Want to speak with sales?
43% of UK businesses experienced a cyber breach last year. Only 14% assess cyber risk in their immediate suppliers.
That gap is about to close, fast.
The UK government recently published its Cyber Action Plan, backed by £210 million and a new central authority. The plan officially focuses on central departments and arm's-length bodies (ALBs) meeting baseline standards by 2029. But if you're an MSP or IT service provider serving public sector clients, the official timelines matter less than understanding the direction of travel.
Because government plans don't stay contained. What starts as a departmental delivery target becomes a procurement requirement. Then a supply chain expectation. Then a client question you're expected to answer.
Are you going to be ready when this plan affects your clients?
Why MSPs Should Act Now
The government's Cyber Action Plan creates three immediate pressures that will cascade to MSPs faster than the official 2029 timeline suggests:
- Personal accountability creates budget urgency
Accounting Officers (permanent secretaries, CEOs of government bodies) are now personally responsible for cyber risk across their departments, ALBs, and supply chains. Not departmentally responsible. Personally. When senior officials have personal liability, budgets move faster than policy timelines.
- The enforcement gap is closing
The Cyber Security and Resilience Bill, introduced in November 2025 and passed its second reading in January 2026, will bring medium and large MSPs into direct regulatory oversight for the first time. The Bill is now in committee stage and expected to become law later this year, introducing several critical requirements:
- The 24/72 Rule: Notify the regulator within 24 hours of discovering a significant incident, provide full report within 72 hours
- Turnover-Based Fines: Up to £17 million or 4% of global turnover for serious breaches (GDPR levels)
- Proactive Supervision: The Information Commission (IC) (formerly the Information Commissioner’s Office, or ICO), which will take on new network and information systems security responsibilities under the Bill, can inspect your security posture before incidents occur
- Registration Requirements: RMSPs will have three months to register with the ICO once relevant provisions commence
- The urgency mismatch creates competitive advantage
Here's the tension: The NCSC's own messaging in its Annual Review 2025 is "it's time to act," reinforced by thousands of incidents handled last year and a rising threat picture. But the Action Plan's milestones feel cautious: 50% supplier assurance coverage by 2029, two-thirds of assessed systems meeting 75% of CAF outcomes.
The NAO called out similar issues in its January 2025 report on government cyber resilience. This plan responds to many of those critiques, but the pace still lags behind the threat environment the government itself describes.
For MSPs, that gap creates both opportunity and planning challenge. Clients who wait for mandates will be scrambling. Clients who move now can be defensible, not just compliant on paper. But move too early and you're investing ahead of demand; wait too long and you're scrambling to catch up when clients start asking questions.
The skills dynamic makes this urgent:
Government faces a massive skills gap: one in three cyber roles are unfilled, and 70% of specialist roles rely on contractors because government can't match private sector salaries. The plan creates a Government Cyber Profession to address this, but in the meantime, departments will need partners who can deliver.
What the Government Is Actually Doing
The government is establishing the Government Cyber Unit, a centralised function within DSIT that will set standards, provide services, and hold departments accountable. This represents a fundamental shift from fragmented, department-by-department approaches to active central coordination.
The core commitments:
- The Cyber Assessment Framework (CAF) becomes the organising model for assurance, operationalised through GovAssure
- Cyber Essentials positioned explicitly as a baseline control
- Supply chain assurance becomes mandatory, with 50% of ALBs required to implement "some type" of supplier assurance by April 2029
- Accounting Officers now personally accountable for cyber risk in their departments, ALBs, and supply chains
- Evidence and reporting move from policy theatre to practical delivery
The plan also acknowledges something important: legacy systems are hard to defend (28% of government systems are legacy tech), funding is constrained, and cyber incidents are routine, not exceptional.
The Three-Phase Government Rollout
Understanding the government's implementation timeline helps with planning:
Phase 1: Building (by April 2027)
- Government Cyber Unit established with core functions
- Clear standards and targets set for departments
- Government Cyber Profession launched
- Incident Response Plan published
Phase 2: Scaling (by April 2029)
- Departments deliver costed cyber improvement plans
- Central services pipeline established
- Departments fully operating within new governance structures
- 50% of ALBs implement supply chain assurance
Phase 3: Improving (post-2029)
- Continuous improvement based on data insights
- Strategic supplier management at scale
- Profession drives transformation
The demand you'll see won't wait for Phase 2. Procurement teams move faster than policy milestones, and Accounting Officers with personal accountability will act sooner rather than later.
