Cybersecurity: Government Departments

Earlier this year, DSIT published the Government Cyber Action Plan (GCAP). It represents a radical shift in the government’s approach, by holding organisations to account for managing cyber and digital resilience risks, setting much stronger central direction on minimum standards and priorities for transformation, and investing in scalable digital services and operational capability to better enable risk mitigation.

The GCAP has a phased implementation through to 2030, but improvements are already visible. DSIT has established new risk structures to better manage cross government technology risk. The Government Cyber Unit launched the Government Cyber Profession in February 2026 to address cyber skills shortages, has rolled out central cyber services to help departments tackle key issues and continues to operate our cyber assessment process (GovAssure) which is now entering its third year.

The Government Cyber Coordination Centre (GC3) continues to develop, enabling a more effective response to threats, vulnerabilities and incidents by coordinating incident response to public sector cyber incidents. GC3 recently led a pilot to help departments understand and mitigate key risks from frontier AI models and share findings on how to utilise this technology for effective cyber defence.