Why You Have To Seriously Consider Cyber Essentials To Be Part Of The Supply Chain

In a recent survey carried out by KPMG, the overriding message was that if you are an SME you need to take cyber security seriously or risk being completely frozen out of the procurement process.

If you are lucky enough to already be a supplier, then if you are hacked or have a breach you have a significant chance of being sacked.

Small and Medium Sized Enterprises (SMEs) risk being disqualified from bidding for work because of the lack of importance they place on looking after their valuable client data, according to a survey of procurement managers by KPMG.

A multisector KPMG survey of 175 procurement managers across the UK from organisations with over 250 employees revealed that the general consensus (70%) of procurement managers is that SMEs should be doing more to prevent cyber attacks and protect valuable client data.

The vast majority (86%) of respondents said they would consider removing an SME supplier if they were hacked and nearly all of the respondents (94%) confirmed that cyber security standards are important when awarding contracts to SME suppliers.

George Quigley, Partner in KPMG’s cyber security practice, commented: “Cyber security is not just a technical issue anymore; it has become a business-critical issue for the UK’s SMEs. Larger companies are placing an increased emphasis on the cyber security of their suppliers and increasingly the onus is on SMEs to show that they are tackling this issue head on.

Unfortunately, many SMEs still take a blasé approach towards cyber security and mistakenly don’t see themselves as targets of cyber criminals. Unless these organisations take a more mature approach towards cyber security now, they face the risk of being frozen out of lucrative supplier contracts.”

Already, two-thirds of procurement managers ask their suppliers to demonstrate cyber accreditations (ISO27001, Cyber Essentials, IASME certifications or PCI DDS) as a part of their procurement assessment, with this number likely to increase in the near future. In addition, SMEs are increasingly being asked to self-fund their own accreditations. In the absence of accreditation, two-fifths (41%) of procurement managers expect their suppliers to pay for their own accreditations and reach a certain level of cyber maturity in the near future.

George Quigley concluded: “In order for businesses to be awarded some public sector contracts they already have to demonstrate a certain level of cyber maturity and this is increasingly becoming the norm in the private sector as well. Companies are also imbedding cyber security in their supplier contracts with about half (47%) of existing contracts already stating that suppliers are contractually obliged to tell if they have been hacked. This means that if an SME supplier is breached and doesn’t deal with it appropriately, they could be looking at the termination of an existing supplier contract.

The government is looking to increase the cyber maturity of UK businesses, with accreditations like the Cyber Essentials Scheme. We can only expect the bar to be raised higher in the coming years. There is no time like the present for SMEs to start taking the initial steps towards increasing their level of cyber maturity.”