Delayed cyberattack detection and response

#36 — HMRC acknowledges legacy IT systems and poor data management hinder AI adoption and increase cyber risks.

Public Accounts Committee

Recommendation: We asked HMRC whether the age of some of its IT systems were going to make it more difficult to adopt AI. HMRC agreed and considers the “critical thing with AI is making sure you really have a handle on …

Gov response: 6.1 The government agrees with the Committee’s recommendation. Recommendation implemented 6.2 HMRC has written to the Committee alongside this Treasury Minute response. 6.3 HMRC is well positioned to take advantage of emerging technologies, particularly AI, …

Accepted

#31 — HMRC acknowledges security concerns with third-party Making Tax Digital software, setting strict specifications.

Public Accounts Committee

Recommendation: We asked HMRC whether there were potential security concerns that could be posed by the third–party MTD software taxpayers use to submit their tax returns, including whether there were risks to HMRC’s own systems.63 In written evidence provided after our …

Not Addressed

#24 — HMRC’s legacy IT systems pose security, reliability, and cost risks.

Public Accounts Committee

Recommendation: HMRC explained that there are three key risks that arise from operating legacy systems: lower levels of security; lower reliability and resilience; and higher costs of system changes. HMRC said that its executive team and its digital team track how …

Gov response: 4.1 The government agrees with the Committee’s recommendation. Target implementation date: September 2025 4.2 HMRC will write to the Committee on its plans to address the remediation of its legacy IT systems with a forecast …

Accepted

#9 — Organised criminal groups' ransomware attacks severely disrupt public services and incur significant costs.

Public Accounts Committee

Recommendation: Organised criminal groups use ransomware and data extortion to make money.10 They do this by stealing and encrypting victims’ data and then demanding a ransom or threatening to the leak the data. In October 2023, 5 Q 2; C&AG’s Report, …

Gov response: 1.1 The government agrees with the Committee’s recommendation. Target implementation date: Autumn 2026 1.2 The government has committed in the Blueprint for Modern Digital Government to resetting the relationship with cyber and technology risk, and …

Accepted

#30 — Mandate EU transport operators inform travellers of UK personal import rules by January 2027 deadline.

Environment, Food and Rural Affairs Committee

Recommendation: Regardless of SPS negotiation timings, the Government must not delay the implementation of the requirement for EU transport operators to draw travellers’ attention to UK rules on personal imports of products of animal origin beyond 31 January 2027. (Recommendation, Paragraph …

Gov response: The government accepts this recommendation and the importance of travellers understanding the rules that apply to them. GB legislation includes a requirement for international passenger transport operators to draw the attention of their customer to …

No Published Response

#25 — Legal Aid Agency experienced significant delays in detecting and responding to cyberattack risks

Public Accounts Committee

Recommendation: We asked LAA why it had taken so long to detect the attack and to then take systems offline.48 LAA explained that the risk of a cyberattack on its systems had been rated as extremely high on MoJ’s risk registers …

Gov response: 6.5 The Chief Executive of the Legal Aid Agency (LAA) set out the initial lessons learned at the Committee evidence session in October 2025, including the need for senior leaders to ensure that cyber-vulnerabilities are …

Response Pending

#24 — Legal Aid Agency cyberattack went undetected for four months before system shutdown

Public Accounts Committee

Recommendation: MoJ and LAA acknowledged that the cyberattack on LAA’s online digital services began in December 2024, four months before the LAA detected the attack on 23 April 2025.46 LAA explained that in April, it took action to boost the security …

Gov response: 6.1 The government agrees with the Committee’s recommendation. Recommendation implemented: August 2025 6.2 The MoJ and LAA have already identified and shared lessons from the attack through several routes. Internally, across MoJ, this has taken …

Accepted

#1 — Committee reviewed HMP Dartmoor lease, legal aid provision, and LAA cyberattack management.

