When the UK Defence Secretary starts asking whether you’d cope if your local shop was hit by a cyber attack and your card stopped working at the till, it’s worth paying attention.
Wes Streeting’s warning this week, that households and businesses should prepare for cyber attacks, extreme weather and disruption from hostile states, will have struck some people as alarmist. I’d call it a sensible reminder.
None of these risks are new. What should concern every board is how often they now arrive at once, and how little warning they give. Wildfires this summer, flooding expected this winter and a critical flaw in a programming language that powers much of the internet have all landed in the same few months; that flaw alone took 32 UK government services offline. Streeting also pointed out that AI is giving attackers new ways to push against conventional defences, which should focus a few minds. Last month, the National Audit Office (NAO) warned that the UK’s food supply chain is exposed to disease outbreaks, cyber attacks and extreme weather, and that not enough has been done to strengthen it.
So here’s the uncomfortable question: if one of your critical suppliers went dark tomorrow, would you know within the hour? Would you know who their suppliers are? And if you are confident you would, could you show me the evidence?
That gap, between believing you’re resilient and being able to demonstrate it, is exactly where businesses get hurt. A continuity plan sitting in a shared drive, last opened during the pandemic, is a comfort blanket. Supplier questionnaires that ask whether a cyber security policy exists, and accept “yes” as proof, tell you very little about what happens when something actually breaks.
At LRQA, we spend our days helping organisations find out whether their systems work when it really counts, across cyber security, food safety, responsible sourcing and business continuity. The lesson is the same every time. Resilience is built long before the crisis hits, through real visibility of who you depend on and controls that have been tested by someone with no reason to flatter you.
Much of the coverage has focused on households, with the "Be Ready" campaign asking people to keep three days of supplies at home. That’s reasonable, but a household can only prepare so far. Whether the shelves are stocked and the card works at the till depends on the businesses that sit between government policy and people’s daily lives. The government says it wants UK supply chains to keep running even in times of crisis; that ambition will be met or missed by businesses, so it’s on us.
Streeting's message is to be alert but not alarmed. Fair enough. For business leaders, I’d add one more word: accountable. Your customers, and the communities that rely on what you produce, are trusting that you’ve thought about this properly. The next disruption is coming; the question is whether you’ll be ready for it, and whether you can prove it.