free and relatively quick to implement, making it one of the easiest wins for SMEs wanting to improve visibility and threat awareness.

3. Improve Cyber Security Across Supply Chains

This is likely to have the biggest impact on SME businesses.

The pledge encourages organisations to require Cyber Essentials certification, or equivalent security controls, from suppliers and partners.

In practice, this means more businesses may soon ask their suppliers:

• Are you Cyber Essentials certified?
• What cyber security controls do you have in place?
• How do you protect our data?
• What happens if you suffer a breach?

For SMEs, cyber security is rapidly becoming a commercial requirement, not just a technical one.

Why This Matters for SMEs

Even if your business never signs the pledge itself, your customers may.

And when larger organisations begin reviewing their supply chains, SMEs without basic cyber security measures could:

• Lose opportunities
• Fail supplier assessments
• Face additional scrutiny during tenders
• Be seen as higher risk

On the other hand, businesses that can demonstrate good cyber security practices may gain a competitive advantage.

The government itself highlights that organisations adopting these measures can:

• Build greater trust with customers
• Improve resilience against attacks
• Differentiate themselves from competitors
• Reduce disruption and recovery costs

Cyber Essentials Is Becoming Increasingly Important

One of the strongest themes throughout the pledge is the importance of Cyber Essentials.

Cyber Essentials is the UK government backed baseline cyber security certification designed to protect organisations against the most common attacks.

It focuses on five core technical controls:

• Firewalls
• Secure configuration
• User access control
• Malware protection
• Security updates

The government describes Cyber Essentials as the cyber equivalent of locking your doors and windows.

For many SMEs, achieving Cyber Essentials is likely to become one of the simplest ways to:

• Demonstrate credibility
• Meet supplier requirements
• Improve internal security
• Prepare for future compliance demands

How SMEs Can Prepare Now

You do not need a large internal IT department to begin improving cyber resilience.

Here are some practical first steps:

Review Your Current Cyber Security Position

Ask:

• Do we have MFA enabled?
• Are systems patched regularly?
• Do staff receive security awareness training?
• Are backups tested?
• Could we recover from ransomware?

Consider Cyber Essentials Certification

If you are not already certified, now is a good time to explore it, particularly if you work with larger organisations or hold sensitive customer data.

Involve Leadership

Cyber security should not sit solely with IT. Directors, and business owners should understand:

• Key business risks
• Recovery plans
• Supplier risks
• Financial impact of downtime

Assess Your Supply Chain

Think about:

• Which suppliers have access to your systems or data?
• What happens if one of them is compromised?
• Do you ask suppliers about cyber security?

Create an Incident Response Plan

Many businesses only discover weaknesses during an incident. Having a documented response plan can significantly reduce downtime and disruption.

Final Thoughts

The Government Cyber Resilience Pledge is another strong signal that cyber security expectations across UK businesses are increasing.

For SMEs, this is not about fear or box-ticking. It is about:

• Protecting the business
• Protecting customers
• Remaining commercially competitive
• Building resilience in an increasingly digital world

Businesses that act early will likely find themselves in a much stronger position as cyber security requirements continue to evolve across supply chains and procurement processes.

There is a general feeling in the industry the Government’s Cyber Resilience Pledge is a strong indication that compulsory cyber security measures are coming and that it is a matter of national security. And this makes sense as we are in a state of modern warfare, being fought in cyber space, where mass disruption and economic strain are high on the target list.

If you would like advice on Cyber Essentials, supply chain security, or improving your organisation’s cyber resilience, get in touch with the team at Intrasource.