zgphotography - stock.adobe.comNewsUK government under-prepared for catastrophic cyber attack, hears PACThe Commons Public Accounts Committee heard government IT leaders respond to recent National Audit Office findings that the governments cyber resilience is under parByBrian McKenna,Enterprise Applications EditorPublished: 11 Mar 2025 15:00 The government is under-prepared for a catastrophic cyber attack and still dogged by legacy IT, but making progress, the Public Accounts Committee of the House of Commons has heard.The committee, chaired by Geoffrey Clifton-Brown, Conservative MP for North Cotswolds, took testimony on 10 March from four high-ranking government IT leaders about the cyber resilience of Whitehall departments. This followed the publication, in January, of a report by the National Audit Office (NAO), which found government cyber resilience lacking, weakened by legacy IT and skills shortages, and facing mounting threats.In itsGovernment cyber resiliencereport, thepublic spending watchdogwarned that the cyber threat to the UK government is severe and advancing quickly. It found that 58 critical government IT systems, assessed in 2024, had significant gaps in cyber resilience, and the government does not know how vulnerable at least 228 legacy IT systems are to cyber attack.The NAO spotted that the governments cyber assurance scheme,GovAssure, found significant gaps in cyber resilience, with multiple fundamental system controls at low levels of maturity across departments.GovAssureassesses the critical systems of government organisations. It was set up in April 2023.The question, according to the report under review at the PAC committee session, is no longer if the government will face a damaging cyber attack, but how severe the impacts may be, as the sophistication and number of attacks continues to rise.As the governments operations become increasingly digitised, so too does the severity of potential impacts resulting from cyber attacks. In an effort to combat this, the government published a Cyber Security Strategy in 2022, which set out plans to make the public sector resilient to cyber attacks by 2030. The PAC chair said the committee would look at how the government understands the severity of the cyber threat that it faces, how it can best achieve the aim of the strategy, and build the governments resilience to cyber attacks.Testifying before the committee were: Cat Little, chief operating officer for the Civil Service and permanent secretary to the Cabinet Office; Vincent Devine, government chief security officer and head of the Cabinet Offices Government Security Function; Joanna Davinson, interim government chief digital officer at the Department for Science, Innovation and Technology; and Bella Powell, cyber director of the Cabinet Offices Government Security Group.One matter of concern to the MPs on the committee is the lack of visibility civil servants seem to have into the very number of government IT systems, spread across departments and arms-length bodies, and to what extent they are legacy systems especially vulnerable to cyber attack.Clive Betts, Labour MP for Sheffield South East, said: This is quite a critical issue. This is about the threat from potential cyber attack that could be launched against a legacy system, and we dont yet know what the systems are to begin with. This is quite a critical issue. This is about the threat from potential cyber attack that could be launched against a legacy system, and we dont yet know what the systems are to begin with Clive BettsLabour MP for Sheffield South East Davinson responded: Its not a simple, Whats the list? Weve asked that question of departments, and have had responses through our legacy risk framework. Weve got that understanding and we are continuing to expand that out to other organisations. [But] its not a resource-free exercise.Little added: What this part of our discussion really brings to light is that government, in a period of scarce resources, has got to make prioritised decisions based on risks and how much assurance is desired. And its for the government to set its risk appetite, and to use that risk appetite and information to allocate resources accordingly.Weve made huge progress in understanding the most significant issues that weve got [in terms of legacy], and whilst its not every single system, it is the vast majority ... [and] were using both GovAssure and our technical expertise in legacy IT to set out for ministers the choices about risk and how much risk they want to buy out. That is the fundamental question. If youve got X billion pounds available to fund people, resources, skills, to remediate legacy IT, and to invest in new technology, how you use your allocative resource has got to be risk based, and its got to be outcome based. The whole point of the Spending Review process is to bring outcomes and risks together so that ministers can make a funding allocation choice.Powell said: We are ramping up the number of systems that were looking at. We are not doing that in an exponential fashion, but I think its also worth noting that with GovAssure, we are driving the car and building it at the same time. We launched it in April 2023 following some early pilots with departments [when] it was still at an early-stage assurance process.There is much more that we can and need to do, particularly in terms of automation of that process, in terms of providing stronger support and guidance to departments in implementing it, and also in the root cause analysis to better understand the data that we are gathering from that process. It is by no means a finished product, it is by no means a perfect product, but what its already starting to do is give us the outcomes that we need in terms of understanding resilience levels and where we can take action.MPs were also concerned about the extent to which the government has, as the NAO report states, under-estimated the extent of cyber risk.Devine was candid in relation to the lateness of the introduction of GovAssure in April 2023. We probably have woken up to the scale of cyber risk more slowly than we should have done. We were probably unrealistic in relying upon self-assessment [of government departments], he said. We didnt ramp up the government response to cyber security from assurance through to response as quickly as we should have ... because we [werent] as alive to the threats as we should have been Vincent DevineCabinet Office Despite recognising this in 2010, starting to invest money significantly in 2016, we didnt ramp up the government response to cyber security from assurance through to response as quickly as we should have, in retrospect. Why? Because I dont think we were as alive to the threats as we should have been, and probably because we hadnt had the incidents that brought it to life for us that we and our allies have had over the last five years. Its not a good answer, but it is the true answer, Devine added.To that, Little added: Its really difficult to go back in time to our predecessors. Like all good risk management, you manage risks as best you can until they become an issue. When they become an issue, and theyre live and theyre real, you step up your response. Weve always known about the risks, but it wasnt until it became a real, live issue that the scale of what we were dealing with became clear, and it needs a different sort of response.The original NAO report gave, as an example of how damaging cyber attacks can be, the instance, in June 2024, of anattack on a supplier of pathology services to the NHS in south-east London, which led to two NHS foundation trusts postponing 10,152 acute outpatient appointments and 1,710 elective procedures. It also cited the British Library ransomware attack in October 2023, which has already cost 600,000 to rebuild services. The library expects to spend many times more as it continues to recover. These were mentioned in the PAC session.The report found that the biggest risk to making the UK government resilient to cyber attack is a gaping skills gap. One in three cyber security roles in government were vacant or filled by temporary and more expensive staff in 2023-24, while more than half of cyber roles in several departments were vacant, and 70% of specialist security architects were staff on temporary contracts.In the Public Accounts Committee meeting, Little said she was sad to see a continued over-reliance on contractors, but that initiatives such as a cyber security Fast Stream and a new digital pay framework were starting to have an impact.Powell added that the overall number of digital technology professionals in the civil service has grown, and stands at nearly 6%.Its not as much as wed like it to be. We are struggling with the very technical resources, and thats a market problem they are scarce in the private sector as well as in the public sector, she said.Read more about UK government cyber resilienceNAO: UK government cyber resilience weak in face of mounting threats.Local government bodies are being invited to take advantage of a new NCSC-derived Cyber Assessment Framework to help enhance their resilience and ward off cyber attacks.Labour government plans new laws around cyber security, data sharing and skills.In The Current Issue:Digital twins map the world and guide strategic decisionsLiverpool reinvents customer service through digital platformDownload Current IssueSUSE CEO: Enterprise Linux where choice happens' Open Source InsiderSLM series - OurCrowd: Are domain-specific LLMs just as good (or better)? CW Developer NetworkView All Blogs