David Reed

The critical systems referenced in the National Audit Office report were assessed by GovAssure – Government's cyber assurance programme. Of the 72 assessed systems referenced in the report, 18 have been reassessed since publication.

GovAssure requires organisations to scope and assess their critical IT systems on an annual basis in tranches, prioritising Critical National Infrastructure systems first. Once assessed, organisations will work through Targeted Improvement Plans, so systems may not be immediately reassessed the following year whilst remediation is ongoing.

Government has acknowledged that it faces significant cyber security and resilience risks and has set out its wider package of measures to tackling these through the Government Cyber Action Plan, published in January 2026 and backed by over £210 million.

The Law Officers’ Convention applies to advice which may or may not have been given by the Law Officers, or requested of the Law Officers, and the Convention applies to your question.

The Law Officers’ Convention can be found at paragraph 21.27 of Erskine May:

“By long-standing convention, observed by successive Governments, the fact of, and substance of advice from, the law officers of the Crown is not disclosed outside government. This convention is referred to in paragraph [5.14] of the Ministerial Code [updated on 6 November 2024]. The purpose of this convention is to enable the Government to obtain frank and full legal advice in confidence.”

In 2019, the Government introduced arrangements for the monitoring and management of strategic suppliers through Memoranda of Understanding (MoUs) agreed between the Government and each strategic supplier. Under the MoU, strategic suppliers agree to provide the Government with information required to monitor and manage risks across their supply chains.

In addition, the Government regularly publishes Key Performance Indicators for its most significant contracts to maintain visibility of delivery performance. Individual contracting authorities are responsible for undertaking appropriate due diligence as part of their procurement processes.

The Procurement Act 2023 further strengthens the ability of contracting authorities to respond to poor performance and to mitigate risks across public sector supply chains.

Cabinet Office Ministers and officials regularly engage with other government departments on a wide range of cross-cutting resilience matters, including the impacts of any potential energy supply shortages.

Cross-departmental engagement occurs on a continuous basis, and there have been a large number of ministerial and official meetings held on broader resilience over the past 12 months, at which this topic can arise. To provide more detailed information would exceed the threshold and incur a disproportionate cost to the Cabinet Office.

The three-year household resilience public information campaign will launch later this year. The government is developing resources and materials that will be hosted on GOV.UK for partners to download, adapt and distribute locally.

The UK has met NATO’s 1.5% defence and security-related spending target, as defined by NATO. NATO’s definition sets out that spend should be to protect our critical infrastructure, defend our networks, ensure our civil preparedness and resilience, unleash innovation and strengthen our defence industrial base.

Given this definition, contributions came from a number of departments. All spending captured as part of the 1.5% is determined through the Spending Review and set out to Parliament via the Estimates process in the usual way.

The Government does not routinely comment on ongoing investigations or operational activity.

While the government does not have a dedicated budget to support SMEs to develop business continuity plans, we have set out a comprehensive package of support in our Plan for Small Businesses that will enable SMEs to grow and thrive, including when faced with disruption.

This includes a new Business Growth Service to simplify finding advice and support for SMEs, extending the Help to Grow: Management Programme to help upskill SME leaders, and introducing significant legislation on late payments to ensure SMEs can effectively manage their cash flow. The government’s Cyber Essentials also helps SMEs protect themselves against digital threats.

For the 2026/27 – 2028/29 financial years, BIST is providing multi-year core grant funding to Local Authorities across England for them to provide a Growth Hub. Growth Hubs are expected to provide local businesses with advice and access to support for a broad range of business needs.

There are no ring-fenced elements; the parent Authority of each Growth Hub has flexibility in how and what it delivers, based on local business needs and local growth plans.

Although no specific funding has been allocated to the Business Growth Service (BGS) for financial year 2026-27 to help UK SMEs develop business continuity plans, DBT supports small and medium sized businesses become more resilient in the event of major disruption in a number of ways.

BGS is part of a wide range of business support channels available that include the Business Support Service and Growth Hubs in England providing support and guidance to help businesses plan, adapt and respond to challenges. These include practical cyber resilience measures such as Cyber Essentials among SMEs.

The Critical Minerals Intelligence Centre (CMIC), funded by the Department for Business, Innovation, Science and Trade and delivered by the British Geological Survey, produces the UK’s criticality assessment. With a continuously expanding amount of data used in criticality assessments, continued monitoring and data processing require upgrading and semi-automation. CMIC’s criticality assessment upgrades this year will improve its workflow systems, making them more efficient, expanding on the number of HS codes analysed and focusing on large-volume materials. The next overarching update to the criticality assessment is due to take place in 2027.

DBT supports and feeds into cross-Whitehall work to ensure that small and medium sized businesses are more resilient in the event of major disruption. DBT provides direct messaging and guidance to business should major disruption occur, and works closely with cyber partners across Whitehall to drive uptake of practical cyber resilience measures such as Cyber Essentials among SMEs.

DBT supports SMEs through wider business support channels, primarily the Business Growth Service accessible through business.gov.uk, the Business Support Service and Growth Hubs in England, which provide guidance and signposting to help businesses plan, adapt and respond to challenges.

I cannot comment on specific incidents whilst investigations are ongoing for reasons of national security.

I can, however, confirm that the incident referred to impacted micro-scale generation, and at no point was there a risk to the wider energy system.

I cannot comment on specific incidents whilst investigations are ongoing for reasons of national security.

I can, however, confirm that the incident referred to impacted micro-scale generation, and at no point was there a risk to the wider energy system.

I cannot comment on specific incidents whilst investigations are ongoing for reasons of national security.

I can, however, confirm that the security and resilience of our energy system is the Department’s top priority.

