UK Government Shifts to Service-Led Cyber Governance After Stinging Audit
UK Civil Service drops mandate-led cyber governance for useful central services after a critical audit.
UK Civil Service Deputy CISO Breandán Knowlton-Hung said a 2025 National Audit Office review found the 2022 National Cyber Security Strategy had no proper implementation plan and no way to measure whether it worked. Across roughly 465 government bodies, about one in three cyber roles were vacant or filled by contractors. The service is shifting to “polycentric governance,” building central services such as vulnerability monitoring that cut median domain-level fix time from about 50 days to eight, while keeping hard authority for shared systemic risks.
- A 2025 NAO audit found no real implementation plan or outcome measures.
- About one in three government cyber roles were vacant or contractor-filled.
- Central vulnerability monitoring cut median domain fix time from about 50 days to eight.
- Hard mandates are reserved for systemic risks; other services must be useful enough to adopt.
Full article638 words · extracted from infosecurity-magazine.com · click to collapse
The UK government is overhauling its approach to cybersecurity for the British civil service sector, moving away from top‑down mandates toward centrally built services that frontline teams actually adopt and use.
“A mandate is permission to direct. It isn’t the ability to make change happen,” said Breandán Knowlton‑Hung, Deputy CISO at the UK Civil Service. “We learned that the hard way across a very federated system.”
During the Gartner Security & Risk Management Summit in London on September 23, Knowlton‑Hung outlined how a 2025 National Audit Office (NAO) report forced a rethink of the operating model set out in the 2022 National Cyber Security Strategy.
The 2022 strategy pitched an ambitious “defend as one” vision. Under this approach Knowlton‑Hung’s office sets direction and holds a macro view of risk while departments own and manage their local risks.
On paper, the strategy acknowledged the UK government’s reality, which is made of roughly 465 separate entities, including ministries, agencies and public bodies with their own leaders, budgets and systems.
However, in practice, the model relied on a quiet assumption that simply issuing standards and requiring assurance would lead to compliance and outcomes, Knowlton‑Hung said.
The reckoning came in 2025, when the NAO concluded that three years into the strategy, the UK government had “no proper implementation plan” and “no way to tell whether any of it was really working,” as Knowlton‑Hung summarized.
The audit also underscored severe capacity constraints. One in three cyber roles were vacant or filled by temporary contractors and a large majority of specialist architects were not permanent.
“You can issue all the mandates you like. If there’s no one at the other end to pick them up, they won’t get picked up,” Knowlton‑Hung noted.
That gap between policy and practice, he argued, is amplified in federations, whether in government or private companies that grew by acquisition.
“People didn’t refuse to act. They just couldn’t, because of budgets, systems, or competing risks they actually own,” he said.
UK Government Introduced “Polycentric Governance” for Cybersecurity
In response, Knowlton‑Hung said the government is pivoting to what he calls a “polycentric governance” model, where multiple overlapping centers of decision‑making that coordinate rather than obey a single hierarchy.
He framed it in three main actions:
- Start by building useful, centrally delivered services that solve real problems for users in the hundreds of government services
- Make adoption socially and operationally cheaper than non‑adoption
- Reserve hard central authority for a small set of systemic risks where one failure can harm everyone
“Own fewer things centrally, but own them harder,” he said. “Everywhere else, be unmissably useful.”
Knowlton‑Hung also emphasized that, despite this governance shift, central government will still set direction, hold the policy line and intervene strongly on shared risks that no single agency should accept locally.
One example he highlighted is a central vulnerability monitoring service that continually scans thousands of public sector organizations for roughly a thousand classes of externally visible weaknesses. It then routes actionable notifications to the right owners.
“By integrating with how people actually work, we cut the median time to fix domain‑level vulnerabilities from about 50 days to eight,” Knowlton‑Hung said.
“We didn’t order those fixes. Local teams owned and carried them out because the service helped them.”
Knowlton‑Hung was candid about pace and limits, admitting that while cyber assurance scores are improving year‑over‑year, they are still not fast enough against the threat.
He said the UK government is layering an action plan on top of the operating model to accelerate impact.
“Stop trying to force change through a memo,” Knowlton‑Hung said. “Go and be useful instead. Build the thing people want to pick up, then get out of the way while they use it.”