CYBER RESILIENCE HOW TO PROTECT SMALL FIRMS IN THE DIGITAL ECONOMY

Cyber Resilience: How to protect small firms in the digital economy
That combined effort will need to deliver, a number of significant long-term changes in the behaviour
and practices of individuals, businesses and the Government. 76 Currently, technology is running
ahead of the ability to adapt to the changes it is driving in personal and in particular economic activity.
Practices in business and elsewhere remain largely 20th century and still best suited to the industrial
age. They have not caught up with the digital economy.
Change however, needs to involve more than just ‘catching-up’ with current technology. It also needs
to incorporate enough flexibility to enable further adaptation as the technologies now in use evolve
or new ones emerge. Only by building in such flexibility can the UK economy become truly resilient
in the very long-term.
UK Government progress to date
There is no doubt that the Government leads internationally on the cyber security agenda. From a
standing start successive Governments have moved the UK forward significantly in the last decade
in areas such as:
• The Government understands that an inclusive or shared approach is needed, which encourages
all areas of society to invest in the objective of a more resilient economy. The Government has
already made great strides towards this, for example, by working collaboratively with business
to improve the cyber resilience of UK business.
• The UK Cyber Security Strategy in 2011 has helped focus and bring coherence to the cyber
resilience policy agenda. The expected new five year strategy must be an ambitious one. It
must not shy away from tough choices and outline, where appropriate, radical plans for further
institutional reform and behaviour change.
• The Government has instigated some positive institutional reforms to ensure delivery of the
current Cyber Security Strategy. This has included the creation of the Office of Cyber Security to
co-ordinate cross-government activity on cyber resilience as part of a wider co-ordinated effort
to improve resilience more generally.
• The Chancellor made a very encouraging speech in late 2015 laying out new policy ideas for
improving the cyber resilience of the economy, including the creation of a one stop shop for
cyber resilience information and advice for businesses. 77
The National Cyber Security Centre (NCSC) is potentially a very positive step forward. As a single
point of contact will allow small businesses to access the best information from a single trusted
source.
Together, these measures provide the foundations for the next phase of reform to improve the UK’s
cyber resilience.
Next steps
While much of what the Government is doing is ambitious, there is still further to go to build a truly
resilient small business sector and wider economy.
Small businesses should make a fair and sustained contribution to the overall cyber
resilience of the UK economy but policy makers need to understand the constraints that
exist for small businesses. Government policy needs to take a balanced approach by sharing
the resilience burden proportionately among those best able to bear it.
Further improvements in the levels of cyber resilience among small businesses, commercial supplychains
and digital communications networks can only be achieved if a number of vital pre-requisites
are put in place:
76 Business will have to embed principle of resilience into its strategic planning and everyday activities as much as possible. The ‘resilience cycle’ has three
elements: pre-disruption (sense and resist), disruption (react) and post-disruption (Adapt and re-shape). As EY state in their 2014 report on cyber-resilience:
‘Organizations need to establish an understanding of the ‘resilience cycle’ helping…continuously build upon the experience of responding to threats’. Source: EY,
Achieving resilience in the cyber eco-system, 2014.
77 Osborne, G, Chancellor’s speech to GCHQ on cyber security, 2015.
30