Source · Select Committees · Public Accounts Committee
Recommendation 7
7
Accepted
Legacy IT systems pose significant risks to government AI adoption and cybersecurity.
Conclusion
DSIT told us that it was a matter of urgency that the issue of legacy systems in government is addressed, not only to take advantage of the opportunities offered by AI, but also to address other risks including cyber security vulnerabilities. It emphasised prioritising the “systems that have the most valuable data” and “the highest levels of security vulnerability”.9 It added 4 C&AG’s Report, para 2 and Figure 1; DSIT, A blueprint for modern digital government, January 2025 5 Committee of Public Accounts, Use of AI in Government- Written evidence 6 Qq 18, 22 7 DSIT, State of digital government review, January 2025, pp 5, 17 8 Q 44; CDDO, Transforming for a digital future: 2022 to 2025 roadmap for digital and data, updated September 2023 9 Q 50 10 that this was both a software and hardware problem.10 However, it also warned that there is no magic bullet, it will take hard work over a long time to fix, and acknowledged that it needed to get a better grip on the issue.11 Concerning hardware, DSIT emphasised the importance of cloud services as a way for government to move away from maintaining large data centres, although we note in this case the potential trade–off between concentrating usage to achieve greater value for money and diversifying providers to seek greater resilience and security.12 As part of our inquiry into Government cyber resilience, the Cabinet Office told us that “quite a lot of our legacy systems are operating off a very small number of cloud providers, and until you fix some of the legacy issues, it is very difficult to move off some of the cloud services that are there”.13 We will consider this issue further in later scrutiny.
Government Response Summary
DSIT, working with HMT, has conducted an assessment of proposals to address legacy IT and will use this to inform HMT's prioritisation of funding. GDS will also work with departments to ensure the highest risk systems receive the funding they need.
Government Response
Accepted
HM Government
Accepted
The government agrees with the Committee’s recommendation. Target implementation date: Winter 2025 1.2 The Department for Science, Innovation and Technology (DSIT) will carry out this work in two steps. Firstly, working with HM Treasury (HMT), DSIT has conducted an assessment of 2 all proposals submitted by departments as part of the spending review process that sought to address legacy Information Technology (IT). This has been used to conduct an initial prioritisation of the legacy systems that funding is being requested to remediate. This will now be used to inform HMT’s prioritisation of funding and help ensure that an ambitious approach to risk reduction is achieved. Secondly, the Government Digital Service (GDS) will continue to work directly with government departments through their business planning to ensure that the highest risk systems receive the funding they need and funding continues to be prioritised for this purpose.