POLICE forces and fire and rescue services need to urgently protect their systems from the increased risk of cyberattacks, a report from the policing and fire inspectorate has found.

In a new report, His Majesty’s Inspectorate of Constabulary and Fire & Rescue Services (HMICFRS) has warned that opportunities to strengthen cybersecurity arrangements cannot be missed and leaders must prioritise and invest in them. The report highlights that cybersecurity risks in the UK and globally are increasing in scale, complexity and impact.

The inspectorate found committed and capable personnel working hard to keep systems secure, as well as some gradual improvement in cybersecurity arrangements across both sectors. However, many forces and services still have much work to do to address recurring areas of weakness.

Inspectors also found that modernising ICT across both sectors must become a priority to improve resilience. All the organisations inspected rely on legacy systems to some extent, with leaders identifying these systems as their highest strategic risk for cybersecurity.

The inspectorate raised concerns about cybersecurity risks linked to 3rd-party ICT suppliers, particularly where suppliers store or manage sensitive police data. The way staff use ICT systems and data is also a significant problem, with some forces and services simply not doing enough to prevent human error from increasing the risk of cyberattacks.

His Majesty’s Inspector of Constabulary Michelle Skeer OBE QPM said:- “The cyber threat to police forces and fire and rescue services is significant and expanding rapidly. A major cyberattack is not a hypothetical scenario and successful attacks have been disruptive, put the public at risk and were expensive to fix. While there have been gradual improvements, many forces and services still need to urgently redouble their efforts to respond to the increased risk of cyberattacks. Cybersecurity should be viewed as a core organisational priority and not solely a technical risk. Leaders need to prioritise and invest in their cybersecurity arrangements to improve their organisation’s ability to prevent, detect, respond to and recover from attacks."

Michelle continued:- “The government’s programme of police reform and local government reorganisation could offer both sectors opportunities to improve and better co-ordinate the approach to cybersecurity. These opportunities to strengthen cybersecurity cannot be missed. Protecting systems and data is essential to protecting the public.”

Inspectors also said that preparedness and resilience arrangements are often underdeveloped, with unsatisfactory arrangements for backing up and restoring ICT systems following a cyberattack. Forces and services are improving their ability to monitor their ICT systems and detect cyberattacks. But, in many cases, there isn’t enough monitoring coverage or capability.

The inspectorate said a leadership issue is underpinning these problems. Several senior police and fire leaders said they didn’t consider cybersecurity to be part of daily operational decision-making, which means investment is being directed to other priorities.

HMICFRS has made 13 recommendations intended to strengthen cybersecurity by:-

  • making sure all forces and services achieve baseline standards for cybersecurity capabilities;
  • introducing robust external validation of services’ assessments of cybersecurity capabilities;
  • improving the procurement and contract management of third-party ICT suppliers;
  • enhancing collaborative arrangements between government and policing cybersecurity leads;
  • promoting the use of the Police Digital Service’s National Management Centre, and creating a similar national capability for services;
  • increasing the preparedness of services to respond to a cyberattack; and
  • better supporting learning and development for senior leaders and cybersecurity staff.