Government cybersecurity assurance
Robustness and oversight of cyber security assurance programs within government departments for critical systems.
Strongest theme matches
Mixed across source types and ranked by classifier confidence plus text match strength.
NAO recommendation
80match
Government cyber resilience
Government departments should urgently strengthen their own governance, accountability and reporting arrangements around cyber risk. In their annual security appraisal, accounting officers should assess their progress and performance in meeting the cyber security standards set out in Functional Standard GovS 007: Security (the Security Standard), which HM Treasury mandated in 2021. To show the importance of building a...
Matched on
terms: government
Committee recommendation
77match
#45 - 11th Report - Toward a new doctrine for economic security
The Government should amend the capital allowances regime to allow businesses to claim tax relief on subscription-based IT services that directly enhance operational resilience, such as cybersecurity software, legacy system upgrades, business continuity platforms and data protection solutions. A consultation on how this could best be achieved should be launched before the end of the year. (Recommendation, paragraph...
Matched on
terms: cybersecurity, government
Committee recommendation
74match
#22 - 7th Report - Financial resilience of government-sponsored museums and galleries
The Department assured us that it was now working closely with the organisations on how it can provide central advice on improving cyber-resilience and minimising the threat and impact of cyber-attacks. It highlighted the Government’s cyber action plan, which the Department for Science, Innovation and Technology published earlier this year, which it said was setting out a path...
Matched on
terms: government
Committee recommendation
74match
#24 - 1st Report - Rewiring the state: Delivering digital government
GDS should set up a Legacy Systems Taskforce with a remit to drive progress in remediating legacy systems across the public sector. It should be empowered to mandate action by departments and public sector bodies 53 where necessary. The taskforce should publish the results of the promised legacy mapping exercise in as transparent a form as possible given...
Matched on
terms: government
Committee recommendation
73match
#2 - Second Report - The Security of 5G
We share the Government’s objective that the UK remains at the forefront of the 5G rollout as we move into the next technological era. It is imperative that the UK is amongst the first countries to benefit from the technological advances that 5G will bring. The Government’s ambitions for the rollout of 5G are laudable and cybersecurity policy...
Matched on
terms: cybersecurity, government
NAO recommendation
72match
Financial modelling in government
h) work with departments, ALBs and other stakeholders such as the Quality Assurance Working Group on guidance and training to facilitate system-wide learning and improvement. This should include sharing good practice on how business-critical models are managed and practical advice on how to analyse and communicate uncertainty.
Matched on
terms: assurance, government
Committee recommendation
71match
#14 - First Report - A hostage to fortune: ransomware and UK national security
The National Audit Office (NAO) criticised previous delivery failures in cyber security in 2019, finding that the Government risked making the same mistakes with its subsequent National Cyber Strategy. The Government’s Performance Framework for the 2022 NCS appears to be a reasonably rigorous approach to monitoring delivery, but its latest Progress Report sheds little light on whether it...
Matched on
terms: government
Committee recommendation
70match
#50 - 1st Report - Rewiring the state: Delivering digital government
It would be irresponsible to roll out a digital ID built on the UK’s current digital infrastructure. The public sector holds citizens’ data on trust, and should therefore hold itself to a higher standard. The operational and security problems relating to the eVisa system, One Login’s temporary loss of certification against the government’s own digital identity framework, and...
Matched on
terms: government
Committee recommendation
70match
#23 - 1st Report - Rewiring the state: Delivering digital government
Legacy systems present huge efficiency, cost and security risks, and it is therefore deeply concerning that government still does not know the full scale of the problem. While it may be difficult for ministers to argue in favour of spending public funds on systems that still (just about) work, if legacy systems are not remediated, the government’s digital...
