Cybersecurity Policy Report, Cybersecurity Failures Prompt U.K. Government to Set New Path, (Jan 6, 2026)
The government of the United Kingdom intends to replace hard-to-secure legacy technology and hold government agencies accountable for data breaches under a Government Cyber Action Plan published today.
The action plan acknowledges that the government’s existing approach to cybersecurity has been unsuccessful at securing government systems and the data they hold about U.K. citizens.
“The UK has experienced repeated, systemic failures in our digital resilience and we know from experience that these pose unacceptable costs to UK citizens, from compromised personal data, to loss of access to basic public services,” it says.
“These failures are not hypothetical risks, they are recurring realities that result in service breakdown, harm to the public and erosion of trust in these services by the communities who rely on them,” according to the plan.
The plan admits that the government won’t meet its own target, established by the 2022 Government Cyber Security Strategy, “for all government organisations to be resilient to known vulnerabilities and attack methods” by 2030 (CPR, Jan. 26, 2022).
“To protect our critical national infrastructure, defend public institutions and maintain public confidence in essential public services, we must achieve a radical shift in approach and a step change in pace,” it says.
The plan seeks to reset the government’s approach to cybersecurity by establishing a central authority, the Government Cyber Unit, within the Department for Science, Innovation, and Technology (DSIT). Rather than making recommendations to other government agencies, DSIT intends to issue mandates to agencies along with “targeted support” to build better cyber defenses.
“Current accountability structures have failed to achieve the right level of resilience. Responsibilities for cyber risks are unclear at all levels of government, including across the supply chain,” the plan says.
Another cornerstone of the plan is the elimination of legacy technology systems that are too hard to defend. Those upgrades would be financed with proposed funding of 210 million pounds sterling ($284 million).
DSIT linked the action plan to the proposed Cyber Security and Resilience Bill, which had its second reading in the House of Commons today. While the bill aims to strengthen private-sector cyber defenses, the action plan does the same for the public sector, DSIT said.
“This plan sets a new bar to bolster the defences of our public sector, putting cyber-criminals on warning that we are going further and faster to protect the UK’s businesses and public services alike,” Digital Government Minister Ian Murray said in a news release.
The action plan will be implemented in three phases ending in April 2029. By April 2027, DSIT expects to establish the Government Cyber Unit and set “clear targets and standards for government organisations,” among other things.
“This is not just a technical transformation. It is a cultural and operational shift in how the government views resilience,” the plan says.
“Every leader, every public sector organisation, every supplier has a role to play,” it adds. “Together, with clarity of purpose and shared accountability, we can deliver a government that is more secure, more resilient, and able to protect the services on which citizens depend.”
MainStory: TopStory InternationalLegislation DataSecurity