Government cybersecurity assurance
Robustness and oversight of cyber security assurance programs within government departments for critical systems.
Source spread
Where this theme appears
This theme appears across 14 independent accountability sources, so the source mix matters as much as the headline total.
3 inquiry recs
341 committee recs
5 CQC actions
4 ICIBI recs
2 IOPC recs
24 NAO recs
8 IMB recs
1 Article 2 learning point
1 PHSO decision
2 LGO/SPSO decisions
16 ISC reports
1 Law Commission project
Browse by source
Source-grouped records are useful for tracing where a concern came from. Large sections show the 50 strongest matches for that source; counts still show the full theme total.
Inquiry recommendations(3)
27 — NOMIS alert for sensitive security information
Recommendation: NOMIS should include a facility for an alert to appear if information is held by the Security Department on prisoners which could affect their management but which is too sensitive for wider dissemination. An officer at the grade of senior …
Unknown
P1-45 — NPAS helicopter datalink encryption standards
Recommendation: Steps be taken to ensure that the airborne datalink system on every NPAS helicopter observing an incident which involves one of the other emergency services defaults to the National Emergency Service user encryption.
Gov response: The Chair recommended steps be taken to ensure airborne data systems on every National Police Air Service (NPAS) aircraft observing an incident which involves one of the other emergency services defaults to the National Emergency …
Noted
P1-8 — Security as corporate responsibility
Recommendation: Maidstone and Tunbridge Wells NHS Trust should treat security as a corporate not a local departmental responsibility.
Gov response: The Trust now complies with this recommendation in full on the following basis: • The Trust has strengthened its security responsibility arrangements significantly since the Police informed the Trust of Fuller’s mortuary-related crimes in December …
Accepted
Select committee recommendations(341)— showing 50 strongest matches
#51 —
Recommendation: The Government should establish a dedicated SME Resilience Fund, administered by the Department for Business and Trade, to target support at enhancing the cyber resilience of smaller businesses. This fund should integrate with the Government’s new Secure Innovation Reviews, by …
#49 —
Recommendation: The Government should urgently consider expanding the scope of reinsurance schemes such as Pool Re to support private markets which enhance business resilience, particularly in respect of cyber threats. (Recommendation, paragraph 165)
#45 —
Recommendation: The Government should amend the capital allowances regime to allow businesses to claim tax relief on subscription-based IT services that directly enhance operational resilience, such as cybersecurity software, legacy system upgrades, business continuity platforms and data protection solutions. A consultation …
#43 —
Recommendation: We recommend that the Government introduce legislation that would mandate the standards set out in its Software Security Code of Practice. Enforcement agencies should be empowered to monitor compliance, and levy penalties against firms that do not adhere to these …
#41 —
Recommendation: Economic security cannot be achieved without cyber security. The spate of cyber-attacks in 2025 has underlined their potential to devastate not just targeted companies, but consumers and wider supply chains. We welcome the steps being taken to build the UK’s …
#15 —
Recommendation: Cyber threats to the UK’s economy, institutions and infrastructure continue to evolve. A string of high-profile attacks in 2025 have vividly demonstrated the devastating impacts of these attacks on workers, consumers and associated supply chains. The boundary between “state” and …
#14 —
Recommendation: The UK’s existing critical national infrastructure is vulnerable to a range of threats, from extreme weather to cyber-attacks. In expanding and renewing that infrastructure in response to a growing population and the net zero transition, the UK may be forced …
#27 —
Recommendation: There is a high risk that the Government will face a catastrophic ransomware attack at any moment, and that its planning will be found lacking. In 2020, this Committee examined the Government’s preparations for the Covid-19 pandemic, considering what it …
Response attribution not verified
#24 —
Recommendation: The Government’s response to ransomware is conducted partly through the National Cyber Force and the intelligence agencies, on which we can only access limited information. RUSI has argued that the UK intelligence community may not be sufficiently motivated or resourced …
Response attribution not verified
#22 —
Recommendation: The Government and NCSC’s approach to ransomware is often framed through the language of state threats. While we recognise that operators are often facilitated by the Russian harbour state, ransomware is primarily a problem of criminality for profit, rather than …
Response attribution not verified
#20 —
Recommendation: It is possible to infiltrate and disrupt ransomware groups’ infrastructure without arresting the criminals involved, sometimes even preventing attacks after the initial 66 A hostage to fortune: ransomware and UK national security infiltration has taken place. The NCA has some …
