Assessing the aims of the Government Cyber Security Strategy

Integration will be key

Success will be determined by the levels of integration achieved across government, regions, with industry partners and specialist organisations, maybe even with our international allies.

The strategy enables cross-government integration through the creation of the GCCC and the use of the CAF. It will also be important to integrate with all the people required to deliver this strategy – it is not just about cyber security specialists. Human resources, commercial, and technology specialists, as well as programme management and change specialists, will also be needed to embed cyber security across an organisation.

Government should also look to learn from the experiences and capabilities of industries such as financial services or critical national infrastructure (CNI), which have developed more mature approaches to cyber security.

These organisations already use the tools in this strategy (including the CAF), and we can learn from their offerings. They have also been through long and difficult journeys to arrive at their current capabilities. By learning where they went wrong, these pitfalls can be avoided, and delivery can be more focused on the right answers and thus accelerated.

Engage leadership early

Developing the right cyber security skills, knowledge and culture is a key objective in this strategy and underpins the other four.

Although the strategy focuses mainly on training and maintaining the cyber workforce and increasing cyber awareness across departments, this can all wait as operational leadership must be engaged first.

To get this work started quickly, organisational and departmental leadership need to understand and prioritise the delivery of this strategy. This will require strategic direction from the top, informed by clear cyber risk management reporting, with all impacts aligned to operational effects.

Helping senior, non-technical executives understand cyber risks and compare them to other operational risks will support their decision making and lead to the accelerated delivery of the strategy’s outcomes. 

One bite at a time

Across government, processes to justify investment in large programmes, and gain approvals, are often long and delay the start of delivery. This will be exacerbated with the current budget challenges, as departments have to prioritise and do more with less. In particular, many smaller departments and their arm’s-length bodies will be starting from a less mature position, giving them a huge amount to do. 

To tackle this, they should adopt a ‘think big, start small and scale fast’ approach while continuously engaging with all stakeholders. That means investing time in understanding the work required, breaking it into prioritised, manageable bites and looking for ways to begin delivery rapidly. This could be by starting a small project which can be justified quickly or by attaching deliverables – like a secure by design process – to existing programmes (not necessarily cyber security programmes) which are already funded.

While this initial delivery work is being done, departments can focus on building larger cyber transformation programmes to enable the work to scale up and deliver fast. This approach has proven to speed up delivery and improve cyber security capabilities for many organisations across sectors. It was especially effective when delivering the major improvements required to secure remote working during the Covid-19 crisis, particularly helping small and medium-sized organisations adapt quickly under difficult circumstances.

This combination of integration, clear leadership and breaking down the task into manageable pieces will be critical to both sustainably meeting the strategy’s ambitions and starting delivery quickly to build buy-in and confidence.

This article was written by Laura Marsden, public services and cyber security expert, and Chris Goslin, cyber transformation expert at PA Consulting.