Matched on
terms: government
Committee recommendation
70match
#13 - 1st Report - Rewiring the state: Delivering digital government
GDS and the Cabinet Office should publish quarterly reports on departmental and public sector body progress against the information and data security metrics it has committed to, together with its published principles for securing data in public services. These disclosures should be accessible via a single, publicly available tracker. (Recommendation, Paragraph 48) 51
Matched on
terms: government
Committee recommendation
69match
#5 - First Report - A hostage to fortune: ransomware and UK national security
Unlike many areas of national resilience, the Government has imposed cyber resilience requirements on most CNI operators through the 2018 Network and Information System (NIS) regulations, and has also committed to imposing new 62 A hostage to fortune: ransomware and UK national security cyber resilience standards on CNI by 2025. There are significant issues with the implementation and...
Matched on
terms: government
Committee recommendation
69match
#13 - 4th Report – The National Security Strategy
The Government should clarify what will change for private sector Critical National Infrastructure operators as a result of the NSS and provisions of the Cyber Security and Resilience (Network and Information Systems) Bill. It should then work with those operators to identify what support will be needed for them to adapt to the new regime. (Recommendation, Paragraph 59)
Matched on
terms: government
Committee recommendation
66match
#38 - 1st Report - Rewiring the state: Delivering digital government
The government should publish the findings of its investigation into the October 2025 AWS outage and its impact on suppliers and departments. In its response to this report, it should detail the steps it is taking to ensure greater resilience across public sector cloud infrastructure. (Recommendation, Paragraph 110)
Matched on
terms: government
Committee recommendation
66match
#10 - 1st Report - Rewiring the state: Delivering digital government
Successive governments have made a series of promises designed to address the institutional failings outlined in the Information Security Review. Yet we remain concerned that the current government is not holding itself to, or delivering, the standards of information and data security needed to secure and maintain public trust. This failure threatens the government’s digital transformation ambitions, and...
Matched on
terms: government
Committee recommendation
66match
#9 - 1st Report - Rewiring the state: Delivering digital government
It is a fundamental duty of government, public sector bodies and bodies in receipt of public funds to keep safe the data they hold on citizens. This duty has not been consistently upheld in the UK for some time. An Information Security Review, whose existence was - seemingly unnecessarily - kept secret until our intervention, examined a series...
Matched on
terms: government
Committee recommendation
65match
#51 - 11th Report - Toward a new doctrine for economic security
The Government should establish a dedicated SME Resilience Fund, administered by the Department for Business and Trade, to target support at enhancing the cyber resilience of smaller businesses. This fund should integrate with the Government’s new Secure Innovation Reviews, by supporting businesses with the money required to make the improvements identified. (Recommendation, paragraph 171)
Matched on
terms: government
Committee recommendation
65match
#8 - First Report - A hostage to fortune: ransomware and UK national security
Many ransomware victims feel there is insufficient support from law enforcement or Government agencies, with limited state resources focused on the most critical organisations. For smaller organisations and those falling outside the boundaries of critical national infrastructure, the NCSC’s post-incident support appears limited to a list of approved cyber incident response companies, which may be beyond the financial...
Matched on
terms: government
Committee recommendation
65match
#7 - First Report - A hostage to fortune: ransomware and UK national security
Although we recognise the value of peer support, it should not have fallen to Redcar and Cleveland Council’s Leader to train other councils how to prevent and respond to cyber-attacks, following their own devastating attack in 2020. Local authorities are on the frontline of support for the most vulnerable in society. The Government needs to provide much more...
Matched on
terms: government
Committee recommendation
65match
#4 - First Report - A hostage to fortune: ransomware and UK national security
The Government and the National Cyber Security Centre (NCSC)—the public- facing arm of GCHQ—have focused significant efforts on enhancing the UK’s cyber resilience, with particular attention paid to major operators of critical national infrastructure (CNI). Nevertheless, UK CNI remains vulnerable to a catastrophic ransomware attack, particularly in sectors in which investment in upgrading legacy infrastructure has been inadequate....
