Tag: Cyber Resilience Audit and Review (Consultancy)

If your organisation has treated Cyber Essentials as a box-ticking exercise, it is time to reconsider the value of this certification standard. Insurers are already pricing cyber cover against it, some cover is being attached to it for free, and claims outcomes are diverging sharply between those who hold it and those who do not. In this blog article Cyberfort security experts look at why more insurers are mandating Cyber Essentials and Cyber Essentials Plus and where organisations should start with obtaining this certification.

Why are insurers demanding Cyber Essentials?

If your organisation does not hold Cyber Essentials, you are negotiating your cyber insurance from a position of weakness, and you may not even know it. Insurers are no longer treating the certification as a peripheral nice-to-have. They are using it as a baseline signal of risk, attaching real cover to it, and drawing a harder line at the point of claim between organisations that can demonstrate basic control and those that cannot.

This is not a future risk to plan for. It is already happening, and it is happening quietly, in premium calculations and underwriting criteria that most boards never see until a renewal comes in higher than expected, or a claim is challenged. The organisations that treat cyber essentials certification as a compliance formality, rather than as a live input into how their insurer prices and pays out on risk, are the ones who will be caught out first.

This matters more now than it did even two years ago, because the UK government has itself moved decisively. NCSC and the Department for Science, Innovation and Technology (DSIT) have both restated, throughout the past 12 months that Cyber Essentials is central to the UK’s approach to raising baseline cyber resilience across the economy, and the insurance market has followed that signal.

Insurers are already pricing on Cyber Essentials

Cyber insurance underwriting has always relied on some proxy for an applicant’s control maturity, because insurers cannot audit every policyholder’s network before every renewal. For years that proxy was a lengthy self-assessment questionnaire, inconsistently completed and inconsistently trusted. Cyber Essentials gives underwriters something better, an externally verified, government-backed certification against a fixed technical standard, refreshed annually, covering the five controls that NCSC’s own data shows would have prevented the overwhelming majority of the cyber incidents it investigates. 

That is precisely the kind of signal an underwriter wants. Independently assessed, standardised, and easy to verify. Several insurers operating in the UK market now explicitly reference Cyber Essentials in their underwriting criteria for small and medium-sized businesses, and a number offer a preferential rate or a more straightforward application route to certified applicants.

For a CFO or CEO reading a renewal quote, this means a decision made in the IT function – to pursue certification or let it lapse, now shows up as a line on the insurance budget. That is a governance point as much as a technical one. Control decisions taken below board level are already having a financial consequence at board level, whether or not anyone has connected the two.

Certification comes with quantifiable cover attached

The clearest evidence that insurers treat Cyber Essentials as a genuine risk signal, rather than a marketing checkbox, is that some of them are prepared to give away cover on the strength of it. NCSC’s own guidance confirms that organisations with a turnover under £20 million that achieve Cyber Essentials certification receive free cyber liability insurance cover of up to £25,000, automatically included as part of the certification process through NCSC’s delivery partner.

That is not a discount voucher or a marketing gesture. It is underwritten cover, provided because the insurer assessing the risk has concluded that an organisation meeting the Cyber Essentials standard is a materially better risk than one that has not been assessed at all. Insurers do not give away liability cover on organisations they consider high-risk; they price those organisations out or decline them. The fact that this cover is bundled automatically into certification tells you what the insurance market actually believes about the standard’s protective value, more clearly than any marketing statement from NCSC itself could.

For smaller and mid-sized businesses, this is close to a straightforward financial argument. The certification, which typically costs a fraction of a single cyber insurance premium, can bring with it cover that would otherwise need to be purchased separately. For larger organisations above that turnover threshold, the free cover does not apply directly, but the signal to their own insurers, that basic control hygiene is independently verified, still feeds into how their much larger cyber programmes are priced.

Certification changes what happens at the point of claim

The most consequential evidence sits in claims data, not in premiums. NCSC has published figures, drawn from its delivery partner’s own insurance claims experience, showing that organisations holding Cyber Essentials made 92% fewer claims than organisations without the certification. That is a large enough gap that it cannot be dismissed as noise, and it is precisely the kind of statistic that changes underwriting behaviour, because it demonstrates the certification’s protective effect in the real-world outcome insurers care about most, whether they end up paying out.

