06 Feb 2025

National Audit Office report into Government Cyber Resilience Published

The National Audit Office have published a report into the cyber resilience of the UK's central government bodies, highlighting significant security threats and critical shortcomings that have hindered progress in strengthening resilience. As cyber incidents continue to rise, the report underscores the urgent need for improvement.

The report examines the government's efforts to improve it's own cyber resilience and whether these efforts have kept pace with the scale and sophistication of the cyber threats they face today. It aims to hold the government accountable while advocating for greater transparency into its cyber security capabilities.

The report outlines several key findings:

A shortage of digital skills among senior government leaders has created a strategic disconnect, preventing departments from fully understanding the impact of cyber risks and weakening decision-making on cyber resilience.
Widespread reliance on outdated IT systems presents a major security risk. Many of these systems have known vulnerabilities, and the government lacks full visibility into the risks they pose.
Over 50% of fundamental cyber resilience controls, including asset management and incident response planning, remain at low maturity levels, leaving security gaps that threat actors could exploit.
The government faces persistent workforce shortages, limiting its ability to respond effectively to cyber threats. Resource constraints within the Government Security Group (GSG) further slow the implementation of crucial resilience initiatives.
High-profile cyber attacks, such as the one affecting the British Library, illustrate the severe financial and operational consequences of inadequate cyber defences.
The report advocates for a more rigorous approach to cyber security, particularly to mitigate risks associated with legacy IT.

Conclusions:

The report identifies systemic barriers that have slowed progress. While acknowledging centrally led initiatives such as GovAssure and the implementation of Secure by Design principles, it emphasises the need for a whole-system approach to cyber resilience. To meet the Government Security Group’s 2030 ambitions, the government must address critical issues around skills, legacy IT, and accountability.

You can read the report here.

Jill Broom

Head of Cyber Resilience, techUK

Annie Collings

Programme Manager, Cyber Resilience, techUK

Tracy Modha

Team Assistant - Markets, techUK

Return to listing