Response attribution not verified
#19 —
Recommendation: The National Crime Agency is locked in an uphill struggle against the ransomware threat, which is now so sophisticated that even the most highly-protected organisations expect to experience a ransomware attack. There is clear value in the Government’s resilience work, …
Response attribution not verified
#18 —
Recommendation: In line with many other aspects of cyber security, and to ensure that it is treated as a cross-government national security priority, responsibility for tackling ransomware should be transferred from the Home Office to the Cabinet Office, in partnership with …
Response attribution not verified
#15 —
Recommendation: It is potentially concerning that the Conflict, Stability and Security Fund (CSSF) has now been merged with the National Cyber Programme—which delivers aspects of the National Cyber Strategy—as part of the new Integrated Security Fund (ISF). We recognise that this …
Response attribution not verified
#14 —
Recommendation: The National Audit Office (NAO) criticised previous delivery failures in cyber security in 2019, finding that the Government risked making the same mistakes with its subsequent National Cyber Strategy. The Government’s Performance Framework for the 2022 NCS appears to be …
Response attribution not verified
#13 —
Recommendation: The Government has acknowledged that ransomware is the number one cyber security threat to the UK. It is therefore welcome that it has published an ambitious National Cyber Strategy (NCS), with some strong commitments on resilience and the cyber security …
Response attribution not verified
#12 —
Recommendation: While the Government maintains that UK victims should not pay ransoms, it is the only viable option for many of those directly affected, enabling them to keep their businesses afloat and prevent damaging leaks of personal data. Too many organisational …
Response attribution not verified
#11 —
Recommendation: Victims are currently disincentivised to report ransomware attacks, making it difficult to understand fully the nature and scale of the threat, and how best to tackle it. The Director General of the NCA has suggested that it would be unusual …
Response attribution not verified
#10 —
Recommendation: Cyber insurance can provide a vital lifeline for ransomware victims, offering the sort of support and technical advice not offered by state agencies, as well as driving up cyber security standards through conditions of coverage. Unfortunately, there remains a woeful …
Response attribution not verified
#9 —
Recommendation: The emphasis on supporting high-risk individuals and protecting electoral integrity is undoubtedly welcomed. We would, however, welcome a more direct approach from the NCSC in their offer of support to political parties and high-risk individuals. It is unclear if the …
Response attribution not verified
#8 —
Recommendation: Many ransomware victims feel there is insufficient support from law enforcement or Government agencies, with limited state resources focused on the most critical organisations. For smaller organisations and those falling outside the boundaries of critical national infrastructure, the NCSC’s post-incident …
Response attribution not verified
#7 —
Recommendation: Although we recognise the value of peer support, it should not have fallen to Redcar and Cleveland Council’s Leader to train other councils how to prevent and respond to cyber-attacks, following their own devastating attack in 2020. Local authorities are …
Response attribution not verified
#5 —
Recommendation: Unlike many areas of national resilience, the Government has imposed cyber resilience requirements on most CNI operators through the 2018 Network and Information System (NIS) regulations, and has also committed to imposing new 62 A hostage to fortune: ransomware and …
Response attribution not verified
#4 —
Recommendation: The Government and the National Cyber Security Centre (NCSC)—the public- facing arm of GCHQ—have focused significant efforts on enhancing the UK’s cyber resilience, with particular attention paid to major operators of critical national infrastructure (CNI). Nevertheless, UK CNI remains vulnerable …
Response attribution not verified
#3 —
Recommendation: Russian-speaking actors are the source of most attributable ransomware attacks against UK targets. The Russian Government’s tacit (or even explicit) approval of these attacks is consistent with the Kremlin’s disruptive, zero-sum-game approach to the West. It also provides revenue to …
Response attribution not verified
#2 —
Recommendation: Past attacks demonstrate that ransomware can cause severe disruption to the delivery of core Government services, including healthcare and child protection, as well as causing ongoing economic losses. Mass data loss from an attack can be irreversible, even when the …
Response attribution not verified
#1 —
Recommendation: A major ransomware attack could have a devastating impact on UK citizens and the economy, and undoubtedly represents a major threat to UK national security. A sophisticated ransomware ecosystem has evolved, with criminals able to purchase advanced forms of malware …
Response attribution not verified
#26 —
Recommendation: The Government should publish an AI risk taxonomy and risk register. It would be helpful for this to be aligned with the National Security Risk Assessment.
