While the strategy is intended to be public-sector wide , these governance structures do not include public sector representation beyond central government, such as schools, police and the wider health sector. The proposed governance of the strategy is also largely separate from the cross-government governance structure established to oversee wider AI policy delivery led by DSIT, potentially losing the benefits of a coordinated approach and increasing risks to delivery.

this action must be mutually coordinated between the institutions, because several institutions and the IS maintained by them are involved in its execution very often for an e-service to function.

Status updates

Regular monitoring and status updates keep team members, senior management and those charged with governance informed about project progress, milestones, and potential issues. This helps prevent misalignment and ensures that everyone is on the same page.

Some of the goals of the first implementation programme were not reached, because the level of commitment to the actions varied and the level of commitment could not be improved in a centralised manner. Only actions to which the competent authorities and other actors have clearly committed were included in the new implementation pro-gramme. The level of commitment and available resources are linked. Monitoring of the programme has been improved to offer government leaders a better idea of the current status of cyber security.

The integration of Polycom Value Preservation 2030 into the agile approach of the DaziT transformation project ensures a high level of visibility for the project. The working method in the project is flexible and solution-orientated. There is no steering committee for the project at tinhe FOCBS. The progress of the project is continuously monitored by DaziT in a ten-week planning cycle.

Communication protocols

Clear communication protocols ensure that information is conveyed accurately and promptly. Tools such as email , messaging apps , and regular meetings are used to facilitate communication among team members.

Mechanisms for collecting signals from team members include feedback on processes, communication channels, and overall coordination effectiveness.

The exchange of information is burdened with certain legal, technical and cultural challenges. It is therefore important that the Government Offices and the government agencies find forms for addressing these challenges.
Government control of national information and cyber security – both urgent and important RiR - Sweden 2023

The Danish Agency for Governmental IT Services has informed Rigsrevisionen that it is impossible for the agency to upgrade or decommission the servers because the authorities have not, as required, ensured that their administrative systems will be compatible with new servers . (…) the agency has not established the necessary collaboration with the authorities to facilitate timely upgrading or decommissioning.
Security of servers managed by the Danish Agency for Governmental IT Services Rigsrevisionen - Denmark 2023

The heads of individual facilities are confused. There are no regulations and so they do not know what and how to prepare themselves to start the system implementation. Some of them started to act on their own. They set up independent, local systems that will cover only the service providers that are willing to cooperate. NIK warns against incoherence or doubling of the systems which may cause problems with settling the EU funds.

The current operating model is that each agency is responsible for its own cyber protection. There is not enough expertise in cyber protection available, however, which hinders the creation of cyber protection on one’s own and the creation of cyber protection based on purchased services. Operations for which state agencies are responsible that were previously handled by the agencies themselves have been centralised to state service centres in connection with service centre projects. The need for more standardised and comprehensive risk management has increased due to the centralisation. The risk management practices used by the agencies vary, however. The lack of standardisation in risk management may cause gaps in the protection of confidential information, for example. No information that supports the prioritisation of service protection in case of a comprehensive cyber security violation have been collected from central government services.

Lack of a “cyber culture” where agencies prioritize cybersecurity as an essential part of agency mission and operations. [Chief information security officers] considered this area as one of the most significant and challenging to implement overall. (…) agencies were left alone to develop and maintain their own cyber capabilities, despite other agencies across the government sharing the same objectives. (…) The order requires leadership and oversight agencies to collaborate with agency heads to enact several of its requirements, such as the implementation of multifactor authentication and encryption, and appropriate processing and storage solutions for each agency’s sensitive data.
CYBERSECURITY: Implementation of Executive Order Requirements Is Essential to Address Key Actions GAO - USA 2024

The Cabinet Office does not collect or analyse government’s performance in protecting information on a routine basis. This means it has little visibility of information risks in departments and has limited oversight of the progress departments are making to better protect their information. Reporting personal data breaches is chaotic, with different mechanisms making departmental comparisons meaningless
Protecting information across government NAO - UK 2016