The IT Nerd

The UK has unveiled the Government Cyber Action Plan, a key element of which is the creation of a new Government Cyber Unit which will coordinate cyber risk management, improve visibility of risks across government, and oversee incident response and recovery. The Plan is backed by £210 million in funding, aimed at strengthening cybersecurity and digital resilience across government departments and public services.

The Plan reads:  “To protect our critical national infrastructure, defend public institutions and maintain public confidence in essential public services, we must achieve a radical shift in approach and a step change in pace.” Its goals:

1. Better visibility of cyber security and resilience risk
2. Addressing severe and complex risks
3. Improving responsiveness to fast moving events
4. Rapidly increasing government-wide cyber resilience

The Cyber Unit will drive progress towards these strategic objectives by working with NCSC, departments, devolved governments, and suppliers, and will lead cross-government delivery in phases:

• By April 2027 – build a new model for government cyber
• By April 2029 – scale and leverage this new model
• By April 2029 and beyond – use the model to continuously improve government-wide cyber security and resilience

The Action Plan is published alongside the Cyber Security and Resilience Bill which defines expectations for suppliers and organizations providing services to government, and includes initiatives like the Software Security Ambassador Scheme to strengthen the software supply chain. 

Here’s input from cybersecurity experts on the Action Plan.

Ted Miracco, CEO, Approov (UK mobile security expert):

    “The UK government is right to invest £210 million to fix the ‘fragile foundations’ of its legacy systems. However, the plan leaves blind spots as it pushes for faster and more accessible digital services without setting concrete, mandatory rules for mobile devices or the data connections (APIs) they rely on. Currently, this plan groups mobile security under a voluntary Software Security Code of Practice and general Secure by Design goals. This is risky as the government acknowledges that ‘generative AI’ is a top-tier threat, yet it hasn’t established specific defenses for the mobile interfaces that AI tools will inevitably target next.”

Michael Bell, CEO, Suzu Labs:

    “The UK government published a cyber strategy that names the problem. They explicitly acknowledge that government cyber risk is “critically high” and legacy systems “cannot be defended by modern cyber security measures.” The new Government Cyber Unit brings centralized coordination for risk management and incident response, which addresses the fragmented responsibility that has left departments making security decisions in isolation. The four-year implementation timeline is ambitious for government, but the phased approach is realistic. What matters now is execution, specifically whether departments actually replace legacy systems and implement the security controls the strategy mandates.”

Jacob Krell, Senior Director: Secure AI Solutions & Cybersecurity, Suzu Labs:

   “The plan being proposed is timely given today’s cyber threat landscape. Heightening geopolitical tensions worldwide, combined with the rapid advancement of artificial intelligence, are materially changing both the volume and sophistication of cyber attacks.

   “Threat actors continue to operate with increasingly greater capabilities, in an increasingly structured and organized space. Initial access vendors and ransomware creators now go as far as offering 24/7 customer support.  This increasingly hostile environment has shifted cyber risk from a primarily technical concern that fell on IT, into a persistent strategic pressure on governments and societies.

   “The line between the public and private sectors is also increasingly thin. Essential public services depend heavily on privately operated companies, meaning failures in one domain quickly affect the other. Treating private sector cybersecurity as a national security concern is therefore both forward-thinking and prudent.”

Approaching cybersecurity in this manner is a great move. Hopefully this is announcement that has substance behind it rather than being an announcement for show.