Select committee: Public Accounts Committee
Recommendation 6
24th Report - Government cyber resilience
Published 9 May 2025
Addressed to HM Treasury
Public Accounts Committee Government cyber resilience All items in this report Report on parliament.uk ↗ Inquiry on parliament.uk ↗
Recommendation (the committee's words)
Government’s work to date has not been sufficient to make it resilient to cyber attack by 2025, and meeting its 2030 aim to make the wider public sector cyber resilient will require a fundamentally different approach. The Cabinet Office’s focus on implementing its initiatives, such as GovAssure, has been at the expense of it coordinating a cross–government plan that challenges departments to meet their cyber resilience targets. The cyber risk to government is now extremely high and the Cabinet Office does not expect to meet its aim for “government’s critical functions to be significantly hardened to cyber attack by 2025”. Its aim for the whole of government and the wider public sector to be “resilient to known vulnerabilities and attack methods no later than 2030” is very ambitious. This is only achievable if government moves further and faster than it has before. The Cabinet Office assured us it is planning to take a fundamentally different approach for how it operates in future. It is reassuring that the Cabinet Office is learning from the experience of Australia, Canada and other international governments as it designs its new approach to improving government’s cyber security and resilience. We would welcome the greater transparency on public sector resilience levels that the Australian Government has used successfully to improve accountability. recommendation Following the conclusion of the 2025 Spending Review, the Cabinet Office should set out what levers and instruments the centre of government will use to take a fundamentally different approach to cyber resilience. 6 1 The challenge of cyber resilience in Government Introduction
From: Public Accounts Committee, 24th Report - Government cyber resilience (HC 643), 9 May 2025
Government response
Latest Treasury Minutes progress report to the Committee of Public Accounts on the Twenty-fourth Report of Session 2024-26
The government responded to the whole report on 4 June 2026.
Treasury minutes: Government response to the Committee of Public Accounts on the Twenty-fourth report from Session 2024-26
Published 18 September 2025.
Summary written by Accountability Index from the government's response. It is not the government's own words.The government "agrees with the Committee's recommendation" in each of the six areas, setting target implementation dates between winter 2025 and autumn 2026.
- On the evolving threat, the government agrees, notes responsibility has moved to DSIT, and says DSIT will publish an implementation plan in winter 2025 and write to the Committee "in one year's time".
- On cyber skills, it "acknowledges the ongoing cyber skills gaps" and says that "Early next year" DSIT will set how many anticipated vacancies its central initiatives will address and how it will assist departments with the remaining gaps.
- On accountability and funding, DSIT will set expectations for departments to appoint a board member with cyber security and digital resilience expertise, and is "working with HMT on mechanisms for protecting budgets" for cyber and legacy remediation programmes.
- On arm's-length bodies and supply chains, it says departments remain "ultimately accountable for the risk" and that DSIT will "assure and enforce" that Accounting Officers are meeting this responsibility.