Member

We should be concerned about the impact of cyber attacks on SMEs across all sectors, which are generally underresourced and ill prepared to face up to or even detect the growing array of threats. Witness the fact that 96% of all successful cyber attacks in the UK in 2024—the ones we know about—were perpetrated on SMEs, not because they are prime targets but because they are soft targets. That is another reason to establish an OCR: to set up a single competent authority that benefits SMEs whatever their sector, and not simply as an advisory body—we have that already. As addressed in subsections (3) and (4) of the clause proposed in Amendment 88, the OCR would set specific standards, audits and certification for the software and digital service providers and MSPs that SME infrastructure depends on.