Public Accounts Committee

Recommendation: We took evidence from the Ministry of Justice (MoJ), HM Prison and Probation Service (HMPPS) and the Legal Aid Agency (LAA) to follow up on our recent scrutiny of several topics. This included HMPPS’s management of the lease renewal at …

Gov response: The government agrees with the Committee’s recommendation. comprehensive time-bound plan to be more systematic in supporting fee-charging public bodies, which will be shared with the Committee. As part of its remit, and as set out …

Accepted

#5 —

Defence Committee

Recommendation: There is evidence that the UK, and our allies, face many malicious cyber- attacks both from rogue individuals and state-sponsored attacks from states such as Russia and China. These attacks are diverse in their nature and in their aims. Some …

Gov response: Hostile actors must understand that irresponsible behaviour in cyberspace will carry cost. The UK and our allies will continue to expose those that aim to do us and our institutions harm. No longer can they …

Under Consideration

#20 — GovAssure reveals significant gaps and low maturity in departmental cyber resilience.

Public Accounts Committee

Recommendation: In 2023, the Cabinet Office launched ‘GovAssure’, a cyber security assurance scheme, as part of its strategy to improve government organisations’ cyber resilience. Before GovAssure, departments self–assessed their performance against minimum cyber standards set by the Cabinet Office.43 In the …

Gov response: 4.1 The government agrees with the Committee’s recommendation. Target implementation date: Spring 2026 4.2 DSIT is currently improving the way that they collect data on legacy systems across government. 4.3 Departments will continue to be …

Accepted

#19 — Government Cyber Coordination Centre improves information sharing but remains in early stages.

Public Accounts Committee

Recommendation: We asked the Cabinet Office what structures it had in place to share information about cyber security with permanent secretaries and throughout departments.40 The Cabinet Office told us that it had launched the Government Cyber Coordination Centre (GC3) in September …

Gov response: 3.1 The government agrees with the Committee’s recommendation. Target implementation date: Spring 2026 3.2 The government recognises the importance of embedding security expertise at the heart of departmental decision making. 3.3 There is a clear …

Accepted

#18 — Departments remain reluctant to share cyber incident information, hindering collective learning.

Public Accounts Committee

Recommendation: We asked the Cabinet Office what the impact was when departments did not share information about their cyber incidents. The Cabinet Office agreed that sharing data is essential to learn lessons, understand vulnerabilities, share best practice and work out what …

Gov response: 3.1 The government agrees with the Committee’s recommendation. Target implementation date: Spring 2026 3.2 The government recognises the importance of embedding security expertise at the heart of departmental decision making. 3.3 There is a clear …

Accepted

#11 — Government's current cyber resilience levels remain inadequate to effectively respond and recover from attacks.

Public Accounts Committee

Recommendation: We pressed the Cabinet Office on what assurance it could give us that government was keeping up with the cyber threat.17 The Cabinet Office’s assessment was that there was already a gap in government’s ability to respond and that this …

Gov response: 1.1 The government agrees with the Committee’s recommendation. Target implementation date: Autumn 2026 1.2 The government has committed in the Blueprint for Modern Digital Government to resetting the relationship with cyber and technology risk, and …

Accepted

#8 — Nation states pose increasing risk of espionage and disruptive cyber attacks on essential services.

Public Accounts Committee

Recommendation: The Cabinet Office highlighted concerns about nation states’ intent to conduct espionage and disrupt essential services.8 It described a campaign of espionage by Russian military intelligence that involved stealing and leaking data, and defacing websites. The Cabinet Office considered disruptive …

Gov response: 1.1 The government agrees with the Committee’s recommendation. Target implementation date: Autumn 2026 1.2 The government has committed in the Blueprint for Modern Digital Government to resetting the relationship with cyber and technology risk, and …

Accepted

#7 — Government faces rapidly evolving and increasingly sophisticated cyber threats from capable adversaries.