Alongside the National Cyber Security Centre, we work closely with the energy sector to ensure threats to infrastructure are understood and that appropriate mitigations are implemented.

There has been one International Energy Agency coordinated emergency stock release since January 2025 – the action announced on 11 March 2026 in response to the Middle East conflict and Strait of Hormuz disruption. The UK's contribution was ~14 million barrels which DESNZ moved quickly to make available by lowering the obligation on companies to hold stocks. Further information on industry stock levels can be found at: ET_3.11_AUG_26.xlsx

To meet the UK’s oil-stocking obligation as a member of the International Energy Agency, the Secretary of State requires companies that supply more than 50,000 tonnes of key petroleum products to the UK inland market over a 12-month period to hold emergency stocks. This currently applies to 16 refiners and importers. Obligations are allocated among these companies so that the UK holds stocks equivalent to 90 days of net oil imports. Companies report stock levels to the Department monthly, and more frequently during an International Energy Agency stock release. The Department also carries out on-site audits.

The Government keeps risks to Critical National Infrastructure, of which data centres are a part, under continuous review through the National Risk Register process and extensive engagement with industry. As the department responsible for data infrastructure, DSIT also conducts rolling assessments of the risk of a cyber-attack to data centres. This is supplemented by DSIT’s ongoing engagement with the sector to continuously test the capabilities of data centres against known threats, including cyber attacks. DSIT’s assessments consider the potential disruption, compromise or denial of essential services resulting from a successful cyber attack on data infrastructure, and inform national resilience planning assumptions.

Departmental budgets are currently set up to the end of financial year 2025/26. The government is currently in the middle of a Spending Review, which will set out the government’s spending plans for R&D through to 2029/30. This will conclude in June 2025.

At the Autumn Budget 2024, the Chancellor confirmed that total HMG investment in R&D is rising to a record allocation of £20.4bn in 2025/26. As part of this, DSIT's R&D budget is rising to £13.9bn for the 2025/26 financial year.

The Government understands how important it is that everyone can access information in times of national emergency. Television and radio both play an important role in providing such access in a range of different emergency scenarios, including scenarios where other communications may be disrupted.

The BBC has specific requirements under its Framework Agreement in relation to broadcast security and resilience, and works closely with DCMS in ensuring its infrastructure is able to support emergency communications.

Detailed planning and preparations for a range of risks in the National Risk Register is an operational matter for the BBC. The BBC has informed DCMS that there are robust plans and procedures in place, which are tested regularly, for maintaining resilient communications to the public via its TV and radio broadcast networks including live tests of its broadcast systems.

The department does not collect data on whether schools have a business continuity plan, or whether such plans have been reviewed within the last 12 months.

Settings remain responsible for complying with their legal responsibilities, including health and safety requirements, and should develop plans that reflect their local circumstances.

The department publishes non-statutory guidance to support settings to plan for emergencies within their own local context which can be found here: https://www.gov.uk/government/publications/emergency-planning-and-response-for-education-childcare-and-childrens-social-care-settings/emergency-planning-and-response-for-education-childcare-and-childrens-social-care-settings.

The current Resource Accounting and Budgeting (RAB) charge for Plan 2 loans in England is 32.2%. The RAB charge for Plan 2 loans has changed as follows since 2019:

Many factors can influence the RAB charge, including modelling methodology, economic determinants and policy decisions. The last cohort of Plan 2 loan borrowers took their first loans in the 2022/23 academic year, the latest RAB charge covers outlay for borrowers still receiving Plan 2 loans in the 2024/25 financial year.

The department does not hold estimates of lifetime repayment costs for Plan 2 borrowers by earnings bands.

The Autumn Budget included freezes to Plan 2 repayment and interest thresholds for at their 2026/27 financial year level until April 2030, when they will increase annually by inflation.

The following analysis of the impact of freezing the repayment and interest thresholds to aid the decision:

We also do not hold the proportion of borrowers projected to repay of their student loan than the graduate earnings premium attributable to their degree.

The department does not hold estimates of lifetime repayment costs for Plan 2 borrowers by earnings bands.

The Autumn Budget included freezes to Plan 2 repayment and interest thresholds for at their 2026/27 financial year level until April 2030, when they will increase annually by inflation.

The following analysis of the impact of freezing the repayment and interest thresholds to aid the decision:

We also do not hold the proportion of borrowers projected to repay of their student loan than the graduate earnings premium attributable to their degree.

The actual repayments for plan 2 are published in Figure 14 on this page:

https://www.gov.uk/government/statistics/student-loans-in-england-2024-to-2025/student-loans-in-england-financial-year-2024-25#income-contingent-loan-borrower-repayment-status.

The forecasts for Plan 2 are published here:

2020/21: https://explore-education-statistics.service.gov.uk/data-tables/permalink/537c9923-1dee-4dd7-03b6-08de802d14ab.

2021/22: https://explore-education-statistics.service.gov.uk/data-tables/permalink/72cb044b-3268-42b8-2298-08de802e40a1.

2022/23: https://explore-education-statistics.service.gov.uk/data-tables/permalink/63aca262-3422-41f2-03b4-08de802d14ab.

2023/24: https://explore-education-statistics.service.gov.uk/data-tables/permalink/8be5221a-77a1-4544-2297-08de802e40a1.

2024/25: https://explore-education-statistics.service.gov.uk/data-tables/permalink/8b17045b-d933-4ac1-03af-08de802d14ab.

Forecasts are always likely to deviate from actuals due to uncertainty around many factors. Forecasts are based on the most up to date inputs available. Even looking only a year into the future, factors affecting repayments are likely to deviate from model inputs, especially in times of greater economic uncertainty. Over time, improvements to modelling methodology also affect accuracy of forecasts.