Government cyber resilience
SCALE
- 228 legacy IT systems in use in March 2024, 28 percent of them red-rated
- 89 of the 430 incidents managed by the National Cyber Security Centre between September 2023 and August 2024 assessed as nationally significant
- 72 IT systems assessed in the first year of GovAssure, across 35 departments
- £2.6 billion announced for cyber in 2021, £1.3 billion of it allocated to departments
- £650 million (2011) and £1.9 billion (2016-2021) for the earlier strategies
- over 50 percent of cyber security posts vacant in several departments in 2023-24
- £600,000 - the British Library's directly attributable costs of the October 2023 attack
COMPLIANCE
- Government Cyber Security Strategy 2022-2030
- minimum cyber security standards set by the Government Security Group
- NCSC cyber assessment framework, applied through GovAssure
- UK Government Resilience Framework
- National Cyber Strategy 2022
- Cyber Security and Resilience Bill
- National Audit Act 1983, section 6
ECONOMY
- cyber funding announced against funding allocated to departments
- cyber programmes cut back to fund other priorities
- remediation of legacy IT
- cost of an attack to the services it stops
EFFICIENCY
- staffing of the centre's own cyber directorate
- roles between the security group, the technical authority and the digital function
- overlap between central and departmental cyber skills initiatives
- pace of the centrally led interventions
EFFECTIVENESS
- whether the 2025 and 2030 resilience aims can still be met
- quality of the data the government holds about its own resilience
- coverage of the assurance exercise
- accountability for cyber risk at departmental board level
- recruitment and retention of people with cyber skills
1. For a decade the government marked its own cyber homework
Data management Monitoring Analysis
'Until April 2023, the government did not collect detailed, reliable data about the cyber resilience of departments. Before 2023, GSG asked departments to self-assess their performance against the minimum cyber security measures it had set for them. This did not give the government a good understanding of the cyber resilience of departments or specific IT systems' (p.9). The number that circulated in the meantime came from that source: 'GSG used these limited and subjective data to estimate that 25% of government organisations were meeting the minimum standards in 2022' (p.9). The replacement arrived eleven years after cyber attack was first named a top national threat: from April 2023 the security group used the technical authority's cyber assessment framework 'to agree with departments what cyber resilience outcomes they needed to achieve based on their role, likelihood of being targeted by a threat actor, IT estate, and the level of risk they were prepared to take', with independent reviewers verifying what departments reported (p.9). An information-base weakness of the plainest kind: a strategy with a 2025 deadline was steered for its first year on numbers the government itself calls subjective.
- Function: Security, Governance
- Value: Domain knowledge
- Stakeholders: Policy setter, Oversight
- Quality: Reliable, integrated information base Functioning oversight and governance
2. The first real look found the foundations immature across departments
Monitoring Resilience Incident response
'The first year of GovAssure identified significant gaps in departments' cyber resilience, which means they are vulnerable to cyber attack' (p.11). The scale of the look is worth holding next to the finding: 'Between April 2023 and July 2024, 35 departments took part in the first year of GovAssure and self-assessed 72 IT systems, which they identified as critical to running their most important services. Independent reviewers assessed 58 of these' (p.11). What those 58 reviews showed was not a scatter of local faults but a common floor giving way: 'The data highlighted multiple fundamental system controls that were at low levels of maturity across departments including asset management, protective monitoring, and response planning', and 'GSG reported to ministers the implication of these findings: the cyber resilience risk to government was extremely high' (p.11). The report draws the operational consequence elsewhere: departments 'cannot manage risk effectively and make risk-based decisions about how they protect their most important assets, if they do not understand their digital estate and security risks'. Asset management is the control that tells an organisation what it owns; without it the rest is guesswork.
