Source · Select Committees · Public Accounts Committee
Recommendation 29
29
Accepted
Departmental commitment to wider public sector cyber resilience strategy shows inconsistent implementation.
Conclusion
The Cabinet Office confirmed to us that lead government departments were responsible for understanding and tackling cyber risk across the wider public sector. While recognising that departments’ response to the Strategy 56 Q 49 57 Qq 50–51 58 Q 53 59 Qq 54, 57–58 60 Q 58 61 Q 56 62 Q 80 63 C&AG’s Report, para 11 64 C&AG’s Report, para 4.5; The Cabinet Office, Government Cyber Security Strategy: 2022–2030, January 2022 16 had been “varying”, the Cabinet Office focused on the Department of Health and Social Care (DHSC) as a positive example. It told us that DHSC had set a clear cyber security strategy for health and social care that linked to the Cabinet Office’s own strategy. The Cabinet Office said that by strengthening assurance processes, putting in place policies, and investing in common services, DHSC had started to improve its sector’s resilience.65
Government Response Summary
The government agrees and DSIT will clearly outline departmental responsibility for cyber resilience in arm’s-length bodies (ALBs), enforce accountability, ensure ALBs manage risk and report data. The Digital Commercial Centre of Excellence will reform procurement, and DSIT will support departments in managing supply chain risks and setting higher expectations for strategic suppliers.
Government Response
Accepted
HM Government
Accepted
5.1 The government agrees with the Committee’s recommendation. Target implementation date: Spring 2026 5.2 The government recognises the importance of managing the risk in ALBs and their supply chains. Whilst services can and in many cases should be outsourced from lead government departments, they are still ultimately accountable for the risk and must build in mechanisms to manage this. 5.3 DSIT will clearly outline departmental responsibility for the cyber security and digital resilience of their arm’s-length bodies. This will build on and complement the accountabilities set out in ‘Government Security Policy: Security Functional Accountability’ published outside the public domain in October 2024. As part of the interventionist approach to cyber resilience referenced in the Blueprint, DSIT will assure and enforce that Accounting Officers are meeting this responsibility. 5.4 This more active role will see departments responsible for ensuring their associated arm’s-length bodies manage risk in accordance with the centrally set risk appetite. This will include returning assurance data from assurance methods such as GovAssure and Supplier Assurance. 5.5 The Digital Commercial Centre of Excellence will reform procurement processes and ensure clearer guidelines for departments. DSIT will support departments to manage their supply chain risks by embedding baseline contractual requirements into CCS frameworks, providing training and creating the mechanisms to join up between security and commercial teams. DSIT will use government’s buying power to set higher expectations of our strategic suppliers in terms of their cyber security practices and incident response processes.