Response attribution not verified
#62 —
Recommendation: The reliance of modern economies on space-based technologies makes them a prime target for hybrid attacks. Cyber and electronic tactics deployed in Ukraine by Russia have been used elsewhere, including against the UK and its allies. It is therefore essential …
Response attribution not verified
#60 —
Recommendation: The Government should ensure that cyber, EW and emerging technologies are fully integrated into the next edition of the Defence and Security Industrial Strategy. In addition, it should give serious consideration to the creation of a warfare centre for the …
Response attribution not verified
#21 —
Recommendation: There are risks attached to increasing collaboration with commercial partners who, traditionally, have not been involved in defence. The new Government will need to be alert to these risks and work to mitigate them. In particular, the Government should conduct …
Response attribution not verified
#25 —
Recommendation: The Bank took an early decision that, to support system security and long-term resilience, it would run, maintain and update the new RTGS itself, once live. It also owns the intellectual property for the new system. The Bank highlighted that …
Response attribution not verified
#7 —
Recommendation: To secure the anticipated benefits from the new system, the Bank must make good on its plans for maintenance and further enhancement of the RTGS. Delivering long-term value from the new RTGS depends on the Bank’s ability to sustain and …
Response attribution not verified
#18 —
Recommendation: We asked HMRC when it expects to see the benefits of the extra investment in its IT. HMRC told us that by the end of the Spending Review period it wants to be a digital first organisation, with 90% of …
Response status not verified
#22 —
Recommendation: The government should provide clearer and more detailed guidance on how institutions should approach research security, aligned with its wider strategy for international collaboration, as set out in chapter 1. This should include better information-sharing between government and institutions to …
Response status not verified
#21 —
Recommendation: The UK’s research base is operating in an increasingly contested global environment. The risks to research security are growing but the UK’s response is insufficiently developed. Though the recent breach at UK Biobank illustrated how research collaborations can be exploited …
Response status not verified
#22 —
Recommendation: The Department assured us that it was now working closely with the organisations on how it can provide central advice on improving cyber-resilience and minimising the threat and impact of cyber-attacks. It highlighted the Government’s cyber action plan, which the …
Response status not verified
#13 —
Recommendation: The Government should clarify what will change for private sector Critical National Infrastructure operators as a result of the NSS and provisions of the Cyber Security and Resilience (Network and Information Systems) Bill. It should then work with those operators …
Response attribution not verified
#50 —
Recommendation: It would be irresponsible to roll out a digital ID built on the UK’s current digital infrastructure. The public sector holds citizens’ data on trust, and should therefore hold itself to a higher standard. The operational and security problems relating …
Response status not verified
#38 —
Recommendation: The government should publish the findings of its investigation into the October 2025 AWS outage and its impact on suppliers and departments. In its response to this report, it should detail the steps it is taking to ensure greater resilience …
Response status not verified
#24 —
Recommendation: GDS should set up a Legacy Systems Taskforce with a remit to drive progress in remediating legacy systems across the public sector. It should be empowered to mandate action by departments and public sector bodies 53 where necessary. The taskforce …
Response status not verified
#23 —
Recommendation: Legacy systems present huge efficiency, cost and security risks, and it is therefore deeply concerning that government still does not know the full scale of the problem. While it may be difficult for ministers to argue in favour of spending …
Response status not verified
#13 —
Recommendation: GDS and the Cabinet Office should publish quarterly reports on departmental and public sector body progress against the information and data security metrics it has committed to, together with its published principles for securing data in public services. These disclosures …
Response status not verified
#10 —
Recommendation: Successive governments have made a series of promises designed to address the institutional failings outlined in the Information Security Review. Yet we remain concerned that the current government is not holding itself to, or delivering, the standards of information and …
Response status not verified
#9 —
Recommendation: It is a fundamental duty of government, public sector bodies and bodies in receipt of public funds to keep safe the data they hold on citizens. This duty has not been consistently upheld in the UK for some time. An …
Response status not verified
#7 —
Recommendation: There is no doubt that Huawei’s designation as a high-risk vendor is justified. The Huawei Cyber Security Evaluation Centre has consistently reported on its low-quality products and concerning approach to software development, which has resulted in increased risk to UK …
Response attribution not verified
#2 —
Recommendation: We share the Government’s objective that the UK remains at the forefront of the 5G rollout as we move into the next technological era. It is imperative that the UK is amongst the first countries to benefit from the technological …
Response attribution not verified
#8 —
Recommendation: The risks associated with legacy systems include that they can be difficult and expensive to support, lack operational resilience for key government services, and be vulnerable to cyber-attack. This exposes government to what is likely to be an uncertain but …
Response attribution not verified
#14 — Recommend successor Committee examine 5G Supply Chain Diversification, international standards, and technology rollout.