Beyond the headline number, certification also matters procedurally at the point of a claim being assessed. Insurers increasingly ask, as part of claims handling, whether basic controls were in place at the time of an incident, the same categories of control that Cyber Essentials tests. An organisation that can point to a current certification has a documented, independently verified answer to that question. An organisation that cannot is relying on its own account of its own security posture, offered after the fact, at precisely the moment an insurer has the least reason to take that account at face value. That difference can affect not just the speed of a claim, but its outcome.

The wider context – government is not treating this as optional

None of this is happening in isolation. The UK government has been explicit that Cyber Essentials sits at the centre of its strategy for raising baseline resilience across the economy, and it has backed that position with its own procurement rules. Certain categories of government contract have required Cyber Essentials for a number of years, and the government’s own Cyber Governance Code of Practice, along with its wider Cyber Resilience agenda through 2025 and 2026, continues to push board-level accountability for exactly the control areas the certification tests.

Put simply, the same standard that insurers are using to price risk is the standard government is using to gate contracts and expects boards to own. For a business operating in regulated sectors, supplying the public sector, or answering to increasingly cyber-literate customers and investors, Cyber Essentials is converging into a single reference point that touches procurement eligibility, insurance economics, and governance expectation at the same time. Treating it as three separate, unconnected compliance tasks, one for sales, one for finance, one for the board pack, is where most of the wasted effort and missed opportunity in this space actually sits.

What this means for the board

For senior leaders, the implication is not simply to renew the certificate and move on. It is that Cyber Essentials should be reviewed as a financial and risk instrument, not purely a technical one, and that review needs to happen where finance, risk and the insurance renewal cycle actually meet, which for most organisations is a boardroom conversation, not an IT one.

Three questions are worth putting directly to your executive team and your broker at the next renewal:

1. Does your current cyber insurance policy reference Cyber Essentials, or a comparable control standard, in its pricing or its claims conditions, and have you actually asked your insurer that question rather than assumed the answer?

2. If you hold certification, are you using it actively in renewal negotiations, or letting it sit as a badge on a website while the insurer prices you as an unknown quantity?

3. If you do not hold it, what is the quantifiable cost of that gap, in premium, in cover you cannot access, and in the leverage you do not have at the point of a claim?

None of these are IT questions. They are financial governance questions with a technical control standard sitting underneath them. Answering them properly requires the same kind of scrutiny a board would apply to any other instrument that affects the cost and reliability of risk transfer. Cyber Essentials has become one of those instruments, whether or not it was designed to be.

It’s over a year since DORA’s application date, this article opens our DORA insight series. It sets out the five capabilities every financial services firm needs to demonstrate under DORA. Over the forthcoming weeks Cyberfort security and compliance experts will explore each pillar in depth giving their insights, thoughts and recommendations for security professionals who are responsible for implementing and managing this regulatory standard in their organisation.

Most financial services firms are not starting their DORA journey from a position of weakness. They already have security teams, incident response processes, supplier oversight, testing programmes and governance forums. What DORA has done is expose the gap between having these capabilities and being able to demonstrate that they work consistently, under pressure, and with board-level accountability.

That distinction matters because DORA is not a technology regulation. It is an operational resilience regulation.

Regulators are not asking whether an organisation owns the right tools. They are asking whether it can prove it understands its ICT risks, responds effectively to disruption, manages third-party dependencies, tests resilience in a meaningful way, and contributes to the wider resilience of the financial services ecosystem.

Organisations that approach DORA as a compliance exercise will almost certainly produce an
unnecessary large quantity of documentation. Organisations that get the greatest value from it will use it as an opportunity to build lasting operational resilience capabilities.

Across all the conversations with financial services firms at Cyberfort over the past year, one consistent theme emerges. Success under DORA is not determined by individual controls or isolated projects. It is determined by five interconnected organisational capabilities.

Capability 1: ICT Risk Management

Everything starts with governance. Most firms can demonstrate strong operational security controls; vulnerability management, monitoring, asset inventories, incident response plans. What is often harder to demonstrate is how ICT risk is effectively governed, owned and managed at board level.

