Connected tech cybersecurity standards

#19 —

Defence Committee

Recommendation: Within a year the government should set out how it will robustly test and validate the Hybrid Navy’s principal uncrewed systems in High North conditions before they are relied upon for Atlantic Bastion or other operational tasks. This should include …

Report: Government response awaited

#37 —

Defence Committee

Recommendation: The UK’s AI-enabled defence systems will be most effective if they are interoperable with those of its allies. This will require dialogue between allies to ensure that systems are designed with compatibility in mind. Interoperability will be more easily achieved …

Report: Government response published

#43 —

Business, Innovation, Science and Trade Committee

Recommendation: We recommend that the Government introduce legislation that would mandate the standards set out in its Software Security Code of Practice. Enforcement agencies should be empowered to monitor compliance, and levy penalties against firms that do not adhere to these …

Report: No government response linked; deadline passed

#42 —

Business, Innovation, Science and Trade Committee

Recommendation: The Government’s Software Security Code of Practice is a useful first step in encouraging the take up of “secure by design” principles amongst software providers. Compliance with these principles, however, should be the minimum standard rather than a voluntary extra. …

Report: No government response linked; deadline passed

#78 —

International Relations and Defence Committee

Recommendation: There have been several unattributed incidences of damage to subsea infrastructure in the Arctic. In November 2021, the Lofoten-Vesterålen Ocean observatory, an underwater facility in northern Norway, was put out of service after more than 4.3km of its specially designed …

Report: Government response published

#77 —

International Relations and Defence Committee

Recommendation: In 2017, then-Chief of Defence Staff Air Chief Marshal Sir Stuart (now Lord) Peach stated that Russia’s unconventional warfare capabilities were creating “a new risk to our prosperity and way of life” through the potential exploitation of “the vulnerability of …

Report: Government response published

#76 —

International Relations and Defence Committee

Recommendation: Russia has developed a range of capabilities to sabotage and disrupt critical infrastructure, including undersea data cables in the Arctic and further afield. The specialised capabilities for deep-sea maritime sabotage are based on the Kola Peninsula in the Arctic. 89

Report: Government response published

#5 —

International Relations and Defence Committee

Recommendation: Close co-operation between the state and the private sector, which operates most subsea cables and pipelines, is key to deterring threats to critical infrastructure. The UK Government should establish partnerships for working with businesses to combat threats to critical infrastructure.

Report: Government response published

#30 —

Communications and Digital Committee

Recommendation: There is a credible security risk from the rapid and uncontrollable proliferation of highly capable openly available models which may be misused or malfunction. Banning them entirely would be disproportionate and likely ineffective. But a concerted effort is needed to …

Report: Government response published

#24 —

Communications and Digital Committee

Recommendation: The Government should work with industry at pace to scale existing mitigations in the areas of cyber security ( including systems vulnerable to voice cloning), child sexual abuse material, counter-terror, and counter-disinformation. It should set out progress and future plans …

Report: Government response published

#23 —

Communications and Digital Committee

Recommendation: The most immediate security concerns from LLMs come from making existing malicious activities easier, rather than qualitatively new risks.

Report: Government response published

#22 —

Communications and Digital Committee

Recommendation: We recommend that the Government explores the options for and feasibility of acquiring a sovereign LLM capability. No option is risk free, though commissioning external developers might work best. Any public sector capability would need to be designed to the …

Report: Government response published

#21 —

Communications and Digital Committee

Recommendation: We do not recommend using an ‘off the shelf’ LLM or developing one from scratch: the former is too risky and the latter requires high-tech R&D efforts ill-suited to Government. But commissioning an LLM to high specifications and running it …

Report: Government response published

#20 —

Communications and Digital Committee

Recommendation: A sovereign UK LLM capability could deliver substantial value if challenges around reliability, ethics, security and interpretability can be resolved. LLMs could in future benefit central departments and public services for example, though it remains too early to consider using …

Report: Government response published

#62 —

International Relations and Defence Committee

Recommendation: The reliance of modern economies on space-based technologies makes them a prime target for hybrid attacks. Cyber and electronic tactics deployed in Ukraine by Russia have been used elsewhere, including against the UK and its allies. It is therefore essential …

Report: Government response published

#60 —

International Relations and Defence Committee

Recommendation: The Government should ensure that cyber, EW and emerging technologies are fully integrated into the next edition of the Defence and Security Industrial Strategy. In addition, it should give serious consideration to the creation of a warfare centre for the …

Report: Government response published

#21 —

International Relations and Defence Committee

Recommendation: There are risks attached to increasing collaboration with commercial partners who, traditionally, have not been involved in defence. The new Government will need to be alert to these risks and work to mitigate them. In particular, the Government should conduct …

Report: Government response published

#23 —

International Agreements Committee

Recommendation: In the light of the mixed evidence that we received, we recommend that the Government undertake a comprehensive review of the use of source code provisions in trade agreements, particularly focusing on the exceptions to the ban on disclosures.

