Preparing for the ripple effects for government cyber policy

The first year of the U.S. Trump Administration, the new European Parliament and the UK Labour Government brought about considerable shifts in how technology and cyberspace are governed. Across these governments, as well as in re-elected administrations in Canada, Australia and Singapore, national security, sovereignty and interventionism have dominated cyber policy and regulatory agendas.

As outlined in the latest edition of NCC Group’s Global Cyber Policy Radar, cyber security programmes must adapt to this new era of geopolitics, understanding what new policy developments mean for their business and how to respond in a way that builds resilience and competitive advantage.

Here we explore some of the recent shifts we’ve observed global cyber policy, drawing from our insights shaping cyber rules around the world:

Offence is the new defence in national cyber strategies

It’s no surprise, given the lessons learned from the Ukraine war, that cyber is now firmly integrated into nations’ military strategies. However, this is matched with a ‘peacetime’ focus on developing cyber deterrents, openly declaring these capabilities and a seemingly increasing willingness to retaliate in equal measure against cyber attackers. As the UK Security Minister Dan Jarvis has said: “We will seek to do everything that we possibly can to ensure that [cybercriminals] understand that there are repercussions as a consequence of their actions”.

How does this shift impact the private sector? Some (mainly US) commentators have explored whether private sector and critical infrastructure involvement in national cyber operations should be expanded to include more ‘offensive’ activities. Indeed, Congressman David Schweikert has introduced the Cybercrime Marque and Reprisal Authorization Act of 2025 which would – if passed – enable the President to deputise licensed cyber operators “to pursue foreign cybercriminal enterprises targeting American citizens and infrastructure.”

Could we similar moves in the UK? Will operators of critical infrastructure be asked to do more, such as implement honeypots or other ‘Active Cyber Defence’ measures? How does this impact the threat landscape within which you operate?

Governments message is clear: you are responsible for your own cyber resilience

In the words of the National Cyber Security Centre CEO Richard Horne earlier this month: “For too long, cyber security has been regarded as an issue predominantly for technical staff. This must change. All business leaders need to take responsibility for their organisation’s cyber resilience.”

In an era of austerity and reduced public sector expenditure, there is a view that governments can only do so much. The private sector must step up and take responsibility for their own digital resilience. This extends to supply chains, as governments double-down on efforts to create secure, sovereign supply chains.

In practice, in the UK and elsewhere in the world, we are continuing to see a strengthening of the regulatory obligations placed on businesses, an expansion of which organisations they apply to, and the introduction of individual liability placed on senior leaders. While there are efforts to simplify and streamline rules, the bar organisations have to meet in order to comply is continuing to rise.

Are you prepared for a ransomware payment ban?

The UK has announced its intention to ban public sector bodies and operators of critical national infrastructure from giving in to ransomware demands. Under the plans, all other UK-based organisations will have to notify the government before paying a ransom. While the proposals are yet to be set in stone, they would mark a significant shift in how governments disrupt ransomware payment channels.

Organisations should consider how the measures might impact their incident response plans. What would the ransomware reporting and payment notification schemes mean for your response timelines? Would a ransomware payment ban impact your cost of recovery calculations? How would your existing insurance arrangements be affected? Practically working through the consequences of the UK’s plans, while also considering what it would mean if other countries followed suit, will ensure your cyber security, compliance and incident preparedness programmes are ahead of the game.

Reactive rule-by-rule compliance will no longer suffice

Cyber laws, regulations and policies are not static. They are constantly adapting to national priorities, cyber threats and geopolitical developments. Cyber governance must be equally flexible – accounting for governments’ fast-moving and shifting priorities.

To understand more about governments’ evolving cyber policies, what they might mean for you and your organisation, and how you can prepare, download your copy of NCC Group’s Global Cyber Policy Radar here: Global Cyber Policy Radar | NCC Group

Cyber Resilience Programme activities

techUK brings together key players across the cyber security sector to promote leading-edge UK capabilities, build networks and grow the sector. techUK members have the opportunity to network, share ideas and collaborate, enabling the industry as a whole to address common challenges and opportunities together. Visit the programme page here.

