![](https://emergencyservicestimes.com/wp-content/uploads/2025/05/ESS-Button-resized.png")
A new action plan from government sets out how ownership and understanding of cyber risks must improve if there is to be a step-change in the cyber security and resilience of public services.
The Cyber Action Plan published by the Department for Science, Innovation and Technology says “responsibilities for cyber risks are unclear at all levels of government, including across the supply chain” and that leaders “lack visibility and understanding of the risk and resilience levels” in their own organisations.
A new Government Cyber Unit will oversee the collection of data about cyber risk with lead government departments required to account for and report on sector-wide cyber risk along with their own risk. For the emergency services, that would include the Home Office, MHCLG and Department of Health and Social Care. All public sector organisations will be required to assure the cyber security and resilience of their supply chain.
The first phase of establishing the Government Cyber Unit will include work to set direction and develop practical support for local cyber risk management. Wider public sector organisations will need to better understand their own risk as well as consider appropriate mechanisms to ensure suppliers appropriately manage government cyber risk.
The Government Cyber Incident Response Plan (G-CIRP) will provide the overarching framework, structure, roles and responsibilities for cyber incident response within government and expects public sector organisations and suppliers to update their response and recovery plans to align with the G-CIRP, and embed that through exercising or testing.
The 108pp plan references the role of the UK Resilience Academy noting that it is responsible for embedding effective lesson management across government and the public sector by providing guidance and support.
In a first for the government, it will as part of this plan establish the Government Cyber Profession, with a Head of Profession and focus on skill development and the creation of a skills pipeline to upskill, attract, retain and support cyber professional staff.
The first phase of of work to implement the plan is due to complete by March 2027, with scaling activity taking place over the following two years.
Read the Cyber Action Plan in full.
To read similar articles, check out our Technology channel.
