National Audit Office NAO

Legacy systems are often more vulnerable to cyber attack because their creators no longer update or support their use, few people have the skills to maintain them, and they have known vulnerabilities. The government estimated that it used nearly half of its £4.7 billion IT expenditure in 2019 to keep legacy systems running.

Until April 2023, the government did not collect detailed, reliable data about the cyber resilience of departments.

The resilience of the hundreds of ageing legacy IT systems that departments still use is likely to be worse, and departments have no fully funded remediation plans for half of these vulnerable systems. As a result, the government will not meet its aim for its “critical functions” to be resilient to cyber attack by 2025. GSG assesses that achieving this for the wider public sector by 2030 remains ambitious, in part because this relies on departments meeting their responsibilities to keep their systems cyber resilient.

Departments still find it difficult to understand the roles and responsibilities of the cyber organisations at the centre of government.

Multiple fundamental system controls were at low levels of maturity across departments, including asset management, protective monitoring and response planning (…) Departments cannot manage risk effectively and make risk-based decisions about how they protect their most important assets, if they do not understand their digital estate and security risks.