Source · Select Committees · Public Accounts Committee
Recommendation 21
21
Accepted
UKRI's outdated legacy systems pose an increased cyber security risk to government operations.
Recommendation
As we have reported before, one of the most serious risks to all parts of Government and industry is large-scale-assaults on their cyber security defences and ensuring their resilience against such attacks. Outdated legacy systems, such as those at UKRI, increase the cyber risk to government.53 UKRI told us it takes cyber seriously and its updated systems have been designed with “cyber in mind from the beginning”, and that it runs continual cyber and phishing awareness training with staff.54 46 Q 20 47 C&AG’s Report, para 1.28 48 C&AG’s Report, para 1.29 49 Q 41 50 Qq 41-42 51 Q 43, C&AG’s Report, para 1.28 52 Q 54 53 Committee of Public Accounts, Government cyber resilience, Twenty-Fourth Report of Session 2024–25, HC 643, May 2025 54 Q 57 14 3 Risk and reward Portfolio approach to risk management
Government Response Summary
The government accepts the recommendation, stating UKRI is overhauling its systems through organisational change programmes to enhance information security and has invested in data capabilities including a data warehouse. UKRI will provide an update on modernisation progress to the Committee by February 2026.
Government Response
Accepted
HM Government
Accepted
4.1 The government agrees with the Committee’s recommendation. Target implementation date: February 2026 4.2 UKRI’s organisational change programmes are overhauling its systems and processes to enhance grant administration, data quality, information security and to implement other essential improvements. 4.3 UKRI has been investing in improved data capabilities over the last five years and has undergone two internal audit reports noting the progress made. UKRI has developed a data warehouse, Databank, to provide a central repository for UKRI data that can be consolidated from multiple sources. As part of its organisational change approach, UKRI is producing prioritised roadmaps for investment in data and other essential improvements. 4.4 UKRI has re-contracted with its supplier for collecting research outcome data for the research councils, following market engagement and competitive open tender. The revised contract requires changes that we expect will drive improvements to the completeness, accuracy and detail of metadata captured via this process, while minimising administrative burden. Outputs are analysed annually and UKRI will demonstrate these improvements by September 2026. 4.5 UKRI’s in-house systems for processing grant funding applications allow scope to invest to take account of changing user needs over time. UKRI will maintain a careful balance between: a) harmonisation and simplification with a focus on the efficiency of operations both within UKRI and the organisations we fund, and b) the need for flexibility and innovation to maximise the effectiveness of the platform in supporting the best R&I outcomes. 4.6 UKRI will provide an update to the Committee in February 2026 on implementation progress of the wider organisational change programme and plans for further modernisation.