DORA places direct responsibility on senior leadership for the management of ICT risk. That means organisations need more than technical capability. They need a documented framework that explains:

• How ICT risks are identified and assessed
• How risk appetite is defined and approved
• Who owns material risks
• How mitigation activities are tracked
• How the board receives and acts upon risk information

The key question is not “do we manage ICT risks?” It is “can we demonstrate how the organisation makes risk decisions, and prove those decisions align with documented and accepted business risk tolerances?” Without that foundation, every other DORA capability becomes significantly harder to sustain.

Capability 2: Incident Detection, Classification and Reporting

Most firms are relatively good at detecting incidents. The challenge is what happens next.

DORA’s requirements go beyond identifying suspicious activity or responding to technical events. Organisations must be able to classify incidents consistently, assess their severity accurately, determine cross-border and regulatory significance, and report major incidents against a genuinely tight clock – an initial notification within hours of classification, followed by further reports within days and weeks.

This is where many organisations discover that their existing incident processes were designed to support operational response rather than regulatory decision-making. An incident bridge call might successfully coordinate technical remediation, but can it determine severity using documented criteria, assess cross-border relevance, demonstrate why a classification decision was made, and produce an auditable record of root cause and remediation?

The difference between detection and classification is often where the greatest DORA related gap exists. Building a repeatable and defensible incident classification process is one of the most valuable investments financial services firms can make.

Capability 3: Operational Resilience Testing

Testing is not new. What DORA changes is the purpose of testing.

Traditional security testing often focuses on systems, applications or infrastructure. DORA shifts attention towards the resilience of critical and important business services. The key question becomes – can this service continue to operate during a realistic disruptive event?

Answering that requires more than vulnerability scans and penetration tests. Organisations must understand which systems support critical functions, which third parties those functions depend upon, how failures could propagate across services, and whether resilience assumptions have actually been validated under realistic scenarios.

For a sub-set of larger, designated organisations, this also means Threat-Led Penetration Testing. For every organisation in scope of DORA, it means moving beyond testing technology in isolation and towards testing business resilience as a whole. In many ways, testing is where assumptions become evidence.

Capability 4: Third-Party Risk Management

Few financial services organisations operate independently. Critical functions increasingly rely on cloud providers, managed service providers, software vendors and complex supply chains, and DORA recognises that operational resilience cannot exist if third-party dependencies remain poorly understood.

Most firms already have supplier management processes. The challenge is gaining visibility into critical supplier dependencies, concentration risk, fourth-party exposure, contractual obligations and exit readiness.

A supplier register can tell you who your providers are. A resilience-focused third-party risk programme tells you what happens if one of them fails. That distinction is becoming increasingly important as regulators place greater emphasis on systemic risk and concentration within the financial services technology ecosystem.

Capability 5: Information and Intelligence Sharing

The final capability is often the most misunderstood. Many organisations view threat intelligence as something they consume. DORA encourages organisations to view intelligence sharing as something they actively participate in – contributing to, and benefiting from, sector-wide resilience initiatives.

The rationale is straightforward. No individual financial services firm has complete visibility of the threat landscape. Attackers routinely target multiple organisations using similar techniques, dependencies and infrastructure. Sharing intelligence helps firms identify threats faster, improve detection capabilities and strengthen resilience across the sector.

The most mature organisations establish formal processes for consuming threat intelligence, feeding it into detection and testing activities, sharing appropriate indicators and insights, and maintaining audit trails of participation. The result is not simply compliance. It is a stronger collective defence capability.

Why these capabilities matter together

It is tempting to treat DORA’s pillars as separate workstreams. In reality, they are closely connected. A risk management framework informs incident classification. Incident data helps shape resilience testing. Testing identifies third-party dependencies. Third-party risks influence governance decisions. Threat intelligence improves every stage of the process.

The organisations making the greatest progress are not building five separate programmes. They are building one operational resilience capability that integrates and embeds governance, response, testing, supplier oversight and intelligence sharing into a single operating model.

Cyber incidents often make headlines because of the disruption they cause, but they also reveal how organisations operate behind the scenes. The 2025 incident at Jaguar Land Rover (JLR) did exactly that, bringing into focus how closely its operations are connected to suppliers, shared systems and the wider manufacturing ecosystem.

What stood out wasn’t just the interruption itself, but the way it exposed the dependencies that keep a modern automotive operation moving. Supply chains in this sector are highly interconnected, and even a brief pause can surface links that usually sit quietly in the background. The JLR outage made some of those connections more visible and offered a practical reminder of how quickly operational pressures can ripple outward.