Matched on
terms: government
Committee recommendation
65match
#2 - First Report - A hostage to fortune: ransomware and UK national security
Past attacks demonstrate that ransomware can cause severe disruption to the delivery of core Government services, including healthcare and child protection, as well as causing ongoing economic losses. Mass data loss from an attack can be irreversible, even when the ransom is paid. Given the damage wrought by these uncoordinated ransomware attacks, a coordinated and targeted attack has...
Matched on
terms: government
Committee recommendation
65match
#8 - Thirtieth Report - Challenges in implementing digital change
The risks associated with legacy systems include that they can be difficult and expensive to support, lack operational resilience for key government services, and be vulnerable to cyber-attack. This exposes government to what is likely to be an uncertain but high level of financial risk from potential operational and cyber-related incidents. Legacy systems need a significant level of...
Matched on
terms: government
Committee recommendation
65match
#2 - Recommend a trial of a centralised Secure Data Environment and simplify ethical governance
Should our successor Committee wish to explore the reform of the UK health data strategy, we recommend it considers: • Investigating the replication of the academic model of open and competitive funding to solve problems and develop Privacy Enhancing technologies (PETs) and other critical pieces of data infrastructure as an alternative to internal or contracted software development work;...
Matched on
terms: government
Committee recommendation
61match
#49 - 11th Report - Toward a new doctrine for economic security
The Government should urgently consider expanding the scope of reinsurance schemes such as Pool Re to support private markets which enhance business resilience, particularly in respect of cyber threats. (Recommendation, paragraph 165)
Matched on
terms: government
Committee recommendation
61match
#24 - First Report - A hostage to fortune: ransomware and UK national security
The Government’s response to ransomware is conducted partly through the National Cyber Force and the intelligence agencies, on which we can only access limited information. RUSI has argued that the UK intelligence community may not be sufficiently motivated or resourced to tackle ransomware, but it is vital that the NCA’s work is properly supplemented by the other agencies....
Matched on
terms: government
Committee recommendation
61match
#18 - First Report - A hostage to fortune: ransomware and UK national security
In line with many other aspects of cyber security, and to ensure that it is treated as a cross-government national security priority, responsibility for tackling ransomware should be transferred from the Home Office to the Cabinet Office, in partnership with the NCSC and NCA. It should also be overseen directly by the Deputy Prime Minister, as part of...
Matched on
terms: government
Committee recommendation
61match
#13 - First Report - A hostage to fortune: ransomware and UK national security
The Government has acknowledged that ransomware is the number one cyber security threat to the UK. It is therefore welcome that it has published an ambitious National Cyber Strategy (NCS), with some strong commitments on resilience and the cyber security of core Government functions, both of which are vital to defending the UK against ransomware. It is also...
Matched on
terms: government
Committee recommendation
61match
#11 - First Report - A hostage to fortune: ransomware and UK national security
Victims are currently disincentivised to report ransomware attacks, making it difficult to understand fully the nature and scale of the threat, and how best to tackle it. The Director General of the NCA has suggested that it would be unusual for the Government to require any victim of crime to report an attack—but there are usually greater incentives...
Matched on
terms: government
Committee recommendation
61match
#10 - First Report - A hostage to fortune: ransomware and UK national security
Cyber insurance can provide a vital lifeline for ransomware victims, offering the sort of support and technical advice not offered by state agencies, as well as driving up cyber security standards through conditions of coverage. Unfortunately, there remains a woeful lack of UK coverage: premiums are unaffordable for many organisations, and have increased drastically in recent years. There...
Matched on
terms: government
Committee recommendation
61match
#60 - 1st Report - Ukraine: a wake-up call
The Government should ensure that cyber, EW and emerging technologies are fully integrated into the next edition of the Defence and Security Industrial Strategy. In addition, it should give serious consideration to the creation of a warfare centre for the cyber and electromagnetic domain.
