Recommendation 4

The Government and the National Cyber Security Centre (NCSC)—the public- facing arm of GCHQ—have focused significant efforts on enhancing the UK’s cyber resilience, with particular attention paid to major operators of critical national infrastructure (CNI). Nevertheless, UK CNI remains vulnerable to a catastrophic ransomware attack, particularly in sectors in which investment in upgrading legacy infrastructure has been inadequate. Supply chains are also particularly vulnerable, and have been described by the NCA as the ‘soft underbelly’ of CNI. With different CNI operators sharing the same supplier, a single attack could also affect multiple sectors at once, with damaging and widespread consequences.