Recommendation 30

We asked the Cabinet Office how Government managed the cyber security of its supply chain. The Cabinet Office told us that managing supply chain risk was complex and difficult. Government’s supply chain has been the source of incidents with serious consequences for individuals, such as the ransomware attack on the supplier of NHS pathology services, Synnovis. The Cabinet Office set out to us the actions it was taking improve its management of supply chain risk. It was creating schedules that departments could include in future contracts to ensure they were asking their suppliers for the right security measures. The Cabinet Office planned to work with strategic suppliers in 2025–26 to agree objectives for how they will help government improve its cyber resilience. DSIT and the Cabinet Office cited the example of a partnership agreement with Microsoft.66