Public Accounts Committee

Recommendation: The Cabinet Office told us that we should be extremely worried by the rapidly evolving cyber threat, which is the most sophisticated it has ever been. It explained that over the last three years, government’s adversaries, which include nation states …

Gov response: 1.1 The government agrees with the Committee’s recommendation. Target implementation date: Autumn 2026 1.2 The government has committed in the Blueprint for Modern Digital Government to resetting the relationship with cyber and technology risk, and …

Accepted

#26 — Legal Aid Agency acknowledges critical lessons learned from cyberattack response and provider burden

Public Accounts Committee

Recommendation: LAA acknowledged that contingency measures it put in place to keep the legal aid system going placed additional burdens on providers, and that there are several lessons to be learned from the attack. This included, ensuring senior leaders understand risks …

Gov response: 6.5 The Chief Executive of the Legal Aid Agency (LAA) set out the initial lessons learned at the Committee evidence session in October 2025, including the need for senior leaders to ensure that cyber-vulnerabilities are …

Response Pending

#6 — Require MoJ and LAA to detail cyberattack lessons and funding for system vulnerabilities.

Public Accounts Committee

Recommendation: Despite lessons learned from the cyberattack on the LAA, funding to address weaknesses across MoJ systems is uncertain. Vulnerabilities in LAA’s systems had been on MoJ’s risk register since 2021. However, MoJ’s investment of over £50 million to transform and …

Gov response: The government agrees with the Committee’s recommendation. several routes. Internally, across MoJ, this has taken place at: MoJ Audit and Risk Assurance Committee; within the MoJ Executive Committee and Senior Leadership Group; and with the …

Accepted

#25 — Department maintains a prioritised cyber incident response and business continuity framework

Public Accounts Committee

Recommendation: The Department explained that it had a security incident response framework in place that, in the case of a cyber attack, would enable it to keep its services running as much as possible. It told us that its business continuity …

Gov response: 5.1 The government agrees with the Committee’s recommendation. Recommendation implemented 5.2 By 2030-31 the department’s legacy systems will become outdated. This could affect the department’s ability to deliver services efficiently and may lead to higher …

Response Pending

#20 —

Public Accounts Committee

Recommendation: In our 2018 report on the WannaCry Cyber-attack on the NHS, we found that the Department and its arm’s-length bodies were unprepared for the relatively unsophisticated WannaCry attack and had a lot of work to do to improve cyber-security for …

Not Addressed

#8 —

Public Accounts Committee

Recommendation: The risks associated with legacy systems include that they can be difficult and expensive to support, lack operational resilience for key government services, and be vulnerable to cyber-attack. This exposes government to what is likely to be an uncertain but …

Gov response: 2: PAC conclusion: There is no clear plan to replace or modernise legacy systems and data that are critical to service provision but are often old, unsupportable, vulnerable and a constraint on transformation. 2: PAC …

Not Addressed

#7 — Legacy IT systems pose significant risks to government AI adoption and cybersecurity.

Public Accounts Committee

Recommendation: DSIT told us that it was a matter of urgency that the issue of legacy systems in government is addressed, not only to take advantage of the opportunities offered by AI, but also to address other risks including cyber security …

Gov response: The government agrees with the Committee’s recommendation. Target implementation date: Winter 2025 1.2 The Department for Science, Innovation and Technology (DSIT) will carry out this work in two steps. Firstly, working with HM Treasury (HMT), …

Accepted

#31 — Over-reliance on limited strategic IT suppliers creates significant cyber security risks.

Public Accounts Committee

Recommendation: Based on written evidence, we asked the Cabinet Office about the advantages and disadvantages of relying on a few strategic suppliers.67 The Cabinet Office acknowledged that trying to maximise value for money and interoperability while managing the risks was not …

Gov response: 5.1 The government agrees with the Committee’s recommendation. Target implementation date: Spring 2026 5.2 The government recognises the importance of managing the risk in ALBs and their supply chains. Whilst services can and in many …

Accepted

#30 — Government faces complex challenges managing cyber security risk within its supply chain.

