National Audit Office NAO

Too many bodies with overlapping responsibilities operate in the centre of government, confusing departments about where to go for advice. As at April 2016, at least 12 separate teams or organisations in the centre of government had a role in protecting information, many of whom produce guidance. And the governance arrangements above them are unclear and fragmented, with no formal links between the three most important information security decision-making bodies in the Cabinet Office.

Increasing dependencies between central government and the wider public sector mean that traditional security boundaries have become blurred. At present, the Cabinet Office remit for security only extends to central government departments. However, there is a clear dependency between central government and the wider public sector, driven by increasing information flows, the demands of public service provision and shared technical infrastructure

The Cabinet Office does not collect or analyse government’s performance in protecting information on a routine basis. This means it has little visibility of information risks in departments and has limited oversight of the progress departments are making to better protect their information. Reporting personal data breaches is chaotic, with different mechanisms making departmental comparisons meaningless

The Cabinet Office does not have access to robust expenditure and benefits data from departments to take informed strategic decisions on protecting information. This is in part because departments do not always collect or share robust expenditure or benefits data. The Cabinet Office has recently collected some data on security costs, although it believes that actual costs are ‘several times’ the reported £300 million figure. Departments often do not share advice and knowledge effectively, either resulting in them repeating work at additional cost or missing the opportunities presented by adopting new technologies

In the context of a challenging national picture it has been difficult for government to attract people with the right skills . The government established a security profession in 2013, and has undertaken some initial work to establish professional learning and development. Demand for skills and learning across government is growing and is likely to continue to grow. Plans to cluster security teams may initially share scarce skills but will not solve the long-term challenge, and will pose questions for departmental accountability.