Matched on
terms: government
Committee recommendation
61match
#7 - Second Report - The Security of 5G
There is no doubt that Huawei’s designation as a high-risk vendor is justified. The Huawei Cyber Security Evaluation Centre has consistently reported on its low-quality products and concerning approach to software development, which has resulted in increased risk to UK operators and networks. The presence of Huawei in the UK’s 5G networks therefore poses a significant security risk...
Matched on
terms: government
Committee recommendation
57match
#43 - 11th Report - Toward a new doctrine for economic security
We recommend that the Government introduce legislation that would mandate the standards set out in its Software Security Code of Practice. Enforcement agencies should be empowered to monitor compliance, and levy penalties against firms that do not adhere to these rules. (Recommendation, paragraph 150)
Matched on
terms: government
Committee recommendation
57match
#27 - First Report - A hostage to fortune: ransomware and UK national security
There is a high risk that the Government will face a catastrophic ransomware attack at any moment, and that its planning will be found lacking. In 2020, this Committee examined the Government’s preparations for the Covid-19 pandemic, considering what it could teach us about how to prepare for a known risk with a high potential impact. We found...
Matched on
terms: government
Committee recommendation
57match
#22 - First Report - A hostage to fortune: ransomware and UK national security
The Government and NCSC’s approach to ransomware is often framed through the language of state threats. While we recognise that operators are often facilitated by the Russian harbour state, ransomware is primarily a problem of criminality for profit, rather than espionage or geopolitical sabotage. Through the 2021 Integrated Review and its 2023 Refresh, the Government has acknowledged that...
Matched on
terms: government
Committee recommendation
57match
#20 - First Report - A hostage to fortune: ransomware and UK national security
It is possible to infiltrate and disrupt ransomware groups’ infrastructure without arresting the criminals involved, sometimes even preventing attacks after the initial 66 A hostage to fortune: ransomware and UK national security infiltration has taken place. The NCA has some offensive capabilities, but it is vital that the UK is able to operate on a level footing with...
Matched on
terms: government
Committee recommendation
57match
#19 - First Report - A hostage to fortune: ransomware and UK national security
The National Crime Agency is locked in an uphill struggle against the ransomware threat, which is now so sophisticated that even the most highly-protected organisations expect to experience a ransomware attack. There is clear value in the Government’s resilience work, but it is vital that this is paired with further work to raise the costs for attackers, to...
Matched on
terms: government
Committee recommendation
57match
#15 - First Report - A hostage to fortune: ransomware and UK national security
It is potentially concerning that the Conflict, Stability and Security Fund (CSSF) has now been merged with the National Cyber Programme—which delivers aspects of the National Cyber Strategy—as part of the new Integrated Security Fund (ISF). We recognise that this could encourage a more integrated approach to the UK’s A hostage to fortune: ransomware and UK national security...
Matched on
classifier match
Committee recommendation
57match
#12 - First Report - A hostage to fortune: ransomware and UK national security
While the Government maintains that UK victims should not pay ransoms, it is the only viable option for many of those directly affected, enabling them to keep their businesses afloat and prevent damaging leaks of personal data. Too many organisational leaders are left to face this moral dilemma alone, without any state intervention. The NCSC must produce more...
Matched on
terms: government
Committee recommendation
57match
#3 - First Report - A hostage to fortune: ransomware and UK national security
Russian-speaking actors are the source of most attributable ransomware attacks against UK targets. The Russian Government’s tacit (or even explicit) approval of these attacks is consistent with the Kremlin’s disruptive, zero-sum-game approach to the West. It also provides revenue to the Putin regime’s well-oiled network of corruption and criminality. This is not a straightforward state threat, however. For...
Matched on
terms: government
Committee recommendation
57match
#26 - 1st Report - Large language models and generative AI
The Government should publish an AI risk taxonomy and risk register. It would be helpful for this to be aligned with the National Security Risk Assessment.
Matched on
terms: government
Committee recommendation
57match
#62 - 1st Report - Ukraine: a wake-up call
The reliance of modern economies on space-based technologies makes them a prime target for hybrid attacks. Cyber and electronic tactics deployed in Ukraine by Russia have been used elsewhere, including against the UK and its allies. It is therefore essential that the new Government focuses on building greater resilience into the UK’s CNI.