- Function: Security, IT
- Value: Assets
- Stakeholders: Management, Oversight
- Quality: Sound risk management Reliability and availability
3. The oldest systems were left out of the assurance exercise altogether
Analysis Monitoring Design
'Legacy systems are often more vulnerable to cyber attack because their creators no longer update or support their use, few people have the skills to maintain them, and they have known vulnerabilities. The government estimated that it used nearly half of its £4.7 billion IT expenditure in 2019 to keep legacy systems running' (p.7). The stock is large and only roughly understood: 'In March 2024, departments reported using at least 228 legacy IT systems. Of these, 28% (63 of 228) were red-rated as there was a high likelihood and impact of operational and security risks occurring' (p.11). Then the exclusion: 'GSG did not include legacy systems in GovAssure because many of its recommended system controls would not be applicable to legacy systems' (p.11). The reasoning is coherent and the result is that the least defensible part of the estate is the part with no assessment - the government does not have a detailed assessment of 'the cyber security risk to departments and their essential services caused by using legacy IT', nor of 'how well departments have managed this risk, for example, by isolating legacy IT from the rest of their network or performing vulnerability assessments' (p.11).
- Function: IT, Infrastructure
- Value: Assets, Domain knowledge
- Stakeholders: Management, Supplier
- Quality: Sound risk management Reliable, integrated information base
4. Half the ageing estate has no funded plan to fix it
Goal-setting Target Responsibility
The money was announced and then, in part, spent elsewhere: 'In the 2021 Spending Review, the government announced it would invest £2.6 billion in cyber, of which it allocated £1.3 billion to departments for cyber security and legacy IT remediation. By January 2023, departments had funded the most urgent cyber priorities but risked not meeting their cyber resilience targets due to financial pressures. Since January 2023, some departments have significantly reduced the scope of their cyber security improvement programmes to fund other priorities' (p.12). The arithmetic of what is left undone is given exactly: 'In March 2024, departments did not have fully funded plans to remediate around half of the government's legacy IT assets (53%, or 120 out of 228), leaving these systems increasingly vulnerable to cyber attack' (p.12), and the report notes that 'under-investment in technology and cyber security played a role in the severity of the cyber attack on the British Library' (p.12). The conclusion follows from the funding gap rather than from any judgement about intent: 'departments have no fully funded remediation plans for half of these vulnerable systems. As a result, the government will not meet its aim for its "critical functions" to be resilient to cyber attack by 2025' (p.13).
- Function: Finance, Planning
- Value: Finance, Assets
- Stakeholders: Funder, Management, Policy setter
- Quality: Cost control and value for money Clear objectives and goal-setting
5. The centre could not staff the directorate it created to lead the work
Training Skill-building Responsibility
'GSG's resource constraints have limited how quickly it could implement centrally led interventions and the extent it could support departments' (p.9). The directorate set up in November 2022 to lead the government's cyber security function 'consistently reported resourcing, including recruitment and retention of staff, as a significant problem affecting the progress of its work. It had a significant shortage of staff, with around 32% of posts vacant, when it was first established' (p.9). What that bought was a narrower programme: 'Given its resource constraints, the cyber directorate prioritised the interventions it could lead from the centre of government', and it 'made limited progress in leading work to meet other strategic objectives that would help to improve government cyber resilience, such as helping departments to develop the right cyber security skills, knowledge and culture' (p.9). The same shortage runs through the departments it was meant to help: in 2023-24 'one in three cyber security roles in central government was either vacant or filled by temporary staff', in several departments vacancies exceeded 50 percent, and '70% of specialist security architects in post were temporary staff' (p.12). The strategy meant to close that gap by 2030 was, in January 2025, only partially funded (p.13).