Recommendation: Should our successor Committee wish to examine the UK’s telecommunications infrastructure and domestic capability, we recommend it considers: • The implementation of the 5G Supply Chain Diversification Strategy, and relevant policy and technical developments since the then Committee’s report; • …
Response status not verified
#2 — Recommend a trial of a centralised Secure Data Environment and simplify ethical governance
Recommendation: Should our successor Committee wish to explore the reform of the UK health data strategy, we recommend it considers: • Investigating the replication of the academic model of open and competitive funding to solve problems and develop Privacy Enhancing technologies …
Response status not verified
CQC inspection actions(5)
Rochdale Infirmary
The trust should continue to ensure that improvements are made to its IT infrastructure and reduce the risk in cyber vulnerability, system failure and downtime and the associated disruption to clinical services and risk to patient safety.
Should Do
Newham University Hospital
The services should ensure all computers remain locked when unattended.
Should Do
William Harvey Hospital
The trust must ensure all computer terminals are locked when not in use
Must Do
West Berkshire Community Hospital
Takeactiontomeetthedatasecurityandprotectionstandardsandmonitoron-goingcompliancewiththese standards.
Should Do
Poole Hospital
Consider the access to IT systems for agency staff and how this complies with information governance and data protection rules.
Should Do
ICIBI immigration recommendations(4)
An inspection of Border Force insider threat (January – March 2023)
Ensure relevant data from vetting, Home Office Security, and Human Resources is available to Border Force, in order to allow Border Force to create a comprehensive insider threat picture to …
An inspection of Border Force insider threat (January – March 2023)
Publish an updated social media policy, tailored to Border Force operational staff and ensure that this is widely disseminated and communicated.
An inspection of Border Force insider threat (January – March 2023)
Ensure that there is a clear escalation route to a single, senior Home Office leader for the Border and Enforcement Insider Threat and Integrity Committee to resolve issues that cut …
An inspection of Border Force insider threat (January – March 2023)
Conduct a review of insider threat in Border Force within six months, utilising NPSA advice and guidance, and considering ongoing contemporary changes in UK law enforcement, to facilitate the development …
IOPC learning recommendations(2)
Investigation into recruitment irregularities and the actions of a civilian staff member …
The IOPC recommends that British Transport Police puts in place mechanisms to monitor deletion of documents or files from shared and personal computer drives and to recover them where appropriate. In this investigation, allegations were made about the deletion of …
Investigation into recruitment irregularities and the actions of a civilian staff member …
The IOPC recommends that British Transport Police put in place a robust process for visitors to BTP premises to sign in and, where appropriate, be accompanied by a BTP employee. The IOPC investigation examined visitor logs for BTP’s Leeds office …
NAO audit recommendations(24)
Government cyber resilience
Working in alignment with GSG?s government skills strategy, departments should make and enact plans to fill the cyber skills gaps in their workforces. Within the next year, they should: ? undertake a gap analysis of their current cyber workforce to …
Accepted
Government cyber resilience
Government departments should urgently strengthen their own governance, accountability and reporting arrangements around cyber risk. In their annual security appraisal, accounting officers should assess their progress and performance in meeting the cyber security standards set out in Functional Standard GovS …
Accepted
Government cyber resilience
GSG should design regular communications to ensure that senior leaders and other decision-makers across government understand the cyber threat, how it is relevant to their business outcomes and what they can do about it. GSG should embed this into departments? …
Accepted
Government cyber resilience
GSG should work with CDDO to take a more rigorous approach to understanding and mitigating the risk to government organisations? cyber resilience caused by legacy IT systems. Learning from GovAssure and the legacy IT risk assessment framework, this approach should: …
Accepted
