SMEs need to take cyber security seriously | KPMG | UK

SMEs need to take cyber security seriously or face being frozen out of the procurement process, finds KPMG survey

SMEs need to take cyber security seriously

Small and Medium Sized Enterprises (SMEs) risk being disqualified from bidding for work because of the lack of importance they are placing on looking after their valuable client data, according to a survey of procurement managers by KPMG.


Also on

A multisector KPMG survey of 175 procurement managers across the UK from organisations with over 250 employees revealed that the general consensus (70%) of procurement managers is that SMEs should be doing more to prevent cyber attacks and protect valuable client data. 

The vast majority (86%) of respondents said they would consider removing an SME supplier if they were hacked and nearly all of the respondents (94%) confirmed that cyber security standards are important when awarding contracts to SME suppliers. 

George Quigley, Partner in KPMG’s cyber security practice, commented: “Cyber security is not just a technical issue anymore; it has become a business critical issue for the UK’s SMEs.  Larger companies are placing an increased emphasis on the cyber security of their suppliers and increasingly the onus is on SMEs to show that they are tackling this issue head on. 

“Unfortunately many SME still take a blasé approach towards cyber security and mistakenly don’t see themselves as targets of cyber criminals. Unless these organisations take a more mature approach towards cyber security now, they face the risk of being frozen out of lucrative supplier contracts.” 

Already two-thirds of procurement managers ask their suppliers to demonstrate cyber accreditations (ISO27001, Cyber Essentials, IASME certifications or PCI DDS) as a part of their procurement assessment, with this number likely to increase in the near future.  In addition, SMEs are increasingly being asked to self-fund their own accreditations. In the absence of accreditation, two-fifths (41%) of procurement managers expect their suppliers to pay for their own accreditations and reach a certain level of cyber maturity in the near future. 

George Quigley concluded: “In order for businesses to be awarded some public sector contracts they already have to demonstrate a certain level of cyber maturity and this is increasingly becoming the norm in the private sector as well. Companies are also imbedding cyber security in their supplier contracts with about half (47%) of existing contracts already stating that suppliers are contractually obliged to tell if they have been hacked.  This means that if a SME supplier is breached and doesn’t deal with it appropriately, they could be looking at the termination of an existing supplier contract. 

“The government is looking to increase the cyber maturity of UK businesses, with accreditations like the Cyber Essentials Scheme. We can only expect the bar to be raised higher in the coming years. There is no time like the present for SMEs to start taking the  initial steps towards increasing their level of cyber maturity.” 




Notes to editors:

For press enquiries contact

Zoe Sheppard

T: +44 (0)117 905 4337


KPMG Press office: +44 (0)207 694 8773

Follow us on twitter: @kpmguk 


About KPMG

KPMG LLP, a UK limited liability partnership, operates from 22 offices across the UK with approximately 12,000 partners and staff.  The UK firm recorded a turnover of £1.9 billion in the year ended September 2014. KPMG is a global network of professional firms providing Audit, Tax, and Advisory services. It operates in 155 countries and has 162,000 professionals working in member firms around the world. The independent member firms of the KPMG network are affiliated with KPMG International Cooperative ("KPMG International"), a Swiss entity.  Each KPMG firm is a legally distinct and separate entity and describes itself as such. 

Connect with us


Request for proposal