Acuity Risk Management

“Fortunately, we’re not heavily regulated for cyber.” If that’s your organisation’s assumption, the Cyber Security and Resilience Bill is about to test it. Now in its final parliamentary stretch, through the Commons, before the Lords, Royal Assent expected later in 2026, the Bill substantially widens the UK’s cyber regime. It pulls managed service providers, data centres and critical suppliers into scope, many for the first time, with 24-hour reporting and turnover-linked fines. In the latest issue of The Cyber GRC Brief, our CEO David Rajakovich explains who gets pulled in, why the “critical supplier” designation turns on who depends on you rather than what you do, and why treating “not yet law” as “not yet urgent” is a mistake. The question: if you were designated in scope, for what you do, or who relies on you, could you meet a 24-hour reporting expectation and evidence your controls? 📩 Subscribe to The Cyber GRC Brief for a new issue each week. #CyberSecurity #CyberResilienceBill #MSP #SupplyChain #GRC

The cyber questions start at the tender and run to the last day of the contract. Keep the SAQ, the CIP and the evidence in one place throughout.

DEF STAN 05-138, DEFCON 658, your prime’s own questionnaire: the same control evidence, asked for three ways. Hold it once and reuse it.

Financial services is moving towards evidence-based resilience. Defence has already arrived, and there, failing to prove your cyber posture means losing the contract. Since late 2025, CSMv4 has been the mandatory cyber assurance framework for MOD contracts carrying DEFCON 658. Compliance is contractual, it’s independently certified, and it flows all the way down the supply chain, so even indirect suppliers are pulled in. Non-compliance can mean losing the contract or being shut out of future tenders. In the latest issue of The Cyber GRC Brief, our CEO David Rajakovich argues that defence is a preview of where every sector is heading: “prove it works,” made contractual, with real consequences. The question for any sector: if your biggest customer made evidenced cyber compliance a condition of keeping their business, as the MOD already has, could you meet it? 📩 Subscribe to The Cyber GRC Brief for a new issue each week. #Defence #CyberRisk #CSMv4 #SupplyChain #GRC

Your prime wants cyber evidence on request. If your team is small and your tracker is a spreadsheet, that request lands hard.

DORA needs a working ICT risk process, not another platform project. STREAM® Cloud is cyber GRC for risk teams in DORA-regulated firms.