Seen through that lens, the incident becomes less about the disruption and more about what it revealed. It highlighted the level of interdependence built into today’s manufacturing environments and pointed to clear opportunities for organisations to strengthen their resilience. The lessons are practical, achievable and relevant far beyond the automotive sector.

A Quick Look at What Happened

When the cyber‑attack occurred, JLR paused parts of its UK production to contain the issue, restore affected systems and verify that operations could resume safely. What initially appeared to be a short interruption extended as teams completed recovery work and confirmed that core processes were stable.

The disruption affected several areas:

• Manufacturing: some production lines paused and schedules were adjusted.
• Supply chain: suppliers of all sizes experienced delays as orders and timings shifted.
• Logistics: movements of parts and finished vehicles were rescheduled, creating knock‑on effects across transport networks.
• Retail operations: downstream activity changed as production timelines moved.

Throughout the incident, JLR prioritised system stability and close coordination with partners. Production returned gradually, with a focus on safety and continuity across the manufacturing network.

The pause also offered a clearer view of how operational dependencies surface during unexpected events. It showed:

• how quickly changes in one area can influence others
• how reliant modern manufacturing is on shared digital processes
• how important coordinated communication becomes when operations need to adjust at pace

This helps explain why the incident resonated beyond JLR itself. The effects were felt across a broad ecosystem of businesses, reinforcing the importance of understanding supply‑chain dependencies before they are tested.

Why This Was Really a Supply Chain Story

While the incident was centred on JLR, the wider context sits within the structure of automotive manufacturing. The sector relies on a broad network of suppliers, shared digital platforms and coordinated logistics processes, and any disruption naturally draws attention to how these elements interact in practice.

A few operational realities were highlighted during the pause:

• Digital systems support day-to-day operations. Modern manufacturing uses a range of digital tools for ordering, scheduling, supplier coordination and logistics. When these systems are unavailable or slowed, it can influence how physical operations run.
• Production processes are tightly timed. Automotive manufacturing typically follows structured, time-sensitive workflows. Even small changes to those workflows can create adjustments elsewhere, simply because the system is designed to move at a steady pace.
• Suppliers notice changes quickly. When production activity shifts, suppliers often feel the effects early. Larger suppliers may have more capacity to absorb changes, but smaller businesses can be more exposed to sudden fluctuations.

Taken together, the incident illustrated how interconnected the automotive sector is. When a major manufacturer experiences a disruption, the effects can be felt across organisations of varying sizes and roles. It also provided a clearer view of where resilience measures can make a meaningful difference.

What Organisations Can Learn and Apply Right Now

Incidents like this are disruptive, but they also shine a light on where organisations can improve. The lessons aren’t limited to automotive manufacturing they apply to any business that relies on suppliers, partners or digital systems.

Here are the key takeaways.

Map Your Supply Chain

Most organisations have a list of suppliers. Very few have a clear picture of:

• which suppliers rely on which systems
• how data flows between them
• where the single points of failure are
• which suppliers are genuinely critical

A clear supply-chain map doesn’t need to be complicated but it does need to be accurate. And it’s an effective way to spot risks before they become problems.

This is especially important for organisations with complex operations. Without a clear map, it’s almost impossible to understand how a disruption in one area might affect another. JLR’s experience showed how quickly a single incident can ripple across an entire ecosystem.

Set Clear Security Expectations for Suppliers

Security requirements shouldn’t be vague or buried in contracts. They should be:

• specific
• measurable
• regularly reviewed
• aligned with your own risk appetite

If suppliers are part of your attack surface, and they are, they need to be part of your security strategy.

This doesn’t mean expecting every supplier to meet the same standards as a global manufacturer. It means setting expectations that are proportionate, realistic and clearly communicated. When suppliers know what’s expected of them, they’re far more likely to meet those expectations.

Limit Supplier Access to What’s Necessary

A common weakness in supply-chain breaches is overprivileged access. Suppliers often have:

• more access than they need
• access for longer than necessary
• access that isn’t monitored

Follow the principle of least privilege:

If someone doesn’t need access today, they shouldn’t have it today.

