HMICFRS report warns UK police and fire services must urgently improve cybersecurity amid rising threat
The UK inspectorate HMICFRS published its Cybersecurity in Police Forces and Fire and Rescue Services report on October 27, 2026, warning that the cyber threat to these services is growing rapidly and demands a more urgent response. The findings come from a three-phase inspection run between January and May 2026, with dozens of interviews, "reality testing" and a review of over 260 documents. His Majesty's inspector Michelle Skeer said many forces and services must redouble their efforts, and that cybersecurity should be a core organizational priority rather than solely a technical risk. The report makes 13 recommendations to raise the sector's security posture.
Detalhes técnicos
Weaknesses identified in the report:
- Legacy ICT systems are described as a "strategic risk" because they are hard to patch and integrate.
- Third-party risk, especially ICT suppliers that manage sensitive police data, and human error when using external services.
- Underdeveloped preparedness and resilience, including backups and incident response.
- Basic control issues in access management, authentication and provisioning/deprovisioning.
- Lack of senior accountability, with several leaders saying cybersecurity is not part of daily operational decision-making.
- Poor national coordination, leading to uneven cyber maturity across forces and services.
Remediação
HMICFRS recommendations include:
- Introduce baseline standards such as the Cyber Assessment Framework.
- Commission third-party assessments of cybersecurity capabilities.
- Improve procurement and contract management of ICT suppliers, including mandatory Cyber Essentials certification.
- Strengthen collaboration between government and policing cybersecurity leads.
- Promote the Police Digital Service's National Management Centre and create a similar national capability for fire and rescue services.
- Improve preparedness through backup and restore and incident response exercises.
- Improve learning and development for senior leaders and cybersecurity staff.
Linha do tempo
-
HMICFRS report warns UK police and fire services must urgently improve cybersecurity amid rising threat
ler a análise desta fonte ocultar
The UK inspectorate HMICFRS published its Cybersecurity in Police Forces and Fire and Rescue Services report on October 27, 2026, warning that the cyber threat to these services is growing rapidly and demands a more urgent response. The findings come from a three-phase inspection run between January and May 2026, with dozens of interviews, "reality testing" and a review of over 260 documents. His Majesty's inspector Michelle Skeer said many forces and services must redouble their efforts, and that cybersecurity should be a core organizational priority rather than solely a technical risk. The report makes 13 recommendations to raise the sector's security posture.
Technical Details
Weaknesses identified in the report:
- Legacy ICT systems are described as a "strategic risk" because they are hard to patch and integrate.
- Third-party risk, especially ICT suppliers that manage sensitive police data, and human error when using external services.
- Underdeveloped preparedness and resilience, including backups and incident response.
- Basic control issues in access management, authentication and provisioning/deprovisioning.
- Lack of senior accountability, with several leaders saying cybersecurity is not part of daily operational decision-making.
- Poor national coordination, leading to uneven cyber maturity across forces and services.
Remediation
HMICFRS recommendations include:
- Introduce baseline standards such as the Cyber Assessment Framework.
- Commission third-party assessments of cybersecurity capabilities.
- Improve procurement and contract management of ICT suppliers, including mandatory Cyber Essentials certification.
- Strengthen collaboration between government and policing cybersecurity leads.
- Promote the Police Digital Service's National Management Centre and create a similar national capability for fire and rescue services.
- Improve preparedness through backup and restore and incident response exercises.
- Improve learning and development for senior leaders and cybersecurity staff.