Source · Select Committees · Public Accounts Committee
Recommendation 28
28
Accepted
Departments lack resources and oversight to ensure cyber resilience across wider public sector.
Recommendation
Departments, arm’s–length bodies and their partners use a wide range of IT systems and technology to provide public services.63 The Government Cyber Security Strategy: 2022–2030 (‘the Strategy’) set out that government departments’ cyber responsibilities included ensuring their arm’s–length bodies and wider public sector meet resilience targets. In April 2024, the Cabinet Office reported it could not be confident that departments were meeting these responsibilities. Departments reported that they did not have enough funding, people, or oversight to understand and improve resilience across their sectors.64
Government Response Summary
The government agrees to the recommendation by Spring 2026, committing DSIT to clearly outline and enforce departmental responsibility for ALB cyber security and digital resilience, including requiring assurance data. The Digital Commercial Centre of Excellence will also reform procurement processes, and DSIT will support supply chain risk management by embedding contractual requirements and setting higher expectations for suppliers.
Government Response
Accepted
HM Government
Accepted
5.1 The government agrees with the Committee’s recommendation. Target implementation date: Spring 2026 5.2 The government recognises the importance of managing the risk in ALBs and their supply chains. Whilst services can and in many cases should be outsourced from lead government departments, they are still ultimately accountable for the risk and must build in mechanisms to manage this. 5.3 DSIT will clearly outline departmental responsibility for the cyber security and digital resilience of their arm’s-length bodies. This will build on and complement the accountabilities set out in ‘Government Security Policy: Security Functional Accountability’ published outside the public domain in October 2024. As part of the interventionist approach to cyber resilience referenced in the Blueprint, DSIT will assure and enforce that Accounting Officers are meeting this responsibility. 5.4 This more active role will see departments responsible for ensuring their associated arm’s-length bodies manage risk in accordance with the centrally set risk appetite. This will include returning assurance data from assurance methods such as GovAssure and Supplier Assurance. 5.5 The Digital Commercial Centre of Excellence will reform procurement processes and ensure clearer guidelines for departments. DSIT will support departments to manage their supply chain risks by embedding baseline contractual requirements into CCS frameworks, providing training and creating the mechanisms to join up between security and commercial teams. DSIT will use government’s buying power to set higher expectations of our strategic suppliers in terms of their cyber security practices and incident response processes.