Government cyber resilience
GSG should strengthen GovAssure?s focus on improving cyber resilience outcomes. GSG should: ? continue building the capacity to support departments in developing and implementing targeted improvement plans, and monitoring and evaluating progress against them; ? continue developing how GovAssure data …
Accepted
Government cyber resilience
Within six months, GSG should set out how the whole of government needs to operate differently, and what is needed for this transformation to be effective, so that the government can achieve its goals for cyber security and resilience. GSG …
Accepted
Government cyber resilience
Within six months, GSG should develop, share and start using a cross?government implementation plan for the Government Cyber Security Strategy: 2022?2030 (?the Strategy?). GSG should refresh it regularly, include how the government is responding to new and severe cyber threats …
Accepted
Investigation into the performance of UK Security Vetting
The Cabinet Office should: a recognise the importance of modernising the national security vetting process and work quickly to design an implementation plan with key milestones in place;
Accepted
Financial modelling in government
The OBR should: m) require departments, as a matter of routine, to analyse and present the range of plausible outcomes driven by key inputs and model parameters in each case to take account of where there might be material uncertainties …
Accepted
Financial modelling in government
l) include appropriate elements relating to analysis and modelling from the Finance Functional Standard in the Finance Function’s self-assessment tools to measure compliance of functional members with requirements on modelling.
Accepted
Financial modelling in government
The Finance Function should work with the Analysis Function to: k) strengthen the requirements in the Finance Functional Standard on departments to apply the Analysis Functional Standard and the Aqua Book to financial planning and reporting. This should include guidance …
Accepted
Financial modelling in government
The Cabinet Office is working on common standards for departmental sponsorship of ALBs. As part of this work, it should: j) include guidance for departments on overseeing the production and assurance of models in ALBs, based on expert input from …
Accepted
Financial modelling in government
HMT and the Analysis Function should: i) agree the funding and capacity implications of the proposed governance structure in relation to analytical modelling standards and guidance.
Accepted
Financial modelling in government
h) work with departments, ALBs and other stakeholders such as the Quality Assurance Working Group on guidance and training to facilitate system-wide learning and improvement. This should include sharing good practice on how business-critical models are managed and practical advice …
Accepted
Financial modelling in government
g) update its Functional Standard and relevant guidance to include clear principles for departments and ALBs to follow on independent review of business-critical models, and on publication of a model’s inputs, methodology, assumptions, and outputs; and
Accepted
Financial modelling in government
The Analysis Function should: f) set out the appropriate governance structure for the ownership, maintenance, monitoring and assurance of analytical modelling standards and guidance, as presented in the Analysis Functional Standard. As part of this, the Function should work with …
Accepted
Financial modelling in government
e) agree with the Analysis Function on responsibilities for ownership and maintenance of the Aqua Book, including appropriate sign-off arrangements between the Function and HMT for Aqua Book updates.
Accepted
Financial modelling in government
d) build on its current approach to quantifying uncertainty and risk analysis by requiring departments to present HMT with a range of plausible outcomes from business-critical models as a matter of routine. This range should be driven by key inputs …
Accepted
Financial modelling in government
c) put in place processes to assure itself that outputs from departments’ and ALBs’ business-critical models, which HMT uses, have been quality-assured in line with modelling standards. This should include clarifying in all relevant guidance that all models must comply …
Accepted
Financial modelling in government
Accounting officers should: a) Oversee the use of models within their organisation and ensure an appropriate quality assurance framework is in place and used for all business-critical models.