This isn’t about mistrust; it’s about reducing the number of doors an attacker could potentially walk through. Access should be granted sparingly, monitored closely and removed promptly when no longer needed.

Build Segmentation into Your Architecture

Segmentation is an effective way to contain cyber incidents. If one system goes down, it shouldn’t take everything with it. In JLR’s case, the attack affected production systems across multiple factories a sign that segmentation could have reduced the blast radius.

Segmentation doesn’t eliminate risk, but it buys time. And in a cyber incident, time is everything.

It also helps organisations recover more quickly. When systems are segmented, it’s easier to isolate the affected areas, restore unaffected systems and bring operations back online in stages.

Test Your Response with Supplier Focused Scenarios

Most incident response exercises focus on internal failures. But real-world incidents often start elsewhere.

Useful scenarios include:

• a key supplier going offline
• a shared platform being compromised
• a supplier’s credentials being used maliciously

These exercises don’t just test your technical response, they test communication, decision-making and the ability to keep the business running under pressure. They also help identify gaps that might not be obvious during day-to-day operations.

Strengthen Communication Channels with Suppliers

During a crisis, silence creates confusion. Clear, pre-agreed communication paths help everyone respond faster and more effectively.

This includes:

• knowing who to contact
• knowing how to escalate
• knowing what information to share
• knowing how to coordinate recovery

Good communication doesn’t fix the problem, but it makes sure that the people who need to know, do know. It also helps maintain trust both internally and externally.

When suppliers know what’s happening, they can take action to protect their own systems and support your recovery efforts. When they’re left in the dark, they can’t.

Build Contingency Plans for Critical Suppliers

If a supplier goes down, what’s your plan B? Or C? Or D?

Even a basic fallback plan can keep operations moving while the primary supplier recovers. It doesn’t need to be perfect it just needs to exist.

Contingency planning isn’t about expecting the worst. It’s about being prepared for the unexpected. And as JLR’s experience showed, the unexpected can happen quickly.

A More Constructive Way to Look at It

The JLR incident was a reminder that even well-established organisations can face unexpected disruption and that the strength of the response often depends on the preparation done long before anything goes wrong. Cyber incidents will always create challenges, but they also highlight where processes, relationships and systems can be strengthened.

For many organisations, the lesson is clear: resilience isn’t built in the moment of crisis. It comes from having tested response plans, clear communication routes and a realistic understanding of how suppliers, partners and digital systems fit together. The organisations that invest time in this preparation tend to recover more quickly, maintain trust more effectively and minimise the wider impact on their operations.

The JLR case showed how interconnected modern supply chains are and how important it is to be ready for disruption, wherever it originates. Treating supply-chain resilience as a core part of cyber security isn’t just good practice, it’s a practical step towards ensuring that when something unexpected happens, the organisation can respond with confidence rather than scramble to react.

Preparation doesn’t remove risk, but it does shape the outcome. And in a landscape where incidents are increasingly common, that preparation is what allows organisations to absorb the shock, protect their reputation and return to normal operations with far less disruption.

For more information about Cyberfort Supply Chain Security services contact us at [email protected]  and one of our experts will be in touch.

Glen Williams, CEO of Cyberfort Group discusses why UK boards must lead with resilience, beyond compliance, to prevent costly breaches.

---

Infrastructure-level attacks

Despite growing investment in cybersecurity, many UK businesses remain critically exposed to infrastructure-level attacks.

They are under siege; from state actors, criminal groups and opportunistic attackers exploiting any weakness.

Too many are operating under a concerning illusion of safety, believing being compliant means being secure.

But compliance is not resilience and ticking regulatory boxes is no defence strategy.

The biggest vulnerability is not always a firewall or an unpatched system.

Increasingly, it lies at the top. This is the boardroom blind spot – a disconnect between the perceived and actual state of cybersecurity in UK organisations.

Many underestimate the scale, sophistication and speed of cyber-threats.

The result? A slow drift toward crisis – costing money, reputations, operations and in some cases, the very survival of the business.

Leaders must ask the hard questions: If we were breached tomorrow, could we still operate? How fast could we recover – and at what cost?

From airports to automakers: The threat is escalating

Recent attacks on Jaguar Land Rover, major UK airport ransomware incidents and other critical infrastructure show no sector is immune.

Attackers are more organised, more aggressive and increasingly focused on large-scale disruption.