Upcoming events

Latest news and insights

Learn more and get involved

Cyber Resilience updates

Sign-up to get the latest updates and opportunities from our Cyber Resilience programme.

Meet the team

Jill Broom

Head of Cyber Resilience, techUK

Jill leads the techUK Cyber Resilience programme, having originally joined techUK in October 2020 as a Programme Manager for the Cyber and Central Government programmes. She is responsible for managing techUK's work across the cyber security ecosystem, bringing industry together with key stakeholders across the public and private sectors. Jill also provides the industry secretariat for the Cyber Growth Partnership, the industry and government conduit for supporting the growth of the sector. A key focus of her work is to strengthen the public–private partnership across cyber to support further development of UK cyber security and resilience policy.

Before joining techUK, Jill worked as a Senior Caseworker for an MP, advocating for local communities, businesses and individuals, so she is particularly committed to techUK’s vision of harnessing the power of technology to improve people’s lives. Jill is also an experienced editorial professional and has delivered copyediting and writing services for public-body and SME clients as well as publishers.

Email:: [email protected]
Website:: www.techuk.org/
LinkedIn:: https://www.linkedin.com/in/jill-broom-19aa824

Read lessmore

Annie Collings

Programme Manager, Cyber Resilience, techUK

Annie is the Programme Manager for Cyber Resilience at techUK. She first joined as the Programme Manager for Cyber Security and Central Government in September 2023.

In her role, Annie supports the Cyber Security SME Forum, engaging regularly with key government and industry stakeholders to advance the growth and development of SMEs in the cyber sector. Annie also coordinates events, engages with policy makers and represents techUK at a number of cyber security events.

Before joining techUK, Annie was an Account Manager at a specialist healthcare agency, where she provided public affairs support to a wide range of medical technology clients. She also gained experience as an intern in both an MP’s constituency office and with the Association of Independent Professionals and the Self-Employed. Annie holds a degree in International Relations from Nottingham Trent University.

Email:: [email protected]
Twitter:: anniecollings24
LinkedIn:: https://www.linkedin.com/in/annie-collings-270150158/

Read lessmore

Olivia Staples

Junior Programme Manager - Cyber Resilience, techUK

Olivia Staples joined techUK in May 2025 as a Junior Programme Manager in the Cyber Resilience team.

She supports the programs mission to promote cyber resilience by engaging key commercial and government stakeholders to shape the cyber resilience policy towards increased security and industry growth. Olivia assists in member engagement, event facilitation and communications support.

Before joining techUK, Olivia gained experience in research, advocacy, and strategic communications across several international organisations. At the Munich Security Conference, she supported stakeholder engagement and contributed to strategic communications. She also worked closely with local and national government stakeholders in Spain and Italy, where she was involved in policy monitoring and advocacy for both public and private sector clients.

Olivia holds an MSc in Political Science (Comparative Politics and Conflict Studies) from the London School of Economics (LSE) and a BA in Spanish and Latin American Studies from University College London (UCL).

Outside of tech, Olivia enjoys volunteering with local charities and learning Norwegian.

Email:: [email protected]

Read lessmore

Fran Richiusa

Programme Team Assistant for Public Sector Markets, techUK

Fran serves as the Programme Team Assistant within techUK’s Public Sector Market Programmes, where she is responsible for delivering comprehensive team support, managing administrative functions, and fostering strong relationships with members.

Prior to joining techUK in May 2025, Fran built a meaningful career in the charitable and local government sectors. She worked extensively with both victims and perpetrators of crime, and notably led the coordination of Domestic Homicide Reviews across Surrey—an initiative aimed at identifying lessons and preventing future incidents of domestic abuse.

Outside of work, Fran is an avid traveller and a proud cat mum who enjoys unwinding with her feline companions.

Email:: [email protected]
Website:: www.techuk.org/
LinkedIn:: https://www.linkedin.com/in/francesca-richiusa/

Read lessmore

Preparing for the ripple effects for government cyber policy

Offence is the new defence in national cyber strategies

Governments message is clear: you are responsible for your own cyber resilience

Are you prepared for a ransomware payment ban?

Reactive rule-by-rule compliance will no longer suffice