The government has added cyber attacks and major IT outages to its national risk register. The lesson scales down to small firms.
Seven new risks were added on 14 July, including attacks on data centres and a CrowdStrike-style 'digital resilience failure'.
On 14 July the government published the 2026 edition of the National Risk Register, the official list of the threats it thinks could seriously disrupt the country. Seven new risks were added, and several of them are about technology failing. It is a useful signal for any business, not just Whitehall.
What was added
The new entries include cyber attacks on data infrastructure, meaning the data centres that host the systems businesses rely on, along with attacks on water systems and police networks. A separate new category, 'digital resilience failure', was added off the back of the CrowdStrike outage in July 2024, when a single faulty software update knocked out computers worldwide. So the risk is broader than a deliberate attack. It also covers the day a supplier you depend on has a very bad day.
Why the government is worried
The register points to the growing sophistication of attacks, helped along by artificial intelligence. Alongside it, ministers said they will run a national resilience campaign later this year to get households and organisations thinking about how they would cope with events like a cyber attack or a long outage. Darren Jones, Chief Secretary to the Prime Minister, said the government will do all it can and is well prepared, but that everyone can play their part to keep themselves and their loved ones safe.
What it means for a smaller business
You will not be defending a national data centre. The principle scales down all the same. Most small firms now depend on a handful of suppliers: one cloud platform, one broadband line, one phone system, one accounting tool. If any one of them goes down, so does part of your business. The register is a prompt to know those dependencies and have a plan for when one of them fails.
What this means for your business
Treat this as a nudge to do three unglamorous things. Write down which systems and suppliers your business cannot run without. Make sure your data is backed up somewhere separate and that someone has actually tested a restore this year. And agree, in advance, what the team does if the internet, the phones or a key cloud app is down for a day. The CrowdStrike outage showed the biggest disruptions are not always someone's fault, and being ready costs a lot less than being caught out. We can help you map the dependencies and put a simple continuity plan in place.
#WEARECOBALT
Ready when you are.
Tell us what's slowing your business down. We'll tell you exactly how we'd fix it — plainly, with no obligation.