Fewer than 15 of the UK's 350 largest listed companies have signed up to a new voluntary cybersecurity initiative, the Cyber Resilience Pledge, despite an appeal from government ministers. The pledge, launched on Tuesday, aims to encourage businesses to enhance their cyber defenses.
The launch event, held at 10 Downing Street and hosted by Technology Secretary Liz Kendall, announced 70 founding signatories. However, 20 of these are designated strategic government suppliers who were invited to join through a separate Government Cyber Charter. This leaves approximately 50 companies from the broader economy as voluntary participants.
Companies that did commit to the pledge include major firms like Aviva, the London Stock Exchange Group, and Marks & Spencer, the latter having experienced a significant cyberattack last year. Smaller cybersecurity firms, such as C3IA Solutions, Grey Zone Services, and Nexor, also signed on, aligning with their core business offerings.
The Cyber Resilience Pledge asks signatories to implement three key actions: making cybersecurity a responsibility at the board level, registering for the National Cyber Security Centre's (NCSC) free Early Warning service, and adopting a risk-based approach to requiring Cyber Essentials certification within their supply chains. These commitments are voluntary, and no enforcement mechanisms are in place.
The low turnout among FTSE 350 companies has drawn commentary. Jamie MacColl, a senior research fellow at the Royal United Services Institute, expressed surprise at the number of signatories, suggesting that many large companies may already meet equivalent or higher cybersecurity standards through existing certifications.
The government highlighted the financial impact of cyberattacks, stating that the average cost of a significant attack on a UK business is nearly £195,000, with an estimated annual cost to organizations of £14.7 billion, excluding broader economic disruption. This figure is linked to research supporting the Cyber Security and Resilience Bill, which is still under parliamentary debate and not expected to be enforced until 2028.
The Cyber Resilience Pledge was originally intended to follow the unveiling of the UK's National Cyber Action Plan, but that plan's release was delayed. The government indicated that the pledge's effectiveness will be reviewed after a 12-month period, with potential adjustments to its requirements based on the evolving threat landscape.
Some observers suggest this voluntary approach could be a precursor to future regulation. MacColl noted a pattern in UK cyber policy, where voluntary measures often precede legislative action, suggesting that a lack of widespread adoption could provide the government with justification for introducing mandatory requirements.
