Source · Select Committees · Public Accounts Committee
Recommendation 20
20
GovAssure reveals significant gaps and low maturity in departmental cyber resilience.
Conclusion
In 2023, the Cabinet Office launched ‘GovAssure’, a cyber security assurance scheme, as part of its strategy to improve government organisations’ cyber resilience. Before GovAssure, departments self–assessed their performance against minimum cyber standards set by the Cabinet Office.43 In the period April 2023 to July 2024, 35 departments took part in the first year of GovAssure and assessed 72 IT systems, of which independent reviewers verified 58. The GovAssure data showed that there were significant gaps in departments’ cyber resilience, including low levels of maturity across asset management, protective monitoring, and response planning.44
Government Response
A response document is linked to this report, dated 18 September 2025. Response attribution to this conclusion has not been verified. Read the response document ↗