Accepted
UK Research and Innovation: providing support through grants
To enable UKRI to confidently take well-managed risks while effectively protecting public money, it needs a strong approach to funding assurance, fraud and error. By September 2026, it should ensure that the improvements it is implementing for 2025-26 have gone …
Accepted
Transforming health assessments for disability benefits
DWP should: a review the Programme plan and produce an updated business case, incorporating the white paper reforms, including: demonstrating it has effective assurance and control over development of the Programme?s digital architecture, including how the Programme will fit with …
Accepted
Delivery of employment support schemes in response to the COVID-19 pandemic
b) work with the Cabinet Office and government?s counter-fraud functions to improve protocols and thus increase the consistency of data collected on grant claimants, and the pace at which data can be shared between HMRC and other public bodies, in …
Rejected
Digital transformation in the NHS
e) Simplify and strengthen national governance arrangements. This should include further work to provide national bodies with the levers and monitoring capability to ensure local NHS organisations and suppliers comply with national standards for existing and new technology, and for …
Accepted
IMB individual recommendations(8)
Long Lartin (2022)
Will the Governor give more priority to repairs and improvements to the security systems?
Governor / Director
Whatton (2023)
Can the Prison Service give us a timescale for the installation of the replacement Eureka system?
HMPPS
In Progress
Wakefield (2023)
We ask the Minister to act in respect of the substantial security threat posed by the use of unmanned aerial vehicles (UAVs) in the vicinity of HMP Wakefield.
Other
Scotland and Northern Ireland Short-Term Holding Facilities (STHF) (2023)
We recommend that the HR be brought up to basic requirements by UKBF installing portable secure Wi-Fi and connecting a CCTV system to it. We understand that a section of elevator had been removed and stored elsewhere in the terminal. It could be brought back into service. The desired outcome would be that any individual detained is held within a …
Home Office
Scotland and Northern Ireland Short-Term Holding Facilities (STHF) (2023)
We recommend that the CCTV monitoring of the HR be brought to an end and that the adjacent office section be manned when persons are detained within the HR. Also, we requested, in our previous annual report that the missing section of elevator, which had been removed and stored elsewhere in the terminal, be also brought back into service. The …
Home Office
Maidstone (2023)
Provide funding for CCTV across the prison, and for enhanced gatehouse security.
HMPPS
Long Lartin (2024)
Security systems: the maintenance contractor, Amey, has been unable to restore or maintain the ageing surveillance equipment to enable it to provide the prison with adequate security cover. What measures are being taken to install and maintain effective and reliable electronic surveillance and when?
HMPPS
In Progress
Long Lartin (2023)
Security systems. Much of the existing surveillance technology is obsolete or unserviceable, increasing the vulnerability of prisoners and staff. Will the Minister confirm that funds to provide a modern, fully operational surveillance system will be authorised and allocated within the next 12 months?
Ministry of Justice
In Progress
Independent reviews(25)
Fisher Review (Part 1) — Rec 5
Undertake a review of law enforcement and local police force access to secure platforms for the sharing of sensitive material.
Justice & Legal
Accepted
Caldicott Review 2016 — Rec 6
Arrangements for internal data security audit and external validation should be reviewed and strengthened to a level similar to those assuring financial integrity and accountability.
Health & Social Care
Caldicott Review 2016 — Rec 5
NHS England should change its standard financial contracts to require organisations to take account of the data security standards. Local government should also include this requirement in contracts with the independent and voluntary sectors. Where a provider does not meet the standards over a reasonable period of time, a contract …
Health & Social Care
Caldicott Review 2016 — Rec 4
All health and social care organisations should provide evidence that they are taking action to improve cyber security, for example through the 'Cyber Essentials' scheme. The 'Cyber Essentials' scheme should be tested in a wider number of GP practices, Trusts and social care settings.
Health & Social Care
Caldicott Review 2016 — Rec 1
The leadership of every organisation should demonstrate clear ownership and responsibility for data security, just as it does for clinical and financial management and accountability.
Health & Social Care
Jackson Review — Rec 102
Consideration should be given to establishing an IT network for the courts which is separate from, and therefore not constrained by the security requirements of, the gsi system. This network should have its own appropriate level of security.
