NAO: UK government cyber resilience weak in face of mounting threats

Cyber resilience gaps

The NAO evaluated whether government is keeping pace with the rapidly evolving cyber threat it faces from hostile actors. It found that it is not.

It spotted that the government’s cyber assurance scheme, GovAssure, which had independently assessed 58 critical departmental IT systems by August 2024, found significant gaps in cyber resilience, with multiple fundamental system controls at low levels of maturity across departments. GovAssure assesses the critical systems of government organisations. It was set up in April 2023.

According to the NAO report, government departments were using at least 228 legacy IT systems as of March 2024, and the government does not know how vulnerable these systems are to cyber attack.

The report noted that in April 2024, the Cabinet Office Government Security Group (GSG) reported to ministers that some departments had significantly reduced their cyber security improvement programmes to fund other priorities. This was due to “cuts to programme funding, lack of access to cyber skills, challenges with delivery partners, and delays in departmental and cross-government approvals”.

As examples of how damaging cyber attacks can be, the NAO cited the instance, in June 2024, of an attack on a supplier of pathology services to the NHS in south-east London, which led to two NHS foundation trusts postponing 10,152 acute outpatient appointments and 1,710 elective procedures. It also cited the British Library ransomware attack in October 2023, which has already cost £600,000 to rebuild its services. The library expects to spend many times more as it continues to recover.

The report also gave other examples of attacks on the Ministry of Defence and Parliament. In May 2024, the MoD’s payroll contractor’s network was compromised by an attacker – a network that held armed forces staff members’ data. Further back in time, in 2021, a Chinese state-affiliated attacker was, said the report, highly likely responsible for a cyber campaign against the parliamentary email accounts of members across both Houses of Parliament.

The report stated that in March 2024, departments did not have fully funded plans to remediate around half of government’s legacy IT assets – 53%, or 120 out of 228.

The NAO recommends the government develops, shares and starts using a cross-government implementation plan for the Government Cyber Security Strategy within the next six months. It also suggests the whole of government needs to operate differently.

Within the next year, the government should make and enact plans to fill cyber skills gaps in workforces, said the NAO.

Of the technology trumpeted most by the current and previous government – artificial intelligence (AI) – the report said: “AI can improve government’s cyber security, but it can also help threat actors looking to interfere or undermine trust in our democratic system. The NCSC is collaborating with its partners to realise the benefits of AI and protect against the associated security risks.”