Still work to be done on UK cyber resilience

In July, I left the Department of Science Innovation and Technology (DSIT) after six and a half years in positions leading UK technology security policy. In my time there, teams I led made connected technology in the UK more secure by implementing the Product Security and Telecommunications Infrastructure Act and setting out best practice for other technology security, protected modern elements of the economy by proposing expanded legislation, increased broad understanding of cybersecurity through the Cyber Essentials certification scheme, led international cyber policy conversations, developed international standards, and brought cyber into boardrooms with the Cyber Governance Code of Practice and the Cyber Resilience Pledge. 

I walk away proud of our team’s work on UK cyber resilience, confident in the framework we left behind, and humbled by all I have learnt in the process. However, the job is far from done. 

There are countless opportunities to further secure the UK. The government should continue to push the cyber agenda into boardrooms, improve the delivery and implementation of existing policy, provide support for those impacted by cyberattacks, drive public awareness on cyber resilience, including by specifically encouraging public discourse on cyber policymaking, and lead on cyber policy abroad. 

Legislating for board accountability

Much has been said about the need for cyber to be a boardroom issue, rather than a strictly technical issue. Cyberattacks don’t only impact technical teams; they stop companies generating revenue or delivering services and cause reputational damage. Prevention and response requires board oversight, executive action, and work across internal boundaries – as well as the right legislative framework at a national level. 

Board members are expected to understand and govern risk when it comes to human resources, legal, financial, and strategy issues without getting too deep into the technical weeds. When it comes to cyber and technology broadly, however, boards often reflexively kick the issue to technical teams. That’s no longer good enough.

The government has tried to address this reflex by increasing its expectations on companies and boards with the Cyber Resilience Pledge. Launched at Number 10 in July 2026, the pledge asks boards to get on board – via the Cyber Governance Code of Practice, an initiative which  helps them grasp technology risk without overdosing on technical detail. The pledge also tells boards they need to have better control over their supply chain security, with tools like Cyber Essentials. The forthcoming Cyber Action Plan should keep that momentum going. 

The pledge also balances out the conversation between UK entities and the UK Government. Any government support and intervention should be predicated on organisations having done the minimum required, as laid out in the pledge. 

Implementing security by design

Making technology secure at the point of use, installation, download, or plug-in is the best way to bring widespread security to everyone. The burden of security should fall to those that sell the technology, particularly when the end user is not a large company; A FTSE 350 company might be expected to configure settings to improve security, my 75-year-old mother shouldn’t. In reality, often neither do. 

The UK’s Product Security and Telecommunications Infrastructure (PSTI) regime was the first step in a national secure-by-design approach, which has evolved to include a full suite of guidance on how technology companies should design their products and services. Lessons learned from the PSTI should be used to develop the next generation of secure-by-design requirements, legislative or otherwise. 

There is growing public pressure among commentators and legislators to follow the EU and create a UK version of the Cyber Resilience Act to put this guidance into law. The government must tread carefully here, ensuring that any benefits outweigh the cost. Anything mandated should be proven to reduce the impact of cyberattacks on UK persons – with cost proportional. 

We must ask tough questions of the policy. For example, how much more secure has banning default passwords in internet-of-things devices made us, and how does this benefit multiply if this becomes a requirement across all technology? What other requirements impose a reasonable cost on technology producers but have a disproportionally large impact on the security of the nation? 

Moreover, implementation matters. Laws are expensive, difficult, and time consuming to get on the statue book, let alone implement properly. The internal appeal to pursue them in government is often lost after the law is passed – no longer groundbreaking, no longer a sexy future solution; just work for companies, civil servants, and regulators. Careers can be made in developing primary legislation, but are rarely made in implementing it. But substantial effort has gone into creating regulations that already exist. To not implement these with gusto risks losing the financial and political investment in these laws and creating a legislative framework on paper only. Civil servants should be better supported – and rewarded – for executing the vital regulations that have already been set out. Without this, new laws will not be taken seriously. 

