KEYSIGMA Government Cyber Resilience Pledge
Voluntary Declaration of Commitment – October 2026
KEYSIGMA is committed to strengthening cyber resilience through effective governance, responsible risk management and improved security across our operations and supply chains. As a specialist cyber security consultancy and certification body, we recognise the importance of demonstrating the standards and good practices that we encourage other organisations to adopt.
1. Purpose and commitment
Following the UK Government’s ministerial letter of 13 October 2025, Key Sigma Ltd, trading as KEYSIGMA, voluntarily commits to the Government’s Cyber Resilience Pledge.
The pledge sets out three principal commitments intended to strengthen organisational and national cyber resilience: making cyber security a Board-level responsibility, participating in the National Cyber Security Centre’s Early Warning service, and promoting Cyber Essentials certification throughout supply chains.
We recognise that cyber resilience is a shared responsibility and that effective cyber security requires active leadership, informed decision-making and proportionate assurance of third-party risks.
2. Cyber governance and Board responsibility
KEYSIGMA commits to making cyber security an explicit responsibility of the Board and embedding cyber resilience within our governance and risk management arrangements.
We will implement all actions set out in the UK Government’s Cyber Governance Code of Practice, ensuring that cyber security risks receive appropriate leadership attention, oversight and accountability.
We further commit to ensuring that all Board members undertake the National Cyber Security Centre’s Cyber Governance Training within three months of signing this pledge and repeat the training annually thereafter.
3. Participation in the NCSC Early Warning service
KEYSIGMA is already registered with the National Cyber Security Centre’s (NCSC) Early Warning service, fulfilling this commitment under the Government Cyber Resilience Pledge.
The service provides notifications of potential malicious activity and vulnerabilities affecting registered internet-facing assets, helping organisations identify and respond to emerging cyber security threats.
We are committed to maintaining our registration and using the intelligence provided to support our ongoing cyber security monitoring, threat awareness and vulnerability management activities.
4. Cyber Essentials across our supply chain
KEYSIGMA recognises the importance of Cyber Essentials as a baseline security standard and as a mechanism for improving assurance across organisational supply chains.
We commit to registering for the Cyber Essentials Supplier Check Tool within two months of signing this pledge.
We will undertake a comprehensive audit of Cyber Essentials certification coverage across our entire supply chain, ensuring that the findings are presented to and discussed by the Board.
We will adopt a proportionate, risk-based approach to requiring Cyber Essentials certification from our suppliers, taking account of their services, access, dependencies and the potential cyber security risks they introduce.
Where Cyber Essentials certification is not required of a particular supplier, the Board will ensure that this decision aligns with KEYSIGMA’s risk appetite and business strategy and that appropriate assurance is obtained through alternative means.
5. Encouraging cyber resilience within our supply chains
Beyond our immediate commitments, KEYSIGMA will encourage the adoption of the pledge’s principles throughout our own supply chains.
We will engage with suppliers to improve our understanding of the cyber security risks they face, including risks arising from their own third-party relationships and dependencies.
We will encourage proportionate improvements in cyber governance, threat awareness and adoption of Cyber Essentials, recognising that stronger security practices across the wider supply chain contribute to improved collective resilience.
6. Transparency, publication and progress reporting
KEYSIGMA is committed to transparency and accountability in delivering the commitments contained within the Government Cyber Resilience Pledge.
This statement has been published on the KEYSIGMA website as part of our commitment to openly demonstrating our approach to cyber resilience, good governance and supply-chain security.
We will publish an annual update on our website outlining the actions undertaken, progress achieved and any further measures introduced to fulfil the commitments set out in this pledge.
These updates will provide ongoing visibility of our commitment to effective cyber governance, improved threat awareness and strengthened supply-chain assurance.
7. Accountability and declaration
Although the Government Cyber Resilience Pledge is voluntary, KEYSIGMA commits to taking positive and meaningful steps to implement its requirements in full.
Where we are unable to implement any of the pledge’s actions, we will promptly provide the Department for Culture, Media and Sport (DCMS) with relevant feedback explaining the circumstances.
This declaration demonstrates our commitment to strengthening cyber resilience within KEYSIGMA and contributing positively to the security of the wider UK business community and its supply chains.
Signed on behalf of Key Sigma Ltd (trading as KEYSIGMA)
Adam J Nottage
Managing Director
12/10/2026