The Cyber Resilience Pledge is a new voluntary government commitment to strengthen cyber resilience across the economy. Signatories commit to three practical actions:
- Make cyber security a board-level responsibility, using the Cyber Governance Code of Practice and NCSC training.
- Sign up to the NCSC Early Warning service.
- Take a risk-based approach to securing supply chains, including requiring Cyber Essentials where appropriate.
While the Pledge is aimed primarily at medium and large organisations, including FTSE 350 companies, it is open to organisations of all sizes and sectors. Early signatories include M&S, Nationwide, ITV, Microsoft UK and Cloudflare.
Building on its three commitments, the Cyber Resilience Pledge sets an expectation for cyber security leadership: organisations should move beyond one-off assurance exercises and towards repeatable, board-owned practices that strengthen resilience not only within their own organisation, but across their supply chains too.
The supply-chain problem
Many organisations have made progress with their own internal cyber hygiene, including patching regimes, multi-factor authentication, endpoint protection, secure configurations and backups. Yet cyber risk does not stop at the perimeter.
Modern organisations depend on a network of suppliers and partners. These may include IT providers, managed service providers, cloud platforms, specialist consultancies, payroll and HR systems, marketing and analytics tools, facilities and operational technology suppliers, and countless niche software vendors. Each relationship can introduce potential exposure through access to systems, sensitive data or critical service dependencies.
Even when your own controls are strong, threat actors may look for the weakest link. This could be a supplier with a similar level of access but fewer resources, less mature governance or more inconsistent technical controls.
According to the Cyber Security Breaches Survey 2025/26, relatively few organisations formally review cyber risks in their supply chains: 15% of businesses assess the risks posed by their immediate suppliers, and only 6% look beyond to the wider supply chain.
Why supplier assurance is hard
Organisations have long tried to manage supplier risk with questionnaires and bespoke assessments. In principle, this makes sense: you want assurance that is tailored to the service being provided.
In practice, this approach can break down because of:
- Questionnaire overload: Large organisations sometimes push enterprise-grade requirements onto small suppliers. Suppliers that serve multiple large customers can end up completing near-identical questionnaires repeatedly, consuming time that could be spent improving security.
- Inconsistent expectations: Different customers ask for different information in different formats. The result is fragmented assurance with limited comparability.
- Low signal-to-noise: Long questionnaires do not always verify that fundamental technical controls are actually in place.
- A bottleneck to business: Excessive or unclear requirements can slow onboarding and contract renewal, creating friction between security, procurement and commercial teams.
The outcome is familiar to many organisations: lots of documentation, but not always enough confidence.
Cyber Essentials is a baseline that’s robust, recognised and achievable
Cyber Essentials is the UK Government-backed, annually renewable baseline cyber security certification. It was designed to help organisations of all sizes implement a core set of technical controls that reduce exposure to common, internet-based attacks.
There are two levels:
- Cyber Essentials – an independently verified assessment based on a self-assessment questionnaire signed off at board level.
- Cyber Essentials Plus – the same controls, with the addition of an external technical audit to verify implementation.
For supply-chain assurance, Cyber Essentials has a key advantage: it provides a standardised, repeatable minimum expectation that can be applied consistently across suppliers, without the overhead and subjectivity of bespoke checks for every relationship.
It is also widely recognised. Cyber Essentials is frequently requested in procurement, funding and grant applications, and in many government contract contexts. In other words, it is increasingly becoming part of the language of assurance in the UK market.
One of the UK’s largest pensions and life companies, St. James’s Place, mandated Cyber Essentials Plus certification for more than 2,800 independent businesses in its network. Overnight, it saw an 80% reduction in cyber security incidents.
The power of Cyber Essentials through the supply chain
The supply-chain commitment in the Cyber Resilience Pledge is intentionally risk-based. That matters because supply chains are not uniform: a supplier that remotely administers your IT environment is not the same as a low-touch supplier with no system access and minimal data handling.
Used well, Cyber Essentials becomes a practical tool that scales because it can:
- Raise the minimum standard consistently: Suppliers have a clear baseline they can demonstrate through certification.
- Reduce friction in due diligence: A recognised, repeatable minimum expectation can streamline assurance for lower- and medium-risk suppliers, while leaving room for deeper checks where the level of risk justifies them.
- Support SMEs rather than overwhelm them: Suppliers can work towards achievable requirements and use a shared reference point, rather than completing a different questionnaire for every customer.
- Build confidence across complex, global supplier networks: A baseline can be applied consistently even when suppliers operate internationally.
For organisations looking to implement a proportionate approach, the NCSC’s Cyber Essentials supply chain playbook will support you to embed Cyber Essentials in your supply chain. This practical guide sets out a step-by-step approach: assess supply-chain risks, profile suppliers, set minimum security requirements, communicate expectations, incentivise adoption, embed requirements into procurement and contracts, and monitor ongoing adoption.
What this means for organisations that supply services
If your organisation supplies services to larger customers, government or other organisations with formal cyber assurance requirements, Cyber Essentials may feature more often in procurement and assurance conversations.
There are three practical actions you can take:
- Prepare your narrative: Be ready to explain how you meet baseline technical controls, how you manage vulnerabilities and what your incident response looks like.
- Plan certification proactively: Treat Cyber Essentials as a business-readiness activity, rather than waiting for a customer to make it a contractual requirement.
- Use certification as evidence: A current Cyber Essentials or Cyber Essentials Plus certificate can reduce friction, speed up bids and simplify repeated assurance requests.
Certification can also help suppliers demonstrate a consistent level of cyber security to a wide range of customers, rather than responding to every assurance request from scratch.
For buying organisations: verifying Cyber Essentials across your supplier base
If you’re a customer organisation embedding Cyber Essentials into supplier expectations, you’ll also need a straightforward way to verify certification status over time – not just at onboarding.
IASME provides tools to help organisations verify Cyber Essentials and Cyber Essentials Plus certifications:
- Cyber Essentials Certificate Search: Check the status of individual suppliers.
- Supplier Assurance Tool: For organisations with large supplier lists, enabling bulk checks to identify which suppliers hold current certifications.
These tools can reduce manual effort and help you maintain a clearer picture of baseline assurance across your supplier ecosystem. Regular checks are important because Cyber Essentials certification is renewed annually, and supplier assurance needs to reflect current rather than historic certification status.
How IASME can help
IASME delivers the Cyber Essentials scheme on behalf of the National Cyber Security Centre (NCSC). We support organisations adopting Cyber Essentials – both those seeking certification themselves and those implementing Cyber Essentials requirements across their supply chains.
Support can include practical help with:
- Supplier communications: For example, drafting and tailoring supplier letters and email templates to explain what is changing, why it matters, the compliance timeline and where suppliers can get help.
- Helping suppliers understand Cyber Essentials and the route to certification: This can include supplier webinars or Q&A sessions, as well as signposting to free resources such as the Cyber Essentials Readiness Tool and the Cyber Essentials question set.
- Access to NCSC-assured Cyber Advisor support: This includes a free 30-minute consultation for SMEs.
- Programme coordination: For larger programmes, organisations may also want a dedicated point of contact or account management to coordinate supplier queries and communications.
Whether you are introducing Cyber Essentials as a supplier requirement or responding to new customer expectations, a pragmatic, risk-based approach can help improve cyber resilience without creating unnecessary barriers for suppliers.
Find out more
- Cyber Resilience Pledge
- NCSC Cyber Essentials supply-chain playbook
- Cyber Essentials Certificate Search
- Supplier Assurance Tool
Talk to IASME about supply-chain adoption of Cyber Essentials: [email protected]