Source · Select Committees · Public Accounts Committee
Recommendation 13
13
Accepted
Significant cyber security skill vacancies persist across central government departments.
Recommendation
In 2023–24, one in three cyber security roles in central government were vacant or filled by expensive contractors, and the proportion of vacancies in several departments’ cyber security teams was more than 50%.23 The Cabinet Office accepted that there were significant cyber–skill vacancies and set out the actions it was taking to address the shortfall.24 These included a cyber ‘fast stream’ and a ‘TechTrack’ apprenticeship programme to develop more talent within government. The Cabinet Office also told us about a new digital pay framework, which it had designed to allow departments to pay higher salaries to cyber professionals.25 In its letter to us, the Cabinet Office clarified that, for the first time since 2016, it was increasing the maximum amount that departments could pay civil servants in technical roles below the senior civil service grade, by £15,000. This means cyber professionals in government could earn up to £110,000 per annum.26 We pushed the Cabinet Office on government’s reluctance to pay market–rate salaries. The Cabinet Office agreed that paying higher salaries would still be cheaper than using contractors and could save money over the longer term, if it helped to reduce risk.27 19 C&AG’s Report, para 4.15 20 For example: Committee of Public Accounts, Defence Digital, Thirty–Sixth Report of Session 2022–23, HC 727, 3 February 2023; Committee of Public Accounts, BBC Digital, Forty–Sixth Report of Session 2022–23, HC 736, 28 April 2023; Committee of Public Accounts, Digital transformation of the NHS, Eighth Report of Session 2022–23, HC 223, 30 June 2023 21 Qq 12–13 22 Letter from the Civil Service Chief Operation Officer and Cabinet Office Permanent Secretary relating to the oral evidence session held on 10 March 2025 on Government Cyber Resilience, 24 March 2025 23 C&AG’s Report, para 4.15 24 Q 13 25 Q 12 26 Letter from the Civil Service Chief Operation Officer and Cabinet Office Permanent Secretary relating to the oral evidence session held on 10
Government Response Summary
The government agrees, aiming for implementation by Spring 2026, acknowledging the cyber skills gap. It commits to integrating relevant teams into DSIT by November 2025, continuing talent programmes, establishing a Cyber Resourcing Hub, and utilizing 2025 workforce data to set targets for filling vacancies.
Government Response
Accepted
HM Government
Accepted
2.1 The government agrees with the Committee’s recommendation. Target implementation date: Spring 2026 2.2 The government acknowledges the ongoing cyber skills gaps across the public sector and is taking active steps to implement reforms that address this challenge. As part of the announced Machinery of Government change, Cyber, Digital and Data teams focusing on capability and skills will be fully integrated in DSIT by November 2025. 2.3 The government is attracting and upskilling new cyber security talent into government, through several comprehensive talent programmes including the Cyber Fast Stream, Cyber apprenticeships and the Government Cyber Skills Academy. 2.4 Through a new Cyber Resourcing Hub, government is creating a clearer and stronger government employer value proposition to attract candidates within a competitive market and streamlining the recruitment process. 2.5 As part of work to deliver the Government Cyber Skills Strategy, DSIT will continue to work with departments to understand their cyber skills gap and the local action departments are taking to address this. 2.6 2025 workforce data will be utilised to identify cyber vacancies in government and support departments’ plans on how they can fill these vacancies through current programmes and initiatives. 2.7 Early next year, DSIT will set how many of the anticipated cyber vacancies in government its central initiatives will address and how it will assist departments in their efforts to fill the remaining workforce gaps.