Matched on
terms: government
Committee recommendation
57match
#21 - 1st Report - Ukraine: a wake-up call
There are risks attached to increasing collaboration with commercial partners who, traditionally, have not been involved in defence. The new Government will need to be alert to these risks and work to mitigate them. In particular, the Government should conduct careful risk assessments when deciding whether to allow private companies access to certain systems, such as sensitive communication...
Matched on
terms: government
Committee recommendation
57match
#7 - 78th Report - The Bank of England’s Real-Time Gross Settlement Renewal Programme
To secure the anticipated benefits from the new system, the Bank must make good on its plans for maintenance and further enhancement of the RTGS. Delivering long-term value from the new RTGS depends on the Bank’s ability to sustain and adapt the system as the payment landscape evolves. To maintain security, the Bank operates, maintains and updates the...
Matched on
classifier match
Committee recommendation
57match
#22 - 3rd Report - Science diplomacy: Sovereignty, strategy, and the global race
The government should provide clearer and more detailed guidance on how institutions should approach research security, aligned with its wider strategy for international collaboration, as set out in chapter 1. This should include better information-sharing between government and institutions to support decision-making and a review of how central advisory functions such as the Research Collaboration Advice Team are...
Matched on
terms: government
Committee recommendation
57match
#21 - 3rd Report - Science diplomacy: Sovereignty, strategy, and the global race
The UK’s research base is operating in an increasingly contested global environment. The risks to research security are growing but the UK’s response is insufficiently developed. Though the recent breach at UK Biobank illustrated how research collaborations can be exploited by hostile actors, the government’s current “actor agnostic” approach has not translated into clear, practical guidance for those...
Matched on
terms: government
Committee recommendation
57match
#14 - Recommend successor Committee examine 5G Supply Chain Diversification, international standards, and technology rollout.
Should our successor Committee wish to examine the UK’s telecommunications infrastructure and domestic capability, we recommend it considers: • The implementation of the 5G Supply Chain Diversification Strategy, and relevant policy and technical developments since the then Committee’s report; • Examining the Government’s participation in international standards bodies for critical and emerging technologies; or • The rollout and...
Matched on
terms: government
Law Commission project
57match
Protection of Official Data
Parts 1 to 3 of the National Security Act 2023, informed by the report, came into force in December 2023. On the Official Secrets Act 1989 the government continues to keep the position under review.
Matched on
terms: government
ISC report
56match
China
Inquiry into the security threat posed by China across government, industry, academia and critical sectors, and the intelligence response.
Matched on
terms: government
Committee recommendation
53match
#14 - 11th Report - Toward a new doctrine for economic security
The UK’s existing critical national infrastructure is vulnerable to a range of threats, from extreme weather to cyber-attacks. In expanding and renewing that infrastructure in response to a growing population and the net zero transition, the UK may be forced to re-evaluate the trade off between on the one hand, lower cost technology and investment from China, and...
Matched on
classifier match
Committee recommendation
53match
#25 - 78th Report - The Bank of England’s Real-Time Gross Settlement Renewal Programme
The Bank took an early decision that, to support system security and long-term resilience, it would run, maintain and update the new RTGS itself, once live. It also owns the intellectual property for the new system. The Bank highlighted that knowledge transfer was an important part of the programme, which was designed so that the Bank would take...
Matched on
classifier match
Committee recommendation
49match
#41 - 11th Report - Toward a new doctrine for economic security
Economic security cannot be achieved without cyber security. The spate of cyber-attacks in 2025 has underlined their potential to devastate not just targeted companies, but consumers and wider supply chains. We welcome the steps being taken to build the UK’s cyber resilience, but these efforts need to be redoubled in light of recent events. (Conclusion, Paragraph 145)
Matched on
classifier match