UK Government Shifts to Service-Led Cyber Governance After Stinging Audit
UK Civil Service drops mandate-led cyber governance for useful central services after a critical audit.
UK Civil Service Deputy CISO Breandán Knowlton-Hung said a 2025 National Audit Office review found the 2022 National Cyber Security Strategy had no proper implementation plan and no way to measure whether it worked. Across roughly 465 government bodies, about one in three cyber roles were vacant or filled by contractors. The service is shifting to “polycentric governance,” building central services such as vulnerability monitoring that cut median domain-level fix time from about 50 days to eight, while keeping hard authority for shared systemic risks.
- A 2025 NAO audit found no real implementation plan or outcome measures.
- About one in three government cyber roles were vacant or contractor-filled.
- Central vulnerability monitoring cut median domain fix time from about 50 days to eight.
- Hard mandates are reserved for systemic risks; other services must be useful enough to adopt.
- Organizations
- UK Civil ServiceNational Audit OfficeGartner
- Countries
- United Kingdom
From the original article
3 min read at infosecurity-magazine.com
Whitehall is shifting from mandatory cyber controls to service-led governance following a critical audit exposing failures of its 2022 cyber strategy
By Kevin Poireault · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.