Cyber Resilience Pledge

The Cyber Resilience Pledge is a voluntary commitment scheme announced by the UK Department for Science, Innovation and Technology (DSIT) in May 2026, with a formal launch planned for summer 2026. Signatories commit to three obligations: appointing a designated board-level lead for cyber security; enrolling in the NCSC's free Early Warning service; and attaining Cyber Essentials certification across their supply chains. Participating organisations will be published on GOV.UK. The Pledge sits alongside a £90 million DSIT funding package targeting NHS suppliers and SMEs to raise baseline cyber resilience across the UK economy.

The Pledge responds to a consistent finding in UK cyber incident data: breaches frequently enter via supplier and third-party relationships rather than directly targeting the primary victim. By requiring Cyber Essentials certification across supply chains rather than just at the signatory, DSIT is pushing accountability down vendor tiers. The NCSC Early Warning service provides free alerting on IP addresses and domain names that appear in threat intelligence feeds, giving participating organisations visibility they would not otherwise have without a dedicated security operations capability.

For the UK cyber sector — which reported £14.7 billion in annual revenue across 2,603 companies employing 69,600 people in DSIT's May 2026 figures — the Pledge represents a soft-regulation approach that avoids imposing NIS2-style mandatory obligations while creating public reputational incentives for adoption. Its effectiveness depends on the breadth of take-up among supply-chain participants; the summer 2026 launch will test whether the voluntary model achieves meaningful coverage.