NCSC commits to new diversity measures

LGBTQ+

The picture was similarly positive with regard to the number of people who identify as lesbian, gay or bisexual, which stands at 10%, significantly higher than the 2.2% of the UK population who declared themselves as such in the Office for National Statistics’ (ONS’) 2018 data.

The NCSC separates out trans and non-binary people in its reporting, and stated that about 1% of the cyber workforce is made up of trans women and men, or people who are non-binary, in line with the wider population. The NCSC said it had, however, noted a sharp rise in the number of LGBTQ+ people who felt uncomfortable disclosing their identity in the workplace. This may reflect to some extent a climate of increased mainstream hostility towards LGBTQ+ people, especially trans women and men.

In terms of ethnic diversity, the cyber workforce is roughly in line with national figures, with people from BAME backgrounds marginally increasing to 15% from 13% this time last year. The NCSC found a significant jump in the number of black people in security who felt able to be themselves in the workplace, which may reflect wider trends arising from the Black Lives Matter movement.

However, in terms of representation of women, there is clearly still much work to be done. Although 36% of security pros are women, up from 31% last year, this change reflects in part a change to the wording of the question to align with the 2021 Census, and still falls far short of parity. Notably, it found there were more women at relatively early stages of their security careers, with senior security leaders and CISOs much more likely to be men. Nevertheless, said the NCSC, representation of women is significantly higher than that recorded in other similar studies.

Dione Le Tissier, defence director in KPMG UK’s People and Change practice, said: “It’s so important that people working across the sector can thrive and reach their full potential, regardless of their gender identity, ethnicity, disability, sexual orientation or socio-economic background.

“And while we’re seeing improvements in representation, the research shows that there is plenty of work to be done to deliver progressive change and create diverse and inclusive working environments.

“This research delivers vital insight, lifting the lid on the sector so we can better understand how individuals feel about working in cyber security and key areas for improvement.”

Lowering barriers to entry

Simon Hepburn, CEO of the UK Cyber Security Council, which has adopted diversity and inclusion (D&I) as one of its four pillars, said the report’s recommendations, if solidly researched and implemented correctly, could play a huge part in lowering barriers to entry into the world of security.

“The sector must succeed at this,” he said. “It’s vital not just to help the sector fill the tens of thousands of vacancies that exist, but for the sector and the UK to benefit from the wider range of abilities, improved creativity, different thinking and alternative contributions of a truly diverse, inclusive cyber security workforce.

“The Council and the NCSC are in lockstep over the D&I objectives for the sector and, to that end, we also welcome and agree with the conclusions of the report,” said Hepburn.

“Second, we’re very aware that the recommendations in the report are – as they must be in such a report – largely about what needs to be done, and we’re conscious that little may change unless the sector proceeds to address how to do what needs to be done; programmes will need to be devised and executed,” he said.

“The Council will therefore play its full role in devising, driving and supporting D&I programmes, through the Council membership we are at the start of building. I encourage cyber-related organisations that want to lead the way in D&I, and which want to show the sector that they’re leading the way, to join us without delay. There is much to do.”