Select committee: Public Accounts Committee
Recommendation 13
24th Report - Government cyber resilience
Published 9 May 2025
Addressed to HM Treasury
Public Accounts Committee Government cyber resilience All items in this report Report on parliament.uk ↗ Inquiry on parliament.uk ↗
Recommendation (the committee's words)
In 2023–24, one in three cyber security roles in central government were vacant or filled by expensive contractors, and the proportion of vacancies in several departments’ cyber security teams was more than 50%.23 The Cabinet Office accepted that there were significant cyber–skill vacancies and set out the actions it was taking to address the shortfall.24 These included a cyber ‘fast stream’ and a ‘TechTrack’ apprenticeship programme to develop more talent within government. The Cabinet Office also told us about a new digital pay framework, which it had designed to allow departments to pay higher salaries to cyber professionals.25 In its letter to us, the Cabinet Office clarified that, for the first time since 2016, it was increasing the maximum amount that departments could pay civil servants in technical roles below the senior civil service grade, by £15,000. This means cyber professionals in government could earn up to £110,000 per annum.26 We pushed the Cabinet Office on government’s reluctance to pay market–rate salaries. The Cabinet Office agreed that paying higher salaries would still be cheaper than using contractors and could save money over the longer term, if it helped to reduce risk.27 19 C&AG’s Report, para 4.15 20 For example: Committee of Public Accounts, Defence Digital, Thirty–Sixth Report of Session 2022–23, HC 727, 3 February 2023; Committee of Public Accounts, BBC Digital, Forty–Sixth Report of Session 2022–23, HC 736, 28 April 2023; Committee of Public Accounts, Digital transformation of the NHS, Eighth Report of Session 2022–23, HC 223, 30 June 2023 21 Qq 12–13 22 Letter from the Civil Service Chief Operation Officer and Cabinet Office Permanent Secretary relating to the oral evidence session held on 10 March 2025 on Government Cyber Resilience, 24 March 2025 23 C&AG’s Report, para 4.15 24 Q 13 25 Q 12 26 Letter from the Civil Service Chief Operation Officer and Cabinet Office Permanent Secretary relating to the oral evidence session held on 10
From: Public Accounts Committee, 24th Report - Government cyber resilience (HC 643), 9 May 2025
Government response
Latest Treasury Minutes progress report to the Committee of Public Accounts on the Twenty-fourth Report of Session 2024-26
The government responded to the whole report on 4 June 2026.
Treasury minutes: Government response to the Committee of Public Accounts on the Twenty-fourth report from Session 2024-26
Published 18 September 2025.
Summary written by Accountability Index from the government's response. It is not the government's own words.The government "agrees with the Committee's recommendation" in each of the six areas, setting target implementation dates between winter 2025 and autumn 2026.
- On the evolving threat, the government agrees, notes responsibility has moved to DSIT, and says DSIT will publish an implementation plan in winter 2025 and write to the Committee "in one year's time".
- On cyber skills, it "acknowledges the ongoing cyber skills gaps" and says that "Early next year" DSIT will set how many anticipated vacancies its central initiatives will address and how it will assist departments with the remaining gaps.
- On accountability and funding, DSIT will set expectations for departments to appoint a board member with cyber security and digital resilience expertise, and is "working with HMT on mechanisms for protecting budgets" for cyber and legacy remediation programmes.
- On arm's-length bodies and supply chains, it says departments remain "ultimately accountable for the risk" and that DSIT will "assure and enforce" that Accounting Officers are meeting this responsibility.