Report: Government response published

#102 —

Financial Services Regulation Committee

Recommendation: Several witnesses highlighted the success of the FCA’s Regulatory Sandbox in allowing firms to develop new products in a closely supervised environment and recommended that the FCA build on this success. 164 TheCityUK told us that: “The FCA’s sandbox has …

Report: Government response published

#101 —

Financial Services Regulation Committee

Recommendation: Witnesses also highlighted a range of ways through which the FCA and the PRA could facilitate innovation by creating a regulatory environment that is supportive of new technologies, and in which firms could safely develop new products and approaches.

Report: Government response published

#98 —

Financial Services Regulation Committee

Recommendation: A number of witnesses referenced the FCA’s approach to regulating digital assets. Charles McManus, Chief Executive Officer of ClearBank, highlighted that the opportunities offered by fund tokenisation and digitalisation are significant, citing the example of global stablecoin valuations which stood …

Report: Government response published

#96 —

Financial Services Regulation Committee

Recommendation: We received evidence that the regulators themselves cannot drive innovation but can facilitate it by providing the latitude and regulatory frameworks that firms need to innovate. Sandra Boss, Chair of BlackRock UK, told us: “It is important to understand that …

Report: Government response published

#95 —

Financial Services Regulation Committee

Recommendation: We received evidence on the importance of innovation as a facet of international competitiveness and a driver of growth in the financial services sector. In particular, innovation is central to the UK’s world-leading fintech sector. Janine Hirt, Chief Executive Officer …

Report: Government response published

#27 —

Defence Committee

Recommendation: The UK market for vendors is far from satisfactory. Whilst this reflects a wider consolidated ecosystem of global 5G vendors action must now be taken to ensure that 5G is in a more secure position in the years to come.

Report: Government response published

#23 —

Defence Committee

Recommendation: Global standards are key to 5G and future telecommunications networks. China has been very active in the standard setting bodies whilst the UK and allies have stood back. This is not satisfactory. The UK should take a leadership role in …

Report: Government response published

#19 —

Defence Committee

Recommendation: Pressure has been exerted by China on the UK Government to retain the presence of Huawei in its 5G infrastructure through both covert and overt threats. More recently, following the Government’s announcement for the long-term withdrawal of Huawei from its …

Report: Government response published

#16 —

Defence Committee

Recommendation: In the end, the Government decision was taken because of the technical considerations resulting from sanctions; however the Government should have considered the potential damage to key alliances enough of a risk to begin to remove Huawei from the UK’s …

Report: Government response published

#15 —

Defence Committee

Recommendation: The framing of the issue by the United States as a technical concern about the presence of Huawei in our networks has generated disagreement between the two Governments, given the contrasting conclusions of technical experts on either side of the …

Report: Government response published

#2 —

Defence Committee

Recommendation: We share the Government’s objective that the UK remains at the forefront of the 5G rollout as we move into the next technological era. It is imperative that the UK is amongst the first countries to benefit from the technological …

Report: Government response published

#13 — Require providers to adopt network, storage, and cloud security standards for connected tech.

Digital, Culture, Media and Sport Committee

Recommendation: Improving cybersecurity of consumer connected devices is an important and positive step, but the proliferation of connected tech in enterprise settings and the gap in the regime regarding network, storage and cloud security still present likely attack vectors that will …

Report: Government response published

#14 — Recommend successor Committee examine 5G Supply Chain Diversification, international standards, and technology rollout.

Science and Technology Committee (Commons)

Recommendation: Should our successor Committee wish to examine the UK’s telecommunications infrastructure and domestic capability, we recommend it considers: • The implementation of the 5G Supply Chain Diversification Strategy, and relevant policy and technical developments since the then Committee’s report; • …

Report: No government response linked; deadline passed

#36 — HMRC acknowledges legacy IT systems and poor data management hinder AI adoption and increase cyber risks.

Public Accounts Committee

Recommendation: We asked HMRC whether the age of some of its IT systems were going to make it more difficult to adopt AI. HMRC agreed and considers the “critical thing with AI is making sure you really have a handle on …

Report: Government response published

#31 — HMRC acknowledges security concerns with third-party Making Tax Digital software, setting strict specifications.

Public Accounts Committee

Recommendation: We asked HMRC whether there were potential security concerns that could be posed by the third–party MTD software taxpayers use to submit their tax returns, including whether there were risks to HMRC’s own systems.63 In written evidence provided after our …

Report: Government response published

#26 — Prioritise introducing secure digital channels for customers to submit files and messages.

Public Accounts Committee

Recommendation: Last year HMRC acknowledged that is behind many other organisations in enabling customers to communicate securely through digital channels. In 2022–23, approximately 70% of the 22 million items of correspondence HMRC received came in through the post. In January 2025 …

Report: Government response published

#24 — HMRC’s legacy IT systems pose security, reliability, and cost risks.