Other
Fisher Review (Part 2) — Rec 24
The United Kingdom Government should take the lead in developing a protocol to the United Nations Convention against Cybercrime, ensuring fraud is recognised as a priority
Justice & Legal
Fisher Review (Part 2) — Rec 22
To prevent otherwise lawful section 49 Regulation of Investigatory Powers Act 2000 (RIPA) notices being frustrated because relevant data is stored remotely rather than locally, it is recommended the Act be amended as follows: a. References to protected information having come into the ‘possession’ of a person should include protected …
Justice & Legal
Caldicott Review 2016 — Rec 9
Where malicious or intentional data security breaches occur, the Department of Health should put harsher sanctions in place and ensure the actions to redress breaches proposed in the 2013 Review are implemented effectively.
Health & Social Care
Caldicott Review 2016 — Rec 7
CQC should amend its inspection framework and inspection approach for providers of registered health and care services to include assurance that appropriate internal and external validation against the new data security standards have been carried out, and make sure that inspectors involved are appropriately trained. HSCIC should use the redesigned …
Health & Social Care
Caldicott Review 2016 — Rec 3
Trusts and CCGs should use an appropriate tool to identify vulnerabilities such as dormant accounts, default passwords and multiple logins from the same account. These tools could also be also used by the IT companies that provide IT systems to GPs and social care providers.
Health & Social Care
Goldacre Review — Rec TRE 23
Ideally one national TRE, never more than three Ideally there should be one national TRE. This will minimise duplication of effort around the IG service wrapper, the underlying technical infrastructure, and cybersecurity risks, and minimise unnecessary variation in implementation that has historically obstructed re-use of code. However, in pragmatism, the …
Health & Social Care
Goldacre Review — Rec TRE 20
Publish all technical steps taken to prevent and detect misuse of data All TREs must take technical steps to prevent and detect misuse of patients’ data, such as by obfuscating access to raw data; and disclose these technical methods openly. Ensuring National TREs are Accessible, and Used
Health & Social Care
Goldacre Review — Rec TRE 15
Ensure TRE access is faster and easier than data dissemination TREs are lower risk than data dissemination. They present a range of safeguards that substantially increase patient privacy, and prevent analyses outside of those permitted, by sharing information about all activity in the platform, and by using tools that obstruct …
Health & Social Care
Goldacre Review — Rec TRE 2
Rapidly create a substantial multidisciplinary TRE technical delivery team This should be rapidly convened by the NHS Transformation Directorate. It is crucial that this team has the right people: it should combine skills in software development, data architecture, clinical informatics, data science, data management, information governance, cybersecurity, and open source …
Health & Social Care
Goldacre Review — Rec Open 44
Produce clear guidance on disclosure risk and open code If code is not written thoughtfully, and consciously, there are small risks of disclosing small amounts of personal information. Release of open code from TREs should efficiently manage disclosure risks, and TREs should give clear and enforced guidance to users on …
Health & Social Care
Goldacre Review — Rec S2
Ensure all NHS data policies actively acknowledge the shortcomings of “pseudonymisation” and “trust” as techniques to manage patient privacy: these outdated techniques cannot scale to support more users (academics, NHS analysts, and innovators) using ever more comprehensive patient data to save lives.
Health & Social Care
Anderson Review — Rec 16
The rules regarding retention of data by CSPs should comply (to the extent that it may be applicable) with EU law as contained e.g. in Joined Cases C-293/12 and C594/12 Digital Rights Ireland and with the ECHR, particularly as regards: (a) limits on the data whose retention may be required; …
Other
Cunliffe Water Commission — Rec 70
Recommendation 70: The UK and Welsh Government should strengthen legislation relating to security arrangements for the water industry to ensure it keeps pace with a changing industry.
Other
Goldacre Review — Rec S4
Use the enhanced privacy protections of Trusted Research Environments (TREs) to create new, faster access rules and processes for safe users of NHS data; ensure all TREs publish logs of all activity, to build public trust.
Health & Social Care
Goldacre Review — Rec S1
Build trust by taking concrete action on privacy and transparency: trust cannot be earned through communications and public engagement alone.
