Key Takeaways
- The UK government’s National Cyber Action Plan (NCAP), intended as an updated strategy to defend the wider economy from state‑backed and criminal hacking, has been postponed again due to leadership uncertainty after Prime Minister Keir Starmer’s resignation.
- Although the full release is delayed, the government remains committed to cyber defence through complementary measures such as the Cyber Security and Resilience Bill, the National Cyber Resilience Pledge, and daily support from the National Cyber Security Centre (NCSC).
- The NCAP is expected to be organized around three pillars—Threat, Growth, and Resilience—and will adopt a “near, mid, far” cyber‑space framework advocated by NCSC chief executive Richard Horne.
- Persistent delays in related legislation (e.g., the Cyber Security and Resilience Bill, ransomware proposals) underscore concerns that cybersecurity continues to receive low political priority in Westminster, despite high‑profile attacks on organisations like Synnovis and Jaguar Land Rover that have caused billions of pounds in economic damage.
- Upcoming events, including a Tuesday signing ceremony for the Cyber Resilience Pledge by numerous FTSE 350 firms, will proceed as planned, signalling ongoing efforts to raise private‑sector cyber hygiene while the broader strategy awaits finalisation.
Introduction and Delay
Britain’s National Cyber Action Plan, the government’s forthcoming strategy for shielding the wider economy from state‑backed and criminal hacking, has been delayed once more. Multiple sources with knowledge of the matter told Recorded Future News that the plan, originally slated for publication on Monday, was postponed amid the uncertainty surrounding the Labour Party’s leadership contest, which opens on 9 July. The delay follows Prime Minister Keir Starmer’s resignation, which triggered a scramble for his successor and left the timetable for major policy releases in flux. A government spokesperson affirmed that the administration remains committed to publishing the NCAP, emphasizing that protecting national security is the first duty and highlighting ongoing actions such as the Cyber Security and Resilience Bill, the National Cyber Resilience Pledge, and daily expert support from the National Cyber Security Centre (NCSC).
Political Context and Leadership Uncertainty
The postponement is directly tied to the fluid political landscape after Starmer’s departure. As of the article’s publication, no other candidates had officially declared their intention to contest the Labour leadership, though Andy Burnham, the former Manchester mayor and current frontrunner, is widely expected to emerge victorious following the Makerfield by‑election that preceded the premier’s resignation. This leadership vacuum has created a climate of caution within Whitehall, where senior officials appear reluctant to finalise major strategic documents until the new political direction becomes clearer. Consequently, the NCAP—initially conceived as an update to the 2022 National Cyber Strategy—has been caught in the cross‑currents of party politics, illustrating how shifts at the top can ripple through specialised policy areas such as cybersecurity.
Government Commitment and Ongoing Initiatives
Despite the delay, the government stressed that work on bolstering the UK’s cyber defences continues unabated. The spokesperson pointed to three concurrent tracks: the progression of the Cyber Security and Resilience Bill through Parliament, the promotion of the national Cyber Resilience Pledge—a voluntary commitment for businesses to elevate their digital defences—and the day‑to‑day assistance provided by the NCSC to organisations nationwide. These measures are presented as tangible steps that fulfil the government’s pledge to protect national security while the broader action plan undergoes finalisation. The emphasis on existing programmes aims to reassure stakeholders that the postponement does not equate to a halt in cyber‑risk mitigation efforts.
Historical Timeline of the Plan
The NCAP’s origins trace back to a promise made by then‑Chancellor of the Duchy of Lancaster Pat McFadden, who first announced that an updated cyber strategy would be released before the end of 2025. By April 2026, the target had shifted to “this summer,” and the document was rebranded from a “strategy” to an “action plan” to reflect a more operational focus. McFadden’s 2025 announcement was made in Manchester, a city whose then‑mayor, Andy Burnham, now leads the Labour leadership race. The evolution of the timetable—from a firm 2025 deadline to a vague summer 2026 window—mirrors the broader pattern of repeated postponements that have plagued UK cyber policy initiatives in recent years.
Cyber Security and Resilience Bill Delays
Closely linked to the NCAP’s fate is the Cyber Security and Resilience Bill (CSRB), an overhaul of the country’s critical‑infrastructure cyber legislation. The CSRB required more than four years to reach Parliament and is now not expected to be enforced until 2028—a full decade after the NIS Regulations it was designed to replace. Core provisions of the bill were completed as early as 2022 under former Prime Minister Rishi Sunak, but his administration mistakenly described the laws as “updated” before omitting them from that year’s King’s Speech, leaving the draft bill unintroduced. When Starmer’s government attempted to revive the bill in September 2025, it was stalled again by a cabinet reshuffle. This legislative inertia underscores a systemic challenge: even when technical groundwork is laid, political and procedural hurdles can delay implementation for years.
