![](https://emergencyservicestimes.com/wp-content/uploads/2025/05/ESS-Button-resized.png")
The National Police Chiefs’ Council has published the National Policing Cyber Security Strategy setting out proposals to transform policing’s resilience to cyber attack, while at the same time maintaining public trust and confidence in law enforcement.
The three-year strategy is, says NPCC chief Gavin Stephens, a ‘significant step forward’ supporting policing’s wider work ‘to ensure that we are ready and able to face current, new, and emerging threats from criminals and cyber incidents.’
HMI Andy Cooke says that in the future it is ‘highly likely’ that HMICFRS will inspect the effectiveness of force’s cyber security practices and the contribution of this new strategy.
The Cyber Security Strategy is one of the pillars supporting the National Policing Digital Strategy and aligns with the government’s own strategy. It contains five objectives that cover the management of risk, protection against attack, detection of cyber events, minimising the impact of incidents and the underpinning knowledge and cyber security skills.
‘The scale and diversity of information stored and processed across policing’s digital platforms presents a high-value target to threat actors, from nation states to cyber criminals.’
To achieve the objectives, the strategy says that ‘policing’s cyber security operating model must evolve,’ and that a one size fits all approach to cyber is ‘unlikely to succeed.’ It recognises the varied financial situation of forces, particularly smaller ones, and their ability to buy in the cyber skills when the commercial sector can pay so much more. Centrally provided cyber security services will go some way to alleviate this but for larger forces, local cyber security capability will be warranted. All chiefs will be ‘equipped with education and data related to cyber risk.’
‘Chief officers posing the timely question ‘Is this secure?’ will encourage the necessary behavioural change to enable growth in the maturity of cyber security across policing. This alone is an essential precursor to all strategic priorities and associated transformation proposals.’
Pressing home the need for consistency and to ‘defend as one,’ the strategy says that it will develop national cyber security services to enable improved collaboration and optimise the investment of resources once and avoid silo-working. It does not provide any detail on what those services might be.
‘The delivery of the objectives and priorities detailed in this Strategy, will require pragmatism to achieve a vision where cyber security practices implemented with policing are proportional to the threats it faces.’
There is a plan of work with an indicative timetable to deliver the goals of this strategy but the 17 strands of activity need the right level of funding. It says, ‘all of these proposals are subject to the availability of resources to deliver and many are subject to funding applications being approved, so consequentially could have start dates moved.’
Oversight of delivery of the strategy falls to a new Cyber Security Strategy Steering Group and it will report into existing structures within the NPCC. The day to day management of activity within work streams will be with cyber expertise led working groups.
To evaluate the successful delivery of this strategy, police chiefs will use baseline data in the form of so-called SyAP scores. These were introduced in 2022 and provide the current maturity state for policing’s cyber security controls. Increased maturity using these scores will be used to measure the extent of a force’s cyber transformation.
Read the National Policing Cyber Security Strategy
For similar articles, check out our Technology channel.