By Chris Newton-Smith
Cyber resilience is receiving increased board-level attention. In the UK this is partly the result of initiatives such as the Government’s Cyber Resilience Pledge, which was formally launched on July 7th, 2026. It marks an important shift in the way organizations are encouraged to recognise and prioritise risk, reinforcing that this must be a whole-of-business endeavour rather than something confined to the IT department.
The Pledge reinforces that cyber resilience is not just about enforcing stronger controls. More broadly, organizations should integrate governance across silos.
What the pledge means for businesses
The Cyber Resilience Pledge sounds deceptively simple. In fact, it is ambitious in scope. Organizations signing the voluntary pledge commit to three concrete actions. Registering for the National Cyber Security Centre’s free Early Warning service is perhaps the most straightforward. It is a tool designed to alert organizations to potentially suspicious activity on their networks.
Signatories must also implement the Government’s Cyber Governance Code of Practice and ensure that all board members complete the NCSC’s Cyber Governance Training. These steps will help cement boardroom oversight of cyber risk as a core business risk and empower board members to strengthen their organization’s ability to prepare for, respond to, and recover from cyber incidents.
The final action is to audit Cyber Essentials coverage across the supply chain and take a risk-based approach to requiring Cyber Essentials certification. That will require more effort, but it is critically important given the risks associated with third-party incidents. Government data shows that just 15% of UK businesses formally review the risks posed by their immediate suppliers, falling to 6% for the wider supply chain.
A new era of complex, interconnected risk
The Pledge is voluntary, but it signals something important. It is an acknowledgement that organizations face heightened cyber risk. The Government’s Cyber Security Breaches Survey 2025/2026 found that around two-thirds of medium (65%) and large (69%) businesses experienced a cyber breach or attack in the previous 12 months.
The Government wrote in an April open letter to business leaders that AI is capable of ‘finding weaknesses in software, writing the code to exploit them, and doing so at a speed and scale that would have been impossible even a year ago’.
Network defenders are already under significant pressure managing risk across a fast-expanding attack surface. AI is helping adversaries to scale attacks, but AI systems also represent attractive targets in their own right. Just over a quarter (26%) of respondents to IO’s State of Information Security Report 2025 reported that their businesses had experienced a data poisoning incident in the previous 12 months. Defenders’ task is made harder by the complex, interconnected nature of distributed IT systems that may span cloud containers and laptops used for remote work.
Complexity can weaken cyber security by creating gaps in visibility and coverage that threat actors can exploit. It can also make compliance more challenging. Regulatory frameworks such as NIS2, DORA, and the EU AI Act do not map perfectly onto organizational structures. Their requirements tend to overlap, creating more work for understaffed governance, risk, and compliance (GRC) teams.
The Pledge recognises that cyber resilience requires action beyond the IT department. More broadly, the risks that threaten organizations rarely exist in isolation. A ransomware attack can result in a data protection incident. An AI governance failure can result in reputational damage and regulatory scrutiny. An outage affecting a third-party supplier can be just as disruptive to operations as an internal breach.
While each cause may be different, the effects are often the same: financial damage, reputational damage, and increased regulatory scrutiny.
Building a resilience loop
Fragmented governance across information security, data protection, and AI governance creates visibility gaps, duplicates effort, and increases breach risk. It overburdens teams and adds operational cost. It also fails to acknowledge that today’s corporate risk surface is interconnected. The time for managing risk through static, point-in-time programmes is over.
Organizations need an integrated, continuous approach to GRC across information security, data protection, and AI governance. At IO we call this proposed model a ‘resilience loop’: a single operational model that brings ISO/IEC 27001 for information security management, ISO/IEC 27701 for privacy information management, and ISO/IEC 42001 for AI management into one interlocking system in which each domain informs the others.
These management system standards have a harmonised structure that supports integrated implementation. Shared activities can be managed once and applied across all three where requirements overlap. This can reduce operational costs, improve risk oversight, and enhance regulatory readiness.
Risk changes continuously; resilience must be maintained
The resilience loop approach also means treating compliance as an ongoing process of improvement, refinement, and resilience building rather than as a point-in-time snapshot of posture that can quickly become outdated. These ISO management system standards explicitly require continual improvement.
Threats are evolving rapidly. Organizations are continuously adding new capabilities to their IT systems. Supply chains and regulations are in a constant state of flux. Periodic, box-ticking compliance programmes cannot be relied on to keep organizations secure when they face dynamic risk and rapid technological innovation. They may focus on formal requirements at a point in time without building sustained cyber resilience.
The resilience loop can help address that. It can reduce the pre-audit scramble for evidence because the work is performed every day, embedded in operations, visible to leadership, and kept current. It can also help organizations absorb new requirements into the existing structure rather than treat each requirement as a crisis.
It is a model for continuous compliance that lets automation do much of the heavy lifting while keeping people in control of the decisions that matter. It supports an organization that is better prepared for change and can transform GRC into a means of building trust, resilience, and growth.
The author
Chris Newton-Smith is CEO of IO.