Public Accounts Committee

Recommendation: HMRC explained that there are three key risks that arise from operating legacy systems: lower levels of security; lower reliability and resilience; and higher costs of system changes. HMRC said that its executive team and its digital team track how …

Report: Government response published

#26 — Balance digital trade and AI growth with strong protections for UK standards and industries.

Business, Innovation, Science and Trade Committee

Recommendation: Looking ahead, future commitments in the potential Economic Prosperity Deal must balance opportunities for growth in digital trade, AI, and services with strong protections for UK standards, tax sovereignty, and critical domestic industries. (Recommendation, Paragraph 141) 56

Report: Government response published

#21 — Strike balance in digital trade to promote AI while safeguarding UK sovereign capabilities.

Business, Innovation, Science and Trade Committee

Recommendation: Any future digital trade provisions negotiated under the Economic Prosperity Deal should strike a careful balance: promoting AI adoption and cross-border collaboration to strengthen the Western technological 55 alliance, while safeguarding intellectual property, ensuring fair taxation, and enabling the development …

Report: Government response published

#18 —

Defence Committee

Recommendation: Uncrewed systems could help the Royal Navy generate the mass and persistence needed for sustained operations in the High North, the North Atlantic and around critical undersea infrastructure. They could be especially valuable for surveillance, anti-submarine sensing and seabed protection, …

Report: Government response awaited

#38 —

Defence Committee

Recommendation: The Government should convene a programme of discussions with the UK’s AUKUS and NATO allies aimed at reaching a mutual understanding of each other’s AI objectives and strategies. These discussions should also explore reaching, where possible, common positions and standards …

Report: Government response published

#45 —

Business, Innovation, Science and Trade Committee

Recommendation: The Government should amend the capital allowances regime to allow businesses to claim tax relief on subscription-based IT services that directly enhance operational resilience, such as cybersecurity software, legacy system upgrades, business continuity platforms and data protection solutions. A consultation …

Report: No government response linked; deadline passed

#92 —

International Relations and Defence Committee

Recommendation: The Tony Blair Institute told us that state collaboration with major tech companies would be key for internet resilience in the Arctic and beyond. They recommended that the UK should support investment in alternative Arctic infrastructure. The UK could also …

Report: Government response published

#10 —

National Security Strategy (Joint Committee)

Recommendation: Cyber insurance can provide a vital lifeline for ransomware victims, offering the sort of support and technical advice not offered by state agencies, as well as driving up cyber security standards through conditions of coverage. Unfortunately, there remains a woeful …

Report: Government response published

#1 —

National Security Strategy (Joint Committee)

Recommendation: A major ransomware attack could have a devastating impact on UK citizens and the economy, and undoubtedly represents a major threat to UK national security. A sophisticated ransomware ecosystem has evolved, with criminals able to purchase advanced forms of malware …

Report: Government response published

#64 —

International Relations and Defence Committee

Recommendation: The new Government should also invest in Space Situational Awareness and Space Domain Awareness capabilities, for which it heavily relies on the US.

Report: Government response published

#51 —

International Relations and Defence Committee

Recommendation: The UK should invest in research and development to maintain a strategic edge in drone technology (including amphibious drones), and support the rapid development of new technologies that can compete in contested environments. Given the pace of technological adaptations on …

Report: Government response published

#25 —

International Agreements Committee

Recommendation: We welcome the positive impact the Electronic Trade Documents Act has had for trading businesses, and encourage the Government to cooperate with partners, including through the G7 and G20, to support wider implementation of similar legal frameworks.

Report: Government response published

#24 —

Human Rights (Joint Committee)

Recommendation: The recent OpenAI/Hugging Face security incident starkly highlights the societal risks posed by the growing power of AI systems. It illustrates how the newest AI models can engage in activities that would be unlawful if undertaken by a legal person, …

Report: Government response awaited

#20 —

Transport Committee

Recommendation: We recommend that the government consult within the next 12 months on introducing mandatory in-vehicle CCTV, with a view to including this requirement within national standards if it is sufficiently supported by evidence. The consultation should also seek views on …

Report: Government response published

#16 —

National Security Strategy (Joint Committee)

Recommendation: Emergency services should ensure their business continuity plans highlight any areas of critical reliance on foreign internet servers, and account for temporary internet disruption in the event of a security crisis. (Recommendation, Paragraph 100) Legal Responses

Report: Government response published

#6 —

National Security Strategy (Joint Committee)

Recommendation: The National Protective Security Authority (NPSA) and National Cyber Security Centre should require all UK landing stations to be target-hardened to sufficient levels to deter state-backed sabotage. They should require landing station operators to develop within 12 months an emergency …

Report: Government response published