Cybersecurity Policy Report, Cyber Threat to U.K. Government Requires Urgent Response, Parliament Committee Warns, (May 12, 2025)
A United Kingdom parliamentary committee is warning of a “substantial gap” between the cyber threat to U.K. government networks and the government’s ability to defend itself.
“The severity and nature of the cyber threat to the government has evolved more rapidly than the Cabinet Office anticipated,” the Public Accounts Committee said in a report published Friday.
The committee noted that the government only recently assessed a subset of its systems to evaluate their cyber resilience, and the survey showed that a large number of systems used hard-to-defend legacy information technology.
“Alarmingly, the government estimates that risky ‘legacy’ IT systems make up 28% of the public sector’s IT estate, and substantial gaps also still remain in its understanding of the estate’s resilience to attack,” the committee said in a news release.
“By January 2025, 319 legacy systems had been identified as in use across government, ‘red’-rating around 25% as having a high likelihood and impact of risks occurring; but government does not know how many legacy systems there are in total,” it said.
“We recognise that the size and complexity of the public sector, and its supply chains, make it challenging for government to manage cyber risk. However, it is unacceptable that the centre of government does not know how many legacy IT systems exist in government and therefore cannot manage the associated cyber risks,” it said.
Aside from legacy systems, the government has fallen behind in hiring cybersecurity personnel due to low salaries and recruitment shortfalls, the committee added.
The committee, which is responsible for overseeing government expenditures, recommended, among other things, that the government assess its cybersecurity posture, including efforts to replace legacy systems and boosting the hiring of cyber professionals.
“Government Departments are beginning to wake up to the serious cyber threat they face,” said Geoffrey Clifton-Brown, the committee’s chair, who described the U.K. government’s cyber “battlements” as “crumbling.”
“If the Government is to meet its own ambition to harden resilience in the wider public sector, a fundamental step change will be required,” Mr. Clifton-Brown said.
“This will involve infusing every top team with the required digital expertise, with cyber and digital specialists at the top level of every department, both management and boards to bring about a change in thinking throughout the civil service for greater threat awareness and digital transformation,” he said.
“Part of this will be government finally grasping the nettle on offering competitive salaries for digital professionals,” he added. “For too long, Whitehall has been unwilling to offer attractive remuneration for experts who are able to secure high-paid work elsewhere.”
News: InternationalLegislation DataSecurity