Government publishes Cyber Action Plan for greater resilience of public services

Cybersecurity industry welcomes plan, but expresses concern about funding and talent

The Cyber Action Plan, published alongside the second reading of the Cyber Security and Resilience Bill in Parliament, sets out how the public sector will respond to an increasingly hazardous cyber security landscape.

The government has set out its plans to strengthen the security and resilience of digital public services, publishing a £210 million Government Cyber Action Plan aimed at protecting citizens, data and critical services from escalating cyber threats. A new Government Cyber Unit will drive delivery, coordinating action across departments and the wider public sector.

The plan is part of the much wider push from the government for the increased scope of digitisation in public service delivery. That process will only be successful of the public trust that these services and their data are safe, secure and resilient.

Key priorities include improved visibility of cyber and digital resilience risks across government, enabling resources to be focused where exposure is greatest. The government also plans to take more decisive, joined-up action on complex risks that no single organisation can manage alone, supported by a dedicated central team.

Incident response is another major focus. Departments will be required to maintain robust response and recovery arrangements, allowing faster containment of threats and minimising disruption when attacks occur. At the same time, targeted investment will be used to close critical resilience gaps and protect services that citizens rely on every day.

The accompanying Cyber Security and Resilience Bill extends these expectations to suppliers, setting clearer requirements for organisations that provide essential services to government, including energy, water, healthcare and data centre operators. The aim is to strengthen resilience across supply chains, recognising that weaknesses in one organisation can have systemic consequences.

Risks lurking in the software supply chain are addressed through the launch of a new Software Security Ambassador Scheme, designed to promote adoption of the Software Security Code of Practice. With 59% of organisations experiencing software supply chain attacks in the past year, the initiative brings together major technology and financial services firms—including Cisco, Palo Alto Networks, Sage, Santander and NCC Group to share insights into implementation and provide “feedback to inform future policy improvements.”

Industry comment

The Cybersecurity industry has broadly welcomed the plan, but some have already questioned whether the £210 million investment is suited to the scale of the task.

Commenting via email, James Neilson, SVP International at OPSWAT said:

“The government’s new cyber action plan is welcome, as public sector priorities during a cyberattack must be keeping critical services running and protecting sensitive data. Time is the most valuable resource in incident response, so improving detection, response and recovery speed across departments is essential.

“However, the £210 million funding commitment is limited given the size and complexity of public sector networks. Even after £2.6 billion was allocated in 2021 for cyber security and legacy IT modernisation, significant issues remain. If the government is serious about improving cyber resilience, further investment will be required.”

Also commenting via email, Trevor Dearing, Director of Critical Infrastructure at Illumio said:

“It’s encouraging to see increased investment across government and the public sector, especially the focus on resilience, visibility, and reducing risk through the new cyber unit.

“But £210 million is nowhere near enough to address the scale of the problem. And while the plans centre on government and digital services, they overlook the private organisations that manage much of our critical infrastructure. If we want real progress, response teams need to cover both public and private sectors.

“Also, investment alone won’t fix the problem. The public sector continues to lag behind the private sector in attracting cyber talent. To build effective teams, it must compete on salaries and benefits and ensure strong coordination and clear accountability across agencies to defend against increasingly sophisticated threats.”