Summary
- The UK’s wider National Cyber Action Plan has reportedly been delayed amid political instability.
- A voluntary Cyber Resilience Pledge for major companies is still expected to proceed.
- UK cyber policy is moving through partial measures while statutory resilience reform remains on a longer track.
The UK’s wider National Cyber Action Plan has reportedly been delayed, creating a gap between government ambition on cyber resilience and the formal publication of a strategy intended to address state-backed and criminal threats to the broader economy.
The delay has been reported while one part of the package, the government’s Cyber Resilience Pledge for major companies, is still expected to proceed. The pledge is aimed at large businesses, including FTSE 350 companies, and asks signatories to make cyber a board responsibility, use NCSC training, join early warning services, and encourage action through their supply chains.
The delay has not been confirmed through a government notice. It has been reported as linked to political disruption following the resignation of Prime Minister Keir Starmer and the start of a Labour leadership contest. A government spokesperson told Recorded Future News that ministers remain committed to publishing the plan, but the revised timetable and final content are not clear.
The wider national plan sits alongside several other UK cyber policy strands. The Government Cyber Action Plan, published earlier in 2026, focuses on public-sector cyber resilience, central government accountability, government suppliers, risk visibility, response and recovery, and skills. The separate Cyber Security and Resilience Bill is moving through Parliament and is expected to expand duties around essential and digital services.
Taken together, those measures show the direction of UK policy. Public-sector cyber reform is already documented. Statutory resilience reform is moving through Parliament. The FTSE 350 pledge is designed to draw major companies into voluntary board-level action. The delayed plan would connect more of the wider economy to that agenda, particularly where large businesses, suppliers, and critical services intersect.
The larger challenge is sequencing. Cyber resilience policy is becoming a mix of statutory duties, voluntary pledges, regulator expectations, procurement pressure, public-sector controls, and sector-specific guidance. Companies can respond to each instrument individually, but the strategic value comes from clarity over how they fit together: who is accountable, which sectors are in scope, what evidence will be expected, and how supply chain obligations will be assessed.
The voluntary pledge has practical value because it targets board ownership and repeatable action. Director training, early warning services, and supplier engagement can raise the floor among large companies. They also show the limits of voluntary measures. A pledge can create reputational pressure, but it cannot define regulator enforcement, minimum assurance standards, or obligations several layers down from a FTSE buyer.
The delay also lands against an established threat environment. The NCSC has repeatedly warned that critical systems and public services face pressure from state-linked and criminal actors. Ransomware, edge-device exploitation, supplier compromise, and identity attacks have shifted cyber risk from IT operations into continuity, customer service, and national resilience.
The government does not need another strategy document for its own sake. It needs a plan that gives boards, operators, regulators, and suppliers a common model for action. Until the wider national plan appears, UK cyber policy will continue to move through separate announcements: a bill, a pledge, a public-sector control programme, and sector guidance.
Organisations already investing seriously in resilience can work across those strands. Those waiting for a clearer statutory or regulatory line before changing budgets, assurance models, or supplier contracts will have less certainty to work from.