Public Accounts Committee

Recommendation: We asked the Cabinet Office how Government managed the cyber security of its supply chain. The Cabinet Office told us that managing supply chain risk was complex and difficult. Government’s supply chain has been the source of incidents with serious …

Gov response: 5.1 The government agrees with the Committee’s recommendation. Target implementation date: Spring 2026 5.2 The government recognises the importance of managing the risk in ALBs and their supply chains. Whilst services can and in many …

Accepted

#16 — Departments demonstrate insufficient ownership of cyber risk and hinder information sharing.

Public Accounts Committee

Recommendation: Accounting officers in departments are responsible for protecting the security of their organisations and managing their department’s cyber risk, but they have not taken sufficient ownership of this responsibility. Often, membership of departments’ most senior boards does not include a …

Gov response: 3.1 The government agrees with the Committee’s recommendation. Target implementation date: Spring 2026 3.2 The government recognises the importance of embedding security expertise at the heart of departmental decision making. 3.3 There is a clear …

Accepted

#22 — Collaborate with platforms to identify and track disinformation actors and their online spreading techniques.

Science, Innovation and Technology Committee

Recommendation: Foreign interference and disinformation campaigns, with use of technology such as bots and AI, put UK citizens at risk. The possibility that some of the divisive messages and deceptive content spread by users—and amplified by algorithms—last summer were part of …

Gov response: We recognise the risk that foreign interference in the UK can pose, both to society as a whole and individuals. Our analysis published at the end of 2024 highlighted a variety of ways in which …

Not Addressed

#21 —

Public Accounts Committee

Recommendation: As HMRC moves towards a fully digital tax system, the capability of its IT systems, including in terms of cyber security, will become increasingly important to HMRC’s ability to operate effectively. HMRC has recognised that, due to the need in …

Gov response: 5.1 The government agrees with the Committee’s recommendation. Recommendation implemented 5.2 The department has been addressing its legacy technical debt since 2019 and received funding of £268 million at the 2020 Spending Review to continue …

Under Consideration

#6 —

Public Accounts Committee

Recommendation: A significant software update is needed to begin Trial Operations, which will allow up to 24 trains an hour to run through the central section.10 Any unexpected issues with software may take time to fix and we have reported on …

Gov response: agree with the Committee’s conclusion. The £16.5 billion extra funding from Spending Review 2020 will support the aims and priorities outlined in the Integrated Review to better counter developing and future threats. Further detail and …

Under Consideration

#23 —

Public Accounts Committee

Recommendation: As the NAO reported, the PNC’s current technology will no longer be fully supported beyond 2024. The Department told the NAO that it had decided to accept the risk of running the PNC without support for the database after 2024.46 …

Not Addressed

#22 —

Public Accounts Committee

Recommendation: The Department also confirmed that there had been an outage earlier this year, which was due to a problem with network availability and the ‘wider PNC ecosystem’ in its Hendon data centre, affecting the ability of the police to access …

Not Addressed

#21 —

Public Accounts Committee

Recommendation: Concerning the January 2021 incident, the Department told us that all deleted data had now been recovered and everything that had gone wrong in January had been put right.38 The Department said that the data had been recovered by the …

Not Addressed

#20 —

Public Accounts Committee

Recommendation: The PNC has consistently met its service availability targets in recent years; from January 2020 to March 2021 the PNC’s availability was 99.74%, exceeding the Department’s target of 99.65%. However, in January 2021, the PNC experienced a data loss affecting …

Not Addressed

#4 —

Public Accounts Committee

Recommendation: The police must continue to rely on the PNC for another five years, despite the risks to its availability. The PNC is the most important law enforcement technology system in the UK, and it is vital that it is constantly …

Gov response: 5. PAC conclusion: Departments often struggle to track benefits as closely as they track costs

Under Consideration

#2 —

Public Accounts Committee

Recommendation: There is no clear plan to replace or modernise legacy systems and data that are critical to service provision but are often old, unsupportable, vulnerable and a constraint on transformation. Legacy systems, some of which date back to the 1970s, …

