Big firms urge SMEs to do more on cyber security

A multisector KPMG survey of procurement managers across the UK from organisations with over 250 employees reveals that the general consensus among procurement managers is that SMEs should be doing more to prevent cyber attacks and protect client data. The vast majority of respondents said they would consider removing an SME supplier if they were hacked and nearly all of the respondents confirmed that cyber security standards are important when awarding contracts to SME suppliers.

George Quigley, Partner in KPMG’s cyber security practice, commented: “Cyber security is not just a technical issue anymore; it has become a business critical issue for the UK’s SMEs. Larger companies are placing an increased emphasis on the cyber security of their suppliers and increasingly the onus is on SMEs to show that they are tackling this issue head on. “Unfortunately many SME don’t see themselves as targets of cyber criminals. Unless these organisations take a more mature approach towards cyber security now, they face the risk of being frozen out of lucrative supplier contracts.”

Already two-thirds of procurement managers ask their suppliers to demonstrate cyber accreditations, such as ISO27001, Cyber Essentials, IASME certifications or PCI DDS, as a part of their procurement assessment, with this number likely to increase in the near future. In addition, SMEs are increasingly being asked to self-fund their own accreditations. In the absence of accreditation, 41 per cent of procurement managers expect their suppliers to pay for their own accreditations and reach a certain level of cyber maturity in the near future.

Quigley concluded: “In order for businesses to be awarded some public sector contracts they already have to demonstrate a certain level of cyber maturity and this is increasingly becoming the norm in the private sector as well. Companies are also embedding cyber security in their supplier contracts with about half of existing contracts already stating that suppliers are contractually obliged to tell if they have been hacked. This means that if a SME supplier is breached and doesn’t deal with it appropriately, they could be looking at the termination of an existing supplier contract.

“The government is looking to increase the cyber maturity of UK businesses, with accreditations like the Cyber Essentials Scheme. We can only expect the bar to be raised higher in the coming years. There is no time like the present for SMEs to start taking the initial steps towards increasing their level of cyber maturity.”