Introduction
The UK’s proposed Cyber Security and Resilience Bill signals a welcome push to enhance national cybersecurity, especially across critical infrastructure sectors. But while tighter incident reporting is necessary, it’s not enough.
The government must mandate Cyber Essentials certification for at-risk industries and roll out a nationwide awareness campaign. With only 31,000 Cyber Essentials-certified businesses out of over 5 million in the UK, the current state of cyber readiness is alarming—especially in high-risk sectors such as finance, insurance, and legal services.
The Shocking Cyber Essentials Gap in the UK
Despite being government-backed, the Cyber Essentials scheme has seen low adoption across UK businesses. As of 2024:
-
Only ~31,000 UK companies are Cyber Essentials certified
-
Over 5 million UK businesses are operating without this baseline protection
That means fewer than 1% of UK businesses have implemented the most basic, essential cybersecurity controls.
This massive gap leaves millions of organisations vulnerable to ransomware, phishing, data breaches, and supply chain attacks—many of which could be prevented through basic best practices.
Why Cyber Essentials Certification Must Be Mandatory
Cyber Essentials helps organisations defend against common cyber threats by ensuring five core controls are in place:
-
Firewall and Internet gateway protection
-
Secure system configurations
-
Access control
-
Malware protection
-
Timely software updates and patch management
Making this certification mandatory for high-risk sectors would:
-
Improve baseline security across industries
-
Reduce cyber insurance claims and payouts
-
Lower business downtime and financial loss from cyber incidents
-
Align UK business practices with NIS2 and global compliance standards
High-Risk Sectors That Need Cyber Essentials Now
Certain sectors handle vast amounts of sensitive, high-value data and are prime targets for cybercriminals. These industries must be prioritised for mandatory certification:
-
Legal firms: Manage confidential contracts, litigation, and IP data
-
Financial services: Hold sensitive banking and investment information
-
Insurance companies: Store claims data, personal records, and corporate disclosures
A successful attack on any of these could impact hundreds of clients and millions of pounds—not to mention reputational harm and regulatory consequences.
The Missing Piece: A National Cyber Awareness Campaign
Awareness remains a major hurdle. Many SMEs and even mid-sized firms aren’t aware of Cyber Essentials or how it can reduce risk and insurance premiums.
The UK government must launch a national awareness campaign to:
-
Educate businesses on the importance and benefits of certification
-
Promote Cyber Essentials as a business differentiator and trust signal
-
Provide financial incentives or guidance for SMEs
-
Emphasise how certification supports cyber insurance requirements
Monthly Cyber Compliance Should Be the Standard
In addition to certification, businesses should be encouraged—or required—to maintain monthly cybersecurity compliance. This ensures that:
-
Systems stay protected against emerging threats
-
Security patches and updates are applied consistently
-
Compliance with cyber insurance policies is ongoing and verifiable
Proactive monthly compliance helps prevent breaches and improves cyber resilience over time.
Final Thoughts: Prevention Must Come Before Protection
The Cyber Security and Resilience Bill is a significant milestone, but incident reporting alone doesn’t protect data. The government must act now to:
-
Mandate Cyber Essentials for high-risk and regulated sectors
-
Launch a nationwide Cyber Essentials awareness campaign
-
Promote ongoing monthly cyber compliance
With threats growing and digital data volumes rising, Cyber Essentials should no longer be optional—it should be the minimum standard for doing business in the UK.