Regulating for resilient critical organisations

When I joined the UK government in 2019, the EU’s NIS regulations had just come into force. In response to Brexit’s legal legacy, the evolution of cyber threats, and growing dependence on digital services, we needed to upgrade these regulations. If the Cyber Security and Resilience Bill currently making its way through parliament passes, it will provide a strong basis for the UK to build resilience across the economy.

Here, implementation will again be crucial. Some regulators are already improving sectoral cybersecurity effectively, using their full spectrum of deep industry relationships, preparatory work, inspections, enforcement notices, and multi-million pound fines where needed. Others should be politically and financially supported to do the same.

The bill also provides an opportunity to de-tangle some regulatory mess. As companies increasingly fall under multiple regulators, we need to align these different requirements. The EU has recently attempted to address a similar problem with incident reporting. The UK could be more ambitious, regulating out internal differences in evidence requirements and specific implementation. 

We could also be bolder and look to regulate out difference across borders with our EU colleagues, as was discussed at a successful conference earlier this year. This wouldn’t just make cyber regulations more impactful. It would make them significantly cheaper – important in an economy that has struggled for growth.

A policy gap: Who you gonna call?

In a world underpinned by digital transactions, digital assets, and online interactions and where we tell companies ‘when, not if’ and ‘be ready to recover’, some level of support must be available when things go wrong.

If a private company in the UK suffers a cyberattack, they most likely cannot call a government service to help them get up and running. This lack of response and recovery services is the largest gap we have. Many government departments will be interested in what happened and how, but they won’t come in and fix things. 

The network of police-run National Cyber Resilience Centres provides a useful structure and set of services. With the right transformations in ambition, funding, airtime, and improvements in offerings and delivery, these could become the local cyber emergency centres small businesses desperately need. Supporting such a service well will be expensive, but the return on investment would be worth it. 

Some civil society organisations, such as the Cyber Helpline, are doing admirable work here, while insurance has become incredibly efficient at getting companies back up and running. Despite ample opportunities to obtain cyber insurance, including via Cyber Essentials certification, take up is low, at only 10 percent of companies. With cyberattacks costing victim companies £14.7 billion ($19.8 billion) annually, intellectual property theft perhaps as much as £8.5 billion ($11.5 billion), and broader disruption and national security costs unquantified, insurance and education need to be rolled out to a much wider base.

Response and recovery should not be limited to the world of network or computer intrusion. It should cover the full spectrum of digital threats. Fraud, online harms, and cyber incidents bleed much needed value from UK GDP, use similar methods, target the same users, and are seen as the same by victims, but are differentiated in policy. That is a somewhat artificial split that may have merits on the technicalities, but not on the impact to the citizen or business.

Parliament, public discourse, and UK positioning

Parliamentarians and the public often struggle to engage with the complex and often highly technical subject of cyber resilience. Whilst the National Cyber Security Centre provides world-class commentary, advice, and guidance, the government needs to be able to reach and influence a broader set of stakeholders than those already interested in the technical details of cybersecurity – including small business owners, middle managers, C-suite execs, and consumers paying more attention to updated National Lottery formats and summer football transfers. 

In addition to expanding public attention, policy enthusiasts should be brought deeper into the fold. While I was at DSIT, a wide range of academic research institutions, industry organisations, trade bodies, and others (including the leadership of this publication) provided our teams with valuable commentary and critique. However, being open to that input was a choice we made and a culture we developed – no-one enforces or requires that level of external engagement. Feedback should also come from further afield than those with an active interest in cyber; this is a business resilience and critical national infrastructure issue, and non-cyber communities need a bigger voice. 

We should also remember that what happens in the UK has the potential to massively impact the development of cyber policy and standards internationally, if managed well. The UK carries considerable weight in this space. As a clear area of strength and opportunity on the international stage at a time when the UK is trying to re-define its place in a rapidly changing world, the country should be investing more in this niche. Investing now – along with moving the dial on boardroom accountability, careful regulatory implementation, and emergency support – will keep the UK more secure, as well as influence the way global infrastructure is set up for the rest of the century.