The government is under-prepared for a catastrophic cyber attack and still dogged by legacy IT, but making progress, the Public Accounts Committee of the House of Commons has heard.
The committee, chaired by Geoffrey Clifton-Brown, Conservative MP for North Cotswolds, took testimony on 10 March from four high-ranking government IT leaders about the cyber resilience of Whitehall departments. This followed the publication, in January, of a report by the National Audit Office (NAO), which found government cyber resilience lacking, weakened by legacy IT and skills shortages, and facing mounting threats.
In its Government cyber resilience report, the public spending watchdog warned that the cyber threat to the UK government is “severe and advancing quickly”. It found that 58 critical government IT systems, assessed in 2024, had significant gaps in cyber resilience, and the government does not know how vulnerable at least 228 “legacy” IT systems are to cyber attack.
The NAO spotted that the government’s cyber assurance scheme, GovAssure, found significant gaps in cyber resilience, with multiple fundamental system controls at low levels of maturity across departments. GovAssure assesses the critical systems of government organisations. It was set up in April 2023.
The question, according to the report under review at the PAC committee session, is no longer if the government will face a damaging cyber attack, but how severe the impacts may be, as the sophistication and number of attacks continues to rise.
As the government’s operations become increasingly digitised, so too does the severity of potential impacts resulting from cyber attacks. In an effort to combat this, the government published a Cyber Security Strategy in 2022, which set out plans to make the public sector resilient to cyber attacks by 2030. The PAC chair said the committee would look at “how the government understands the severity of the cyber threat that it faces, how it can best achieve the aim of the strategy, and build the government’s resilience to cyber attacks”.
Testifying before the committee were: Cat Little, chief operating officer for the Civil Service and permanent secretary to the Cabinet Office; Vincent Devine, government chief security officer and head of the Cabinet Office’s Government Security Function; Joanna Davinson, interim government chief digital officer at the Department for Science, Innovation and Technology; and Bella Powell, cyber director of the Cabinet Office’s Government Security Group.
One matter of concern to the MPs on the committee is the lack of visibility civil servants seem to have into the very number of government IT systems, spread across departments and “arms-length bodies”, and to what extent they are “legacy” systems especially vulnerable to cyber attack.
Clive Betts, Labour MP for Sheffield South East, said: “This is quite a critical issue. This is about the threat from potential cyber attack that could be launched against a legacy system, and we don’t yet know what the systems are to begin with.”
This is quite a critical issue. This is about the threat from potential cyber attack that could be launched against a legacy system, and we don’t yet know what the systems are to begin with Clive BettsLabour MP for Sheffield South East
Davinson responded: “It’s not a simple, ‘What’s the list?’ We’ve asked that question of departments, and have had responses through our legacy risk framework. We’ve got that understanding and we are continuing to expand that out to other organisations. [But] it’s not a resource-free exercise.”
Little added: “What this part of our discussion really brings to light is that government, in a period of scarce resources, has got to make prioritised decisions based on risks and how much assurance is desired. And it’s for the government to set its risk appetite, and to use that risk appetite and information to allocate resources accordingly.
“We’ve made huge progress in understanding the most significant issues that we’ve got [in terms of legacy], and whilst it’s not every single system, it is the vast majority … [and] we’re using both GovAssure and our technical expertise in legacy IT to set out for ministers the choices about risk and how much risk they want to buy out. That is the fundamental question. If you’ve got X billion pounds available to fund people, resources, skills, to remediate legacy IT, and to invest in new technology, how you use your allocative resource has got to be risk based, and it’s got to be outcome based. The whole point of the Spending Review process is to bring outcomes and risks together so that ministers can make a funding allocation choice.”
Powell said: “We are ramping up the number of systems that we’re looking at. We are not doing that in an exponential fashion, but I think it’s also worth noting that with GovAssure, we are driving the car and building it at the same time. We launched it in April 2023 following some early pilots with departments [when] it was still at an early-stage assurance process.
“There is much more that we can and need to do, particularly in terms of automation of that process, in terms of providing stronger support and guidance to departments in implementing it, and also in the root cause analysis to better understand the data that we are gathering from that process. It is by no means a finished product, it is by no means a perfect product, but what it’s already starting to do is give us the outcomes that we need in terms of understanding resilience levels and where we can take action.”
MPs were also concerned about the extent to which the government has, as the NAO report states, under-estimated the extent of cyber risk.
Devine was candid in relation to the lateness of the introduction of GovAssure in April 2023. “We probably have woken up to the scale of cyber risk more slowly than we should have done. We were probably unrealistic in relying upon self-assessment [of government departments],” he said.
We didn’t ramp up the government response to cyber security from assurance through to response as quickly as we should have … because we [weren’t] as alive to the threats as we should have been Vincent DevineCabinet Office
“Despite recognising this in 2010, starting to invest money significantly in 2016, we didn’t ramp up the government response to cyber security from assurance through to response as quickly as we should have, in retrospect. Why? Because I don’t think we were as alive to the threats as we should have been, and probably because we hadn’t had the incidents that brought it to life for us that we and our allies have had over the last five years. It’s not a good answer, but it is the true answer,” Devine added.
To that, Little added: “It’s really difficult to go back in time to our predecessors. Like all good risk management, you manage risks as best you can until they become an issue. When they become an issue, and they’re live and they’re real, you step up your response…. We’ve always known about the risks, but it wasn’t until it became a real, live issue that the scale of what we were dealing with became clear, and it needs a different sort of response.”
The original NAO report gave, as an example of how damaging cyber attacks can be, the instance, in June 2024, of an attack on a supplier of pathology services to the NHS in south-east London, which led to two NHS foundation trusts postponing 10,152 acute outpatient appointments and 1,710 elective procedures. It also cited the British Library ransomware attack in October 2023, which has already cost £600,000 to rebuild services. The library expects to spend many times more as it continues to recover. These were mentioned in the PAC session.
The report found that the biggest risk to making the UK government resilient to cyber attack is a gaping skills gap. One in three cyber security roles in government were vacant or filled by temporary – and more expensive – staff in 2023-24, while more than half of cyber roles in several departments were vacant, and 70% of specialist security architects were staff on temporary contracts.
In the Public Accounts Committee meeting, Little said she was sad to see a continued over-reliance on contractors, but that initiatives such as a cyber security Fast Stream and a new “digital pay framework” were “starting to have an impact”.
Powell added that the overall number of digital technology professionals in the civil service has grown, and stands at nearly 6%. “It’s not as much as we’d like it to be. We are struggling with the very technical resources, and that’s a market problem – they are scarce in the private sector as well as in the public sector,” she said.
Source
Nintendo Today marketing images from the App Store page. Image source: App Store
Zooming in on the Nintendo Switch 2 console reveals the “C” button. Image source: App Store
ACMER P3 IR＆Diode Enclosed Dual Laser Engraver $1,104.15 (reg. $1,999) Double Discount! 
ByteDance’s InfiniteYou test: Example of creating fake photos. Image source: 
InfiniteYou examples from the ByteDance study. Image source: 
Comparison between ByteDance and other AI image generation services. Image source: 
Don’t expect the same level of Gemini support on the 9a as Google’s flagship devices. Image source: Christian de Looper for BGR
Password managers like Proton Pass and 1Password will let you save passkeys for internet accounts. Image source: 1Password