Gov response: 2022. It should report against these metrics annually to enable Parliament and the public to determine what progress it is making towards meeting the objectives set out in the Government’s 25 Year Environment Plan. 2.1 …

Accepted

#19 —

Public Accounts Committee

Recommendation: The government’s decision in July 2020 to reduce its dependency on technology originating from certain high-risk vendors could introduce delays and additional expense to nationwide roll-out.61 The Department estimated that the removal of high-risk vendors’ 52 DRB0004 DCMS recall (Broadband), …

Gov response: 6.2 BDUK will publish its profile to reach at least 5% of non-commercial premises by the end of 2025 in its 2022-23 corporate plan. As well as achieving the 85% target, the contracts that BDUK …

Not Addressed

#20 —

Public Accounts Committee

Recommendation: The Department has a substantial legacy technology estate, in part because it has not prioritised the investment needed to keep it up to date.63 Defence Digital, the organisation responsible for leading on the digital strategy, estimates it will cost £11.7 …

Not Addressed

#23 — Cabinet Office preparing contingencies for Capita's IT readiness, awaiting September 'go/no-go' decision

Public Accounts Committee

Recommendation: We checked with the Cabinet Office what contingency plans it had should Capita’s IT systems not be ready on the transition date. The Cabinet Office asserted that it had several plans, including a more gradual roll-out of the Capita technology, …

Gov response: 5. PAC conclusion: There is a clear risk that Capita will not be ready to take over administration of the Scheme as planned on 1st December 2025. 5. PAC recommendation: • The Cabinet Office needs …

Accepted

#11 —

Defence Committee

Recommendation: Prior to the US sanctions announced in May, the risk of Huawei products remaining in the UK’s 5G networks was, according to the Government, significant but manageable through monitoring and regulation. The situation changed when Huawei was deprived of reliable …

Gov response: The Government welcomes the Committee’s conclusions and recognition of the Government’s response to the changed context. The Government’s position as set out in January related to high risk vendors generally; however, the US sanctions in …

Under Consideration

#18 —

Public Accounts Committee

Recommendation: The Department has outlined plans to ensure Border Crossing systems are available at crossing points other than the 56 major entry points which will have permanent access to the system. The Department stated that this will involve a mobile capability …

Gov response: The government has nothing further to add to the evidence it gave to the Committee at the hearing on 1 February 2021.

Under Consideration

#17 —

Public Accounts Committee

Recommendation: The latest roll-out of Border Crossing started on time at the beginning of December

Gov response: 5: PAC conclusion: We see a clear risk that the Department will not be able to deliver the programme by the end of March 2022. 5: PAC recommendation: The Department should set out and explain …

Under Consideration

#11 —

Public Accounts Committee

Recommendation: The telephone system Capita uses in the live service for its operations—including contacting offenders—has been in place since 2005. Since May 2021, there have been six 13 Q 24; C&AG’s report, paras 3.6–3.7 14 Q 36 15 Qq 33, 36 …

Gov response: 2.2 His Majesty’s Prison and Probation Service (the agency) has successfully completed the first stages of technical refresh, including replacing obsolete field officer tablet applications and addressing IT health check findings. Further remediation work, including …

Partially Accepted

#10 —

Public Accounts Committee

Recommendation: HMPPS intended Gemini to replace the current case management system (‘Integrity’) which had been in use since 2012 and must now be relied on until 2024. The NAO found that many of its applications were no longer supported by manufacturers …

Gov response: 2.2 His Majesty’s Prison and Probation Service (the agency) has successfully completed the first stages of technical refresh, including replacing obsolete field officer tablet applications and addressing IT health check findings. Further remediation work, including …

Partially Accepted

#21 —

Foreign Affairs Committee

Recommendation: Taiwan is under considerable pressure as China pursues targeted foreign information manipulation and interference campaigns to sway public opinion and change the terms of international diplomatic engagement. There are increasing concerns that increased hybrid attacks are setting the ground for …

Response Pending

#15 — Defra lacks a clear strategy for transforming digital services despite a 10-year transformation goal.

