Recommendation 29

The Cabinet Office confirmed to us that lead government departments were responsible for understanding and tackling cyber risk across the wider public sector. While recognising that departments’ response to the Strategy 56 Q 49 57 Qq 50–51 58 Q 53 59 Qq 54, 57–58 60 Q 58 61 Q 56 62 Q 80 63 C&AG’s Report, para 11 64 C&AG’s Report, para 4.5; The Cabinet Office, Government Cyber Security Strategy: 2022–2030, January 2022 16 had been “varying”, the Cabinet Office focused on the Department of Health and Social Care (DHSC) as a positive example. It told us that DHSC had set a clear cyber security strategy for health and social care that linked to the Cabinet Office’s own strategy. The Cabinet Office said that by strengthening assurance processes, putting in place policies, and investing in common services, DHSC had started to improve its sector’s resilience.65