The UK Cyber Resilience Pledge - What It Commits Businesses To

At CYBERUK on 22 April 2026, the UK government launched the Cyber Resilience Pledge - a voluntary commitment for businesses to raise their security baseline, backed by a further £90 million of investment in defending small and medium sized businesses. The pledge asks signatories to do three specific things: make cyber security a board-level responsibility, enrol in the National Cyber Security Centre's Early Warning service, and require Cyber Essentials certification across their supply chains. For UK employers - particularly those bidding for government work or sitting in regulated supply chains - the pledge is a clear signal of the security baseline that will increasingly be expected.

The pledge sits alongside a wider 2026 cyber and AI regulatory shift, including the AI Code of Practice Regulations 2026 and the Crime and Policing Act, and reinforces the direction of travel set out in our existing IT security policies and cyber resilience policies guidance.

What the Pledge Actually Commits Signatories To

The pledge has three concrete commitments, not the usual aspirational language. Each one has practical, documentable consequences.

1. Board-Level Cyber Security Responsibility

Signatories commit to treating cyber security as a board agenda item, not an IT operational concern. In practice this means a named board member with cyber accountability, regular reporting to the board on cyber risk and incidents, and documented evidence that cyber risk has been considered as part of strategic decision-making. This mirrors the NCSC's Cyber Governance Code of Practice and aligns with the direction of regulatory expectation across financial services, healthcare, and critical national infrastructure.

2. NCSC Early Warning Service Enrolment

The Early Warning service is a free NCSC threat intelligence service that notifies organisations when their networks, domains, or IP ranges show signs of compromise. Enrolment is straightforward but requires the organisation to register its assets with NCSC and have a process for acting on the alerts received. The pledge commitment is not just to enrol - it is implicitly a commitment to act on what Early Warning surfaces.

3. Cyber Essentials Across the Supply Chain

The most consequential commitment. Signatories agree to require Cyber Essentials certification from suppliers as part of procurement and contract management.

This propagates the certification down the supply chain - a tier-1 supplier who signs the pledge will require its own suppliers to be certified, and so on.

For SMEs supplying larger organisations, Cyber Essentials is moving from competitive advantage to minimum entry requirement. Our Cyber Essentials checklist maps directly to the certification controls.

Sources: GOV.UK announcement, 22 April 2026 and Defence Online, 27 April 2026.

Why This Matters Even Though the Pledge Is Voluntary

The pledge is not law. There is no penalty for not signing. But three things make it operationally significant.

Procurement signal. Government and large enterprise buyers are increasingly using pledge signatories as a procurement filter. Not signing does not disqualify a business - but it removes a positive differentiator and can prompt additional security due diligence.

Supply chain propagation. Once tier-1 suppliers sign, their Cyber Essentials requirement flows down to their suppliers contractually. SMEs in regulated supply chains will encounter this as a contract requirement long before they encounter it as a regulatory one.

Direction of travel. The pledge sits alongside the AI Code of Practice Regulations 2026, the Cyber Security and Resilience Bill, and the broader Crime and Policing Act enforcement landscape. Voluntary today, expected tomorrow, regulated the day after.

What Signing the Pledge Requires You to Have Documented

The pledge commitments are easy to make and harder to evidence. Signatories should be able to produce, on request, the following documentation.

Board-Level Governance Evidence

A documented cyber security policy approved at board level
Board minutes referencing cyber security review and risk acceptance
A named individual with board-level accountability for cyber
A cyber risk register reviewed at board cadence

Early Warning Enrolment and Response

Registration with NCSC Early Warning
A documented incident response procedure that integrates Early Warning alerts
Evidence that alerts are being triaged and acted on

Supply Chain Cyber Essentials Policy

A supplier security policy requiring Cyber Essentials certification
Procurement procedures that verify certification before contract award
Contract clauses requiring suppliers to maintain certification for the contract duration
A register of suppliers with certification status and renewal dates

For most SMEs, the documentation gap is wider than the technical control gap. The controls are often in place - but evidence of governance, supplier oversight, and board engagement is missing.

What the £90 Million SME Funding Actually Does

The £90 million announced alongside the pledge is targeted at strengthening SME defences specifically. It is not a direct grant pool - it funds expanded NCSC services, Cyber Essentials uptake support, and sector-specific guidance. SMEs should expect:

Continued availability of the NCSC's free SME-focused tools (Check Your Cyber Security, Exercise in a Box, Early Warning)
Sector-specific Cyber Essentials guidance through industry bodies
Support for smaller suppliers being asked to certify by larger customers

The funding does not remove the cost of Cyber Essentials certification itself - for most SMEs that remains a self-funded compliance cost.

Three Practical Actions Employers Should Take Now

Decide whether to sign. If you bid for government work, sit in a regulated supply chain, or supply enterprise customers, the pledge is likely to be raised in procurement within 12 months. Signing pre-emptively is easier than retrofitting governance evidence under contract pressure. If you do not sign, document why - board-level acceptance of the choice is itself part of good governance.
Audit your Cyber Essentials position. If you are not certified, get certified. If you are certified, confirm renewal is on track and that the scope of certification covers the systems your customers care about. Certification scope is one of the most common gaps surfaced in supplier audits.
Document your supplier security expectations. Whether or not you sign the pledge, the direction of travel is clear: customers will increasingly require evidence that you manage supplier security risk. A short, documented supplier security policy is the foundation. It does not need to be elaborate - but it needs to exist and be enforced.

Where This Fits in the Wider 2026 Cyber Picture

The pledge is one part of a broader 2026 cyber and AI regulatory shift. Alongside it sit the AI Code of Practice Regulations 2026 (SI 2026/425), the Crime and Policing Act 2026 (which brings AI chatbots into illegal content rules and imposes 48-hour takedown duties), the Cyber Security and Resilience Bill (extending NIS-style obligations to a wider set of organisations), and the continued expansion of Cyber Essentials as the de facto baseline for UK procurement.

The common thread is that voluntary best practice and regulatory minimum are converging. Employers who treat the pledge as a one-off PR opportunity will miss the wider point - the standards behind it are becoming the baseline regardless of whether the pledge itself is signed.

How Policy Pros Can Help

Policy Pros helps businesses build the documentation and governance evidence the Cyber Resilience Pledge expects: board-level cyber security policies, supplier security policies, Cyber Essentials readiness packs, and the procurement clauses that propagate certification down the supply chain.

If your existing information security policies need updating to reflect the pledge commitments, or you need a complete cyber governance pack from scratch, our policy review service can identify what needs changing and deliver updated documents on a fixed-price basis.