Public Accounts Committee

Recommendation: Defra told us that it had so far focused on stabilising its legacy applications to reduce the risks of cyber-attack or operational failure and on developing and implementing the IT systems needed for EU Exit, rather than work to reduce …

Gov response: The government agrees with the Committee’s recommendation. Target implementation date: March 2024. Defra’s Executive Committee (ExCo) approved a long-term approach to digital and data for Defra and its biggest arm’s length bodies in June 2023, …

Accepted

#10 — Defra's legacy system resolution extends to 2030, with many applications requiring "hyper-care".

Public Accounts Committee

Recommendation: The NAO also found that Defra did not expect to resolve all its legacy issues until 2030.15 For example, Defra told us that it had worked with the Central Digital & Data Office (CDDO) to establish which services were most …

Gov response: The government agrees with the Committee’s recommendation. Recommendation implemented. Defra is modernising its services and putting users at the heart of developing service improvements. Defra will use best practice techniques such as user research, business …

Accepted

#14 — Ofcom has yet to develop automated data collection systems for non-supervised providers.

Public Accounts Committee

Recommendation: For the non-supervised service providers, Ofcom will monitor their compliance through automated data collection and analysis processes, supported by information from partner organisations that deal with the various harms. Ofcom told us that it has yet to develop the automated …

Gov response: 3.1 The government agrees with the Committee’s recommendation. Target implementation date: Spring 2025 3.2 Given the scale and scope of the regime, Ofcom is designing data-driven tools to identify potential risks, including non-compliance. 3.3 A …

Accepted

#10 —

Defence Committee

Recommendation: Furthermore, whilst the risk remained manageable, it is important to remember the benefits in having a greater number of vendors involved in 5G network provision, despite the designation as high-risk, as this improves overall network resilience should a single vendor …

Gov response: The Government agrees that the UK market will benefit from a greater number of vendors. We have developed the 5G Supply Chain Diversification Strategy, published on 30 November, to diversify the supply chain. We are …

Accepted

#54 —

International Development Committee

Recommendation: Basic services were cut off at the start of the conflict and more than 4.5 million people have been without adequate power or communications for more than four months.129 Filippo Grandi pointed out that the closure of the banking and …

Gov response: The UK will work through the multilateral system, in partnership with other donors, to address the restoration of basic services drawing on experience from other crises. At present the level of insecurity means that basic …

Not Addressed

#6 —

Public Accounts Committee

Recommendation: There is a risk that the Department still lacks the capacity to prioritise and deliver major digital programmes on time. In common with many other government departments and agencies, the Department is reliant on a range of legacy technology systems …

Gov response: 1. PAC conclusion: The pandemic has demonstrated the importance of departments retaining sufficient capacity to respond to emergencies when identifying potential efficiencies.

Under Consideration

#7 —

Public Accounts Committee

Recommendation: Government’s ambition for the UK to have the “world’s most effective border by 2025” relies on cross-government digital programmes, in which it does not have a good track record. In December 2020 the government published its strategy to put in …

Gov response: 7.1 The government agrees with the Committee’s recommendation. Target implementation date: October 2022 7.2 Delivery of the 2025 Border Strategy is well underway, and programmes and pilots will deliver tangible benefits to UK businesses over …

Not Addressed

#7 —

Health and Social Care Committee

Recommendation: The Government and NHS England must set out detailed plans for how the £2.3 billion investment in Community Diagnostic Centres will be utilised, in particular detailing how many additional CT, MRI and PET-CT scanners and endoscopy suites the investment will …

Gov response: The Department and the NHS have published the Delivery Plan for Tackling the COVID-19 Backlog of Elective Care. This plan sets out a clear vision for how the NHS will recover and expand elective services …

Under Consideration