Health & Social Care
Anderson Review — Rec 24
It is not recommended that service providers wishing to offer services in the UK should be required to have a licence, or that they should be required to store data in the UK. But in order to address deficiencies in access to material from overseas service providers, the Government should: …
Other
Anderson Review — Rec 19
The capability of the security and intelligence agencies to collect and analyse intercepted material in bulk should be maintained, subject to rulings of the courts, but used only subject to the safeguards in Recommendations 40-49 and 72-80 below, and only in cases where it is necessary to achieve an objective …
Other
Anderson Review — Rec 14
The Home Secretary should be able by Notice (as under DRIPA 2014 s1 and CTSA 2015 s21) to require service providers to retain relevant communications data for periods of up to a year, if the Home Secretary considers that the requirement is necessary and proportionate for purposes laid down in …
Other
Pickles Electoral Fraud Review — Rec R15
The Government should consider the feasibility of an automated approach to checking nationality, to work as part of the existing individual electoral registration infrastructure.
Other
PHSO casework decisions(1)
LGO / SPSO decisions(2)
24-009-688 — London Borough of Croydon
Summary: We will not investigate Ms X’s complaint about a data breach by the Council because the Information Commissioner’s Office is better placed to deal with that complaint. We will not investigate the complaint about the steps the Council took after the data breach was identified because we could not …
LGO (Local Government & …
Education
Nov 2024
23-018-797 — Devon County Council
Summary: We will not investigate this complaint about how the Council dealt with a freedom of information request. This is because it is reasonable for them to refer the matter to the Information Commissioner and then, if needed, to a tribunal.
LGO (Local Government & …
Other Categories
Mar 2024
ISC reports(16)
Foreign Involvement in the Critical National Infrastructure
Assessment of the national security implications of foreign involvement in the UK's critical national infrastructure.
Special Report
Jun 2013
Russia
Inquiry into the Russian threat to the UK, including interference in democratic processes, cyber activity and the response of the intelligence community.
Special Report
Jul 2020
China
Inquiry into the security threat posed by China across government, industry, academia and critical sectors, and the intelligence response.
Special Report
Jul 2023
International Partnerships
Inquiry into the UK intelligence community's international intelligence sharing partnerships and the safeguards governing them.
Special Report
Dec 2023
Iran
Inquiry into the threat to the UK from Iran, including state threats, hostage taking and the response of the intelligence agencies.
Special Report
Jul 2025
Statement regarding GCHQ's alleged access to the US PRISM programme
Statement or press release
Jul 2013
ISC Annual Report 2013-2014
Annual report on the administration, expenditure and work of the UK intelligence community for 2013-2014.
Annual Report
Nov 2014
ISC Annual Report 2015-2016
Annual report on the administration, expenditure and work of the UK intelligence community for 2015-2016.
Annual Report
Jul 2016
ISC Annual Report 2016-2017
Annual report on the administration, expenditure and work of the UK intelligence community for 2016-2017.
Annual Report
Dec 2017
ISC Annual Report 2017-2018
Annual report on the administration, expenditure and work of the UK intelligence community for 2017-2018.
Annual Report
Nov 2018
ISC Annual Report 2018-2019
Annual report on the administration, expenditure and work of the UK intelligence community for 2018-2019.
Annual Report
Jul 2020
ISC Annual Report 2019–2021
Annual report covering 2019 to 2021, spanning a longer period due to the timing of the Committee's reconstitution.
Annual Report
Dec 2021
ISC Annual Report 2021–2022
Annual report on the administration, expenditure and work of the UK intelligence community for 2021-2022.
Annual Report
Dec 2022
ISC Annual Report 2022-2023
Annual report on the administration, expenditure and work of the UK intelligence community for 2022-2023.
Annual Report
Dec 2023
ISC Annual Report 2023–2025
Annual report covering April 2023 to March 2025, spanning two Committees because no report was issued in 2024 due to the dissolution ahead of the general election.
Annual Report
Dec 2025
Extreme Right-Wing Terrorism
Inquiry into the threat from extreme right-wing terrorism in the UK and the response of the intelligence community.
Special Report
Jul 2022