Protecting Information Across Government inquiry
Closed
What the inquiry looked at
“Protecting information while re-designing public services and introducing the technology necessary to support them is an increasingly complex challenge. The Cabinet Office has not yet established a clear role for itself in coordinating and leading departments' efforts to protect their information, according to a report by the National Audit Office (NAO). National Audit Office report The NAO report found that the Cabinet Office ambition to undertake such a role is weakened by the limited information which departments collect on their security costs, performance and risks. It also notes, however, that the UK Government has a strong international reputation in some areas of information security and digital government. Protecting the information departments hold from unauthorised access or loss is a critical responsibility for departmental accounting officers. Departments are, however, increasingly required to balance this responsibility with the need to make this information available to other public bodies, delivery partners, service users and citizens via new digital services. And increasing dependencies between central government and the wider public sector mean that the traditional security boundaries have become blurred. According to the NAO, too many bodies with overlapping responsibilities operate in the centre of government, confusing departments about where to go for advice. As at April 2016, at least 12 separate teams or organisations in the centre of government had a role in protecting information, many of whom produce guidance. While the new National Cyber Security Centre (NCSC) will bring together much of government’s cyber expertise, in the NAO's view, wider reforms will be necessary to further enhance the protection of information.”
The committee's words, from the inquiry page on parliament.uk ↗.
What it found
Well documented data security breaches at Tesco, Northern Lincolnshire and Goole NHS Trust, Sage, and TalkTalk have recently thrown the challenge of protecting information into the spotlight. The threat from cyber attacks has been one of the UK’s top four risks to national security since 2010, yet it has taken the Government too long to consolidate and co-ordinate its ‘alphabet soup’ of agencies involved in protecting Britain in cyberspace. The Cabinet Office’s role in protecting information remains unclear within central government, and there appears to be no coordination across the wider public sector. There is little oversight of the costs and performance of government information assurance projects, and processes for recording departmental personal data breaches are inconsistent and dysfunctional. Poor reporting of low level breaches, such as letters containing personal details being addressed to the wrong person, reduces our confidence in the Cabinet Office’s ability to protect the nation from higher threat cyber attacks. The use of the internet for cyber crime is evolving fast and the government faces a real struggle to find enough public sector employees with the skills to match the pace of change.
What the government said
No government response is linked to this report.
How the inquiry ran
Each dot is a dated item listed on this page, from the inquiry's opening on 18 October 2016 to its close on 4 January 2018.
- Oral evidence 14 Nov 2016
- Report 3 Feb 2017
What it recommended
The committee's recommendations are not listed here yet. Read them in 38th Report - Protecting information across government ↗ on parliament.uk.
Evidence
Oral evidence sessions 1
- 14 Nov 2016No witnesses recordedparliament.uk ↗