What to Expect: The Cascade Effect
Based on the plan's structure and typical government procurement patterns, here's what to expect:
Cyber Essentials becomes non-negotiable
Not because clients suddenly care about technical controls, but because buyers will use it as a fast, visible way to raise the floor. If you're bidding on work involving public sector clients, regulated industries, or supply chains touching either, CE will move from nice-to-have to table stakes.
CAF becomes the reference model
Even for organisations that never formally adopt CAF, its language and structure will shape how assurance is described, measured, and bought. GovAssure is how this gets operationalised: departments assess critical systems against CAF outcomes and report centrally. If your outputs don't map cleanly to CAF outcomes, you'll spend time explaining why instead of demonstrating value.
Assurance pressure cascades early
Based on how government procurement typically works, requirements cascade like this: government sets requirements for departments, departments push requirements onto their ALBs, ALBs push requirements onto suppliers, and suppliers turn to their MSPs for support. Given the April 2027 and 2029 milestones in the Action Plan, most organisations are likely in the early stages of this process - understanding requirements and planning responses rather than actively implementing yet. But lead departments are now explicitly accountable for the cyber resilience of their ALBs and sectors, which means the timelines say 2029 but procurement processes will move faster.
Evidence replaces effort
The Action Plan emphasises the need to demonstrate compliance through evidence rather than assertions. Clients must show progress to auditors, insurers, and procurement teams. If your service model doesn't produce portable, reusable evidence, you'll be asked to redo work you've already done.
Centralised support creates new dynamics
The Government Cyber Unit will offer services and support to departments at scale. This includes technical advisory, detection services, incident response retainers, and a "partnering function" to help organisations access what they need. For MSPs, this could mean competition from centralised offerings, or opportunities to deliver services through government frameworks.
The Cyber Security and Resilience Bill: Timeline and Preparation
The Bill must pass through both Houses of Parliament before receiving Royal Assent. Once it becomes law, different provisions will be brought into force in phases through secondary legislation (commencement regulations).
This phased approach allows time for:
- Consultation on specific technical requirements and thresholds
- Development of guidance and support materials
- MSPs and regulators to prepare for implementation
For MSPs, this represents a fundamental shift: cybersecurity will move from being primarily a service you sell to also being a regulatory requirement you must live by. The time to prepare is now, before the requirements take effect.
What to do now:
- Review your current incident response and reporting capabilities
- Ensure you have appropriate security measures and documentation in place
- Budget for registration fees and compliance costs
What This Means in Practice
If you're serving public sector clients, regulated industries, or supply chains connected to either, three things shift:
Cyber Essentials becomes the entry point
Fast, standardised, and increasingly expected. Treat it as the gateway to deeper work, not the finish line.
Ongoing assurance becomes the business model
One-off certifications don't match the demand environment. Clients need continuous visibility, not annual audits. Build services that assume compliance is a state, not an event.
Portability and automation win
Manual processes and bespoke outputs don't scale. The MSPs who thrive will be the ones who can turn security work into usable evidence quickly and consistently.
How Leading MSPs Are Responding
Your clients won't wait until 2029 to ask questions about supply chain assurance, Cyber Essentials status, and ongoing compliance evidence. They're asking now.
Over 1,000 MSPs use CyberSmart to answer at scale:
Cyber Essentials certification in as little as 24 hours with unlimited expert support
Continuous compliance monitoring that tracks security posture in real-time
CAF-aligned evidence clients can reuse across tenders, audits, and insurance reviews
Multi-tenant operations with flexible commercial models built for MSP delivery
Security work becomes evidence. Evidence answers questions. Questions answered quickly become revenue.
The Bottom Line
The 2029 milestones are political. The demand is arriving now.
Clients are already facing supply chain assurance requirements in procurement, audits, and renewals. The MSPs who can respond immediately with portable evidence will win that work.
Book a demo to see how leading MSPs are turning compliance demands into scalable revenue streams with CyberSmart.