Source · Select Committees · Public Accounts Committee
Recommendation 21
21
UKRI's outdated legacy systems pose an increased cyber security risk to government operations.
Recommendation
As we have reported before, one of the most serious risks to all parts of Government and industry is large-scale-assaults on their cyber security defences and ensuring their resilience against such attacks. Outdated legacy systems, such as those at UKRI, increase the cyber risk to government.53 UKRI told us it takes cyber seriously and its updated systems have been designed with “cyber in mind from the beginning”, and that it runs continual cyber and phishing awareness training with staff.54 46 Q 20 47 C&AG’s Report, para 1.28 48 C&AG’s Report, para 1.29 49 Q 41 50 Qq 41-42 51 Q 43, C&AG’s Report, para 1.28 52 Q 54 53 Committee of Public Accounts, Government cyber resilience, Twenty-Fourth Report of Session 2024–25, HC 643, May 2025 54 Q 57 14 3 Risk and reward Portfolio approach to risk management
Government Response
A response document is linked to this report, dated 15 October 2025. Response attribution to this conclusion has not been verified. Read the response document ↗