Cyber Resilience Pledge signatories
The Government publishes the official list on GOV.UK. On 2 November 2026 that page stated 235 signatories, including M&S, Tesco, Microsoft UK and BT. The Pledge is voluntary and separate from the Cyber Security and Resilience Bill (CSRB), so signing it does not show compliance with the Bill.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
Where to find the official list
The Government publishes the list on GOV.UK: Cyber Resilience Pledge signatories. When we checked on 2 November 2026, the page said it was last updated on 29 October 2026 and stated a total of 235 signatories.
Always use that page for a current answer. It changes as organisations sign, and this guide is only a snapshot.
The Pledge is a voluntary government initiative. It is not part of the Cyber Security and Resilience Bill (CSRB), and signing it does not show compliance with the Bill.
Some of the organisations listed
All of these names appear on the official list. This is a selection to show the range, not the full list.
| Area | Examples |
|---|---|
| Retail and food | M&S, Tesco, Sainsbury's, Morrisons, Ocado Retail, Argos, Harrods |
| Financial services | Nationwide Building Society, Aviva, NFU Mutual, London Stock Exchange Group, Mastercard Europe Services |
| Technology and telecoms | Microsoft UK, Cloudflare, BT, Vodafone Group and VodafoneThree, Sage |
| Professional services and IT | Deloitte, EY UK, PwC UK, Accenture UK, Capgemini UK, CGI, Capita, Fujitsu Services |
| Utilities, energy and infrastructure | SSE, United Utilities Water, Pennon, Harbour Energy, Balfour Beatty, Kier Group |
| Public sector and transport | Newark and Sherwood District Council, Translink, The Bristol Port Company |
| Media and education | ITV, Future, Pearson UK |
Many smaller cyber security and IT firms are also listed, so the list is not just large companies.
What signatories commit to
The published declaration sets out three actions.
| Action | What it involves | Timing |
|---|---|---|
| Make cyber a board responsibility | Implement all actions in the Cyber Governance Code of Practice, and ensure all board members complete the NCSC's Cyber Governance Training | Training within 3 months, then annually |
| Sign up to Early Warning | Register for the NCSC's Early Warning service | Within 1 month of signing |
| Require Cyber Essentials across supply chains | Register with the Cyber Essentials Supplier Check Tool, audit Cyber Essentials coverage across the supply chain, discuss the audit with the board, and take a risk-based approach to requiring certification | Tool registration within 2 months |
Signatories also commit to:
- Publishing the signed declaration on their website within 2 months.
- Publishing an annual update on their progress, in the annual report or on their website.
- Giving the Government feedback promptly if they cannot implement an action.
If a signatory does not require Cyber Essentials for some suppliers, its board must confirm that this fits its risk appetite and strategy, and that it gets adequate assurance in other ways.
What being on the list tells you
It tells you an organisation has committed to these actions. It does not tell you:
- That the actions are finished.
- That its security is good, or that it has not had an incident.
- That it holds Cyber Essentials itself.
- That the Government has endorsed its products.
- That it complies with the Bill.
If you are checking a supplier, the list is a starting point. Follow up by asking for:
- The published declaration and the latest annual update.
- Its own Cyber Essentials status, where relevant.
- Evidence for the controls relevant to what it does for you.
How to sign
The declaration is a template for signature by the organisation's chair or chief executive. A May 2026 government newsletter said to send signed declarations to a DSIT mailbox, but the declaration now refers to DCMS, and responsibility for the cyber security sector team has moved. So check the current Pledge page before sending anything.
Should you sign?
Before signing, check you can do all of these within the deadlines:
- Book board training within 3 months.
- Identify who will manage Early Warning alerts.
- Get a usable list of suppliers for the Cyber Essentials audit.
- Agree who will write the annual public update.
Implementing all the Code's actions may take your organisation longer than the rest. The commitment is public, so make sure a senior person owns it.
How the Pledge relates to the Bill
The two are separate, but the work overlaps. Board ownership, threat alerts and supplier checks all help you prepare for regulated duties, or for questions from regulated customers. Early Warning does not meet the Bill's incident reporting duty, however, and Cyber Essentials is not the same as meeting the Bill's security duties. See the Bill on one page and our analysis of the Pledge launch.
Sources
Frequently asked questions
GOV.UK publishes the official list. Names include M&S, Tesco, Nationwide Building Society, Microsoft UK, BT, Deloitte and ITV, along with many smaller firms.
Make cyber a board responsibility, sign up to the NCSC’s Early Warning service, and require Cyber Essentials across supply chains using a risk-based approach.
No. It is voluntary, although signatories commit to taking positive and meaningful steps and publishing updates.
No. It shows a commitment to specific actions. It does not prove that the actions are finished or that the company meets any legal duty.