Recommendation 26

We pressed DSIT and the Cabinet Office on why Government’s understanding of its legacy IT was so limited. They told us that the amount of legacy systems, and understanding of them, varied between departments. They said this was because information about legacy systems 48 Q 39 49 Qq 41–42 50 Q 43 51 C&AG’s Report, para 1.3 52 C&AG’s Report, para 3.5 53 Q 47; Letter from the Civil Service Chief Operation Officer and Cabinet Office Permanent Secretary relating to the oral evidence session held on 10 March 2025 on Government Cyber Resilience, 24 March 2025 54 Q 47 55 Q 49; Department for Science, Innovation & Technology, State of digital government review, January 2025 15 was not easy to access and was spread across arm’s–length and other public bodies. The Cabinet Office agreed there was an unacceptable gap in knowledge about government’s legacy IT.56 We asked why departments could not provide a list of the systems they have. We heard that data were in different formats across departments and poor asset management meant departments could not easily collate this data.57 DSIT told us that departments and the centre of government had limited resource to understand and fix legacy systems.58