- Function: Human resources, Organizational structure, Security
- Value: Human capital
- Stakeholders: Staff, Management, Funder
- Quality: Adequately staffed, skilled workforce Adequate resources and competences
6. No measure of whether any of it works, and no plan shared with departments
Monitoring Reporting Performance analysis
'GSG has not had sufficient measures in place to show whether its work to strengthen government's cyber security is effective, nor does it have a plan for how government organisations could become cyber resilient by 2030' (p.11). Three years into an eight-year strategy, 'by January 2025, GSG had not created a comprehensive monitoring and evaluation framework or shared a cross-government strategy implementation plan with departments. This means GSG has not yet been able to effectively measure, monitor and evaluate the government's progress towards the Strategy's aims for 2025 and 2030, or show how well its initiatives are working, and why' (p.11). The effect reaches everyone expected to act on the strategy: 'without a cross-government implementation plan, various parts of government, including departments, do not know what they need to do and by when' (p.11). Oversight of what departments did instead was left open: 'in April 2024, GSG asked departments to start developing their own implementation plans, but since then it has not asked for regular progress reports' (p.11). Targeted improvement plans agreed with departments by August 2024 had likewise not been followed up - 'by November 2024, GSG had not commissioned progress updates' (p.10).
- Function: Strategy, Planning, Governance
- Value: Regulatory system
- Stakeholders: Policy setter, Oversight
- Quality: Clear objectives and goal-setting Functioning oversight and governance
7. Departments still cannot tell which central body is responsible for what
Coordination Responsibility Guidance
The confusion is long-standing and has been reduced rather than removed: 'in 2016, we reported that the government's failure to coordinate how it protects information meant that many organisations had overlapping mandates and activities', after which four organisations were consolidated into the National Cyber Security Centre and, in 2023, a coordination centre was created as 'a collaborative partnership between GSG, CDDO and the NCSC to coordinate cyber security efforts across government so that it can "defend as one"' (p.10). It has not settled the question for the people who have to act on it: 'departments still find it difficult to understand the roles and responsibilities of the cyber organisations at the centre of government', and 'some departments did not understand the extent to which GSG or the NCSC are responsible for government's cyber resilience and incident management' (p.10). The machinery moved again during the audit: there are 'still challenges for GSG and CDDO to overcome in how they coordinate to build cyber security into government's digital strategies and services following the government's decision to move CDDO from the Cabinet Office to the Department for Science, Innovation & Technology' (p.10).
- Function: Organizational structure, Governance
- Value: Regulatory system
- Stakeholders: Policy setter, Delivery partner, Management
- Quality: Avoidance of duplication and fragmentation Functioning oversight and governance
Control focus
| ICS phase | Control function | Cases |
|---|---|---|
| Organic elements of a process | Data management | 1. For a decade the government marked its own cyber homework |
| Analysis | 1. For a decade the government marked its own cyber homework<br/>3. The oldest systems were left out of the assurance exercise altogether | |
| Work processes | Monitoring | 1. For a decade the government marked its own cyber homework<br/>2. The first real look found the foundations immature across departments<br/>3. The oldest systems were left out of the assurance exercise altogether<br/>6. No measure of whether any of it works, and no plan shared with departments |
| Business continuity | Resilience | 2. The first real look found the foundations immature across departments |
| Incident response | 2. The first real look found the foundations immature across departments | |
| Initial phase | Design | 3. The oldest systems were left out of the assurance exercise altogether |
| Goal-setting | 4. Half the ageing estate has no funded plan to fix it | |
| Responsibility | 4. Half the ageing estate has no funded plan to fix it<br/>5. The centre could not staff the directorate it created to lead the work<br/>7. Departments still cannot tell which central body is responsible for what | |
| Training | 5. The centre could not staff the directorate it created to lead the work | |
| Guidance | 7. Departments still cannot tell which central body is responsible for what | |
| Goal-setting | Target | 4. Half the ageing estate has no funded plan to fix it |
| Training | Skill-building | 5. The centre could not staff the directorate it created to lead the work |
| Functions applied to all stages | Reporting | 6. No measure of whether any of it works, and no plan shared with departments |
| Coordination | 7. Departments still cannot tell which central body is responsible for what | |
| Monitoring | Performance analysis | 6. No measure of whether any of it works, and no plan shared with departments |