These breaches often succeed not because defences are absent, but because they are insufficient.  

Many businesses still assume cybersecurity is ‘being handled’ by internal IT or third-party providers – often generalists, not specialists.

But when facing organised crime groups or state-sponsored actors, general IT skills fall short.

The analogy holds: No one would trust a nurse to perform brain surgery – so why expect an IT generalist to protect the core of a business against elite cyber-threats?

The numbers speak for themselves. Of the 2.7 million registered UK businesses, only around 51,000 meet Cyber Essentials standards.

So basic cyber-hygiene is still being overlooked. With critical infrastructure now a prime target, the stakes are rising fast. Cybersecurity must be led from the top, by boards.

Why compliance does not equal resilience

Regulatory compliance frameworks such as ISO 27001, GDPR, the upcoming UK Cyber Resilience Act and Cyber Essentials serve a valuable purpose.

They set minimum standards and enforce accountability, but structure alone is not protection.

Compliance does not mean a business can detect, respond to or recover from an attack.

In fact, many companies seriously breached in recent years were fully compliant – on paper – but not operationally ready.

It is entirely possible to pass an audit and still be breached the very next day.

Worse, compliance is often used as a proxy for resilience – but it is often a lagging indicator of risk.

True resilience means having expert-led, scenario-tested, continuously evaluated strategies that are regularly refined and adapted to new threats.

Anything less leaves businesses dangerously exposed.

What real cyber-resilience looks like

Cyber-resilience is not a product you buy nor a policy you publish.

It is the organisation’s ability to absorb shocks and continue operating with minimal disruption – even when under attack.

Resilience starts at the board-level. This includes recognising cybersecurity as a core business risk as well as bringing in trusted partners, such as NCSC-assured consultancies who can help prepare organisations before, during and after an attack.

Resilient businesses invest in more than software; they invest in strategy.

They rehearse their response so that when a breach inevitably happens, teams avoid losing time or capability. 

Access to experts like virtual Chief Information Security Officers (CISOs) or specialist placements support stronger governance.

Resilience also means going beyond annual assessments to include regular threat modelling, red teaming and incident response drills.

Preparedness must extend across the entire organisation: Leadership, technical teams and non-technical staff alike.

At Cyberfort, resilience is defined not by how quickly companies recover, but by how little it loses in the process – whether that is trust, uptime, data integrity, capital or brand reputation.

Accountability cannot be outsourced

Cyber-risk is business risk – it impacts revenue, reputation, regulatory standing and long-term viability.

Yet this reality is recurringly not landing where it needs to: In the boardroom.

Too often, cybersecurity is viewed as technical – something IT should manage.

This mindset leads to underinvestment, poor response protocols and strategic blind spots in decision-making when it matters most.

Boards are responsible for resilience. Delegating without oversight or mistaking compliance for readiness, is a dereliction of that duty.

Leaders must ask the right questions, challenge assumptions and ensure cybersecurity is embedded in strategic planning.

When cyber is ignored at the top, the entire organisation is left vulnerable.

To close the boardroom blind spot, leaders must first make cybersecurity a standing board agenda item – not as an operational update, but a strategic risk discussion and treated with the same urgency as financial performance or operational risks.

Cybersecurity breaches can impact the balance sheet just as swiftly and severely as a major market event.

Second, boards must invest in education for directors.

While directors do not need to be technical experts, they must understand the business implications associated with cyber-threats.

Finally, success metrics must shift. Instead of measuring success by the absence of incidents, organisations should focus on the speed and effectiveness of detection, containment and recovery efforts.

Don’t wait for the crisis

The time of treating cybersecurity as an IT issue has long passed.

Cyber-risk now permeates every strategic decision – from M&A to supply chains.

The price of inaction is not theoretical – it is real and growing – just ask the companies that did not survive.

The fallout of recent breaches includes broken shareholder value, customer trust and long-term reputational damage that no insurance policy can undo.

Far too many businesses rely on generalist defences in a specialist threat environment.

Boards can no longer afford to sit on the side-lines.

Cybersecurity must be embedded into every strategic decision, not siloed as a compliance exercise.

The question is no longer if a breach will occur, but how well the organisation will be prepared to respond when it does.

Those who wait for the crisis to act will already be too late.