National Cyber Security Strategy mostly failing, says PAC report

The National Cyber Security Strategy (NCSS) is mostly failing, with the Cabinet Office set to achieve only one strategic outcome of the 12 objectives it aimed to deliver by 2021, a damning Public Accounts Committee (PAC) report has found.

According to the report released 5 June, the department has given evidence that it did not intend to achieve all the outcomes outlined in the 2016-2021 strategy, nor was it able to say how many it did intend to achieve.

The 12 outcomes of the NCSS, a five-year, cross-government strategy with a budget of £1.9bn, include cyber crime detection and prevention, managing risk in the critical national infrastructure, and development of cyber security skills.

The single outcome the Cabinet Office will be able to deliver by the end of the current term is incident management, the PAC report said, adding that the department demonstrated low confidence regarding its ability to achieve the other goals.

Incident management, according to the NCSS, is “the management and coordination of activities to investigate, and remediate, an actual or potential occurrence of an adverse cyber event that may compromise or cause harm to a system or network”.

The Cabinet Office has yet to set out its plans for cyber security once the current term ends, the report added, recommending that a long-term approach is put in place well in advance of the end of the current strategy in 2021.

In addition, the Cabinet Office cannot justify the value for taxpayers’ money from the current approach to national security, the PAC report pointed out.

It added that the absence of a business case for the NCSS and the National Cyber Security Programme (NCSP), coupled with the fact that the department did not assess if funding was sufficient for delivery of the initiatives, makes it even harder to assess value for money.

In light of this, the report recommends that a properly costed business case should be produced to support future cyber security work after 2021.

Despite recognising that cyber security is a difficult area for government to influence and regulate, the PAC report acknowledged that the government has made some progress around enhancing cyber security to protect consumers and businesses.

However, it did argue that it is still difficult for consumers to know whether connected devices or online services that hold personal information are safe to use, and highlighted the lack of a traffic light-type system to inform consumer choice.

It also added that government must do more around getting large organisations to take ownership of the issue and encourage smaller and more vulnerable companies within their supply chains to “get their cyber security right”.

Within its recommendations, the PAC report requested a response from the Cabinet Office around how it plans to influence business sectors such as retail to inform consumers about their cyber security readiness and how they plan on measuring success in that area.

Shadow cabinet minister Jo Platt said the report confirms the Conservative party’s “fundamental mishandling” of the UK’s cyber security.

“For the government to fail to achieve 11 of their own 12 strategic outcomes is an admission of their inability to get a grip on the cyber landscape, which we all ultimately pay the price for,” Platt said.

“Whether it’s the syphoning of funding away from the strategy, the failure to promote good cyber practice among consumers or the incompetent management of the strategy, this report serves as a declaration of no confidence in the Conservatives to keep us safe in the digital age,” she added.

Amid her criticisms of the government’s approach to the issue, Platt has argued that the current administration does not provide the leadership that the government and public need around cyber security and has called for the creation of a dedicated ministry.  

The PAC report follows another blistering report by the National Audit Office (NAO) published in March 2019, where concerns were raised about the government’s ability to meet the NCSS goals and protect UK citizens, business and the national infrastructure from cyber attacks.

Similarly, the NAO also touched on the issue of funding allocation and prioritisation around national cyber security work, and said the government “needs to learn from its mistakes and experiences to meet this growing threat”.