Ransomware Proposals and Political Prioritization
Parallel to the CSRB, a set of ransomware‑focused proposals—mandatory reporting for all victims, a licensing regime for extortion payments, and a ban on ransom payments for critical‑infrastructure operators—was slated for public consultation in mid‑2024. The initiative was derailed when Sunak called a general election, pushing the consultative process onto the back burner. The episode contributed to a growing perception that cybersecurity remains a low political priority within Westminster. During the 2024 election campaign, a ransomware attack on the pathology provider Synnovis by the Russia‑linked Qilin group forced London hospitals to declare a critical incident, cancelling operations and appointments. Yet neither major party addressed the attack in any detail during their campaigns, reinforcing the view expressed by experts like Jamie MacColl of RUSI that cybersecurity only garners significant attention after a major incident occurs.
High‑Profile Cyber Incidents (Synnovis, Jaguar Land Rover)
The tangible cost of this neglect was starkly illustrated by two major cyber events. In September 2025, a cyberattack on Jaguar Land Rover (JLR)—one of Britain’s largest manufacturers, responsible for roughly 4 % of the nation’s goods exports—halted vehicle production for over a month. The Cyber Monitoring Centre labelled it the most economically damaging cyber incident ever to hit the UK, estimating a shutdown cost of £1.9 billion (≈ $2.5 billion) and affecting more than 5,000 organisations across JLR’s supply chain; JLR itself reported being out of pocket by £680 million (≈ $896 million). The severity prompted the government to underwrite a £1.5 billion loan to support JLR’s suppliers, even as the CSRB—drafted years earlier—remained unintroduced, having been shelved that same month amid a cabinet reshuffle. Earlier, the Synnovis ransomware incident had similarly exposed gaps in national preparedness, with critical healthcare services disrupted despite the attack’s clear political relevance.
Details of the National Cyber Action Plan (Pillars and Near/Mid/Far Space)
Although the full NCAP has not been officially disclosed, Recorded Future News understands it will be structured around three pillars: Threat, Growth, and Resilience. The clearest public articulation of the government’s approach came in a June 2026 lecture to the Royal United Services Institute (RUSI) by NCSC chief executive Richard Horne, three weeks before the plan’s intended launch. Horne urged a “full court press” across what he termed the “near, mid, and far spaces” of cyberspace—a framework expected to shape the NCAP’s architecture. He defined the near space as the defence of individual organisations, the far space as offensive action against adversaries, and the mid space as the shared cloud, technology, and telecommunications infrastructure, most of which resides in private hands. In the mid space, the government intends to partner with providers to “harden the mid space and disrupt attacker activity.” Horne also noted that the NCSC is developing a National Cyber Defense Capability to fuse intelligence and actions across the near, mid, and far realms in real time, describing the endeavour as operating in an “agentic AI world.” Between June 2024 and May 2026, the NCSC handled more than 200 incidents affecting critical national infrastructure and its supply chain, with roughly 75 % linked to state actors.
Cyber Resilience Pledge and Industry Engagement
A central component of the NCAP’s implementation strategy is the Cyber Resilience Pledge, a voluntary commitment whereby participating companies agree to make cybersecurity a board‑level responsibility, subscribe to the NCSC’s Early Warning service (which delivers threat‑intelligence tip‑offs about imminent ransomware attacks), and enforce Cyber Essentials certification throughout their supply chains. Government ministers have written to the chairs and chief executives of hundreds of firms, including all FTSE 350 companies, urging them to sign the pledge. A signing event scheduled for Tuesday is still expected to proceed, although the exact attendance remains uncertain. The initiative reflects a broader effort to raise baseline cyber hygiene across the private sector while the overarching NCAP awaits finalisation, signalling that the government seeks to leverage industry cooperation as an interim bulwark against cyber threats.
Conclusion and Outlook
The repeated postponement of Britain’s National Cyber Action Plan reveals a tension between the urgent need for a cohesive national cyber defence strategy and the realities of political turnover and competing legislative priorities. While the government continues to advance complementary measures—such as the Cyber Security and Resilience Bill, the NCSC’s daily incident response, and the Cyber Resilience Pledge—the delay raises questions about whether the UK can sustain an effective, proactive posture against increasingly sophisticated state‑backed and criminal cyber actors without a unifying, publicly articulated framework. High‑profile attacks on organisations like Synnovis and Jaguar Land Rover have already demonstrated the substantial economic and societal costs of inadequate preparation. As the Labour leadership contest unfolds and the new administration settles into place, stakeholders will be watching closely to see whether the NCAP finally emerges with the clarity, resources, and political backing required to safeguard the nation’s digital economy in the years ahead.