Asked by: Matt Rodda (Labour - Reading Central)
Question to the Ministry of Defence:
To ask the Secretary of State for Defence, whether his Department has made an assessment of the potential national security risks associated with IT infrastructure operated by (a) his Department's arm’s-length bodies and (b) private firms under contract to his Department.
Answered by Andrew Murrison
The Ministry of Defence (MOD) takes the security of its IT infrastructure, that of its arm’s length bodies and of its suppliers, very seriously. However, the MOD does not comment on specific details of individual risk assessments as this could give useful information to potential adversaries.
Defence employs a Cyber Risk Management Framework that regularly reviews and escalates risk. This uses evidence from a variety of sources including as the Cabinet Office’s Gov Assure ‘Cyber Assessment Framework’ (CAF). All Defence Organisations, including ALBs, sit within this framework. MOD contracts are subject to a risk assessment which is used to determine the nature of the control measures should be applied to the contract.
The Cyber Resilience Strategy for Defence is driving a programme of work to improve Defence’s cyber security. In the longer term the MOD’s Secure by Design approach will ensure security is built into our capability programmes from the outset and managed effectively on a through life basis. The MOD is also reducing the cyber security risk across its complex legacy estate by improving its ability to respond to and detect cyber incidents, improve cyber awareness across the workforce, and improve resilience in it supply.
Asked by: Matt Rodda (Labour - Reading Central)
Question to the Ministry of Defence:
To ask the Secretary of State for Defence, with reference to the guidance by the Central Digital and Data Office entitled Guidance on the Legacy IT Risk Assessment Framework, published on 29 September 2023, how many red-rated IT systems are used by his Department; and how many red-rated IT systems have been identified since 4 December 2023.
Answered by James Cartlidge - Shadow Secretary of State for Defence
It is not appropriate to release sensitive information held about specific red-rated systems or more detailed plans for remediation within the Ministry of Defence’s IT estate, as this information could indicate which systems are at risk, and may highlight potential security vulnerabilities.
Asked by: Matt Rodda (Labour - Reading Central)
Question to the Ministry of Defence:
To ask the Secretary of State for Defence, pursuant to the Answer of 4 December 2023 to Question 3662 on Ministry of Defence: ICT, if he will publish details of the 11 red-rated legacy IT systems.
Answered by James Cartlidge - Shadow Secretary of State for Defence
The information held about Red Rated Systems is sensitive as it highlights potential security weaknesses within the Ministry of Defence’s IT estate. For this reason I am withholding this information.
Asked by: Matt Rodda (Labour - Reading Central)
Question to the Ministry of Defence:
To ask the Secretary of State for Defence, how much their Department spent on (a) current and (b) legacy IT infrastructure (i) in total and (ii) purchased in 2013 or earlier in each of the last three years.
Answered by James Cartlidge - Shadow Secretary of State for Defence
The Ministry of Defence (MOD) is committed to reducing our dependence on legacy IT systems. This is in keeping with wider efforts across Government, and in accordance with the Central Digital and Data Office’s Legacy IT Risk Assessment Framework.
As outlined in the National Audit Office report entitled The Digital Strategy for Defence: A review of early implementation in 2022, the estimated annual departmental spend on digital, which includes IT infrastructure, is approximately £4.4 billion. MOD does not routinely collect consolidated information for spending on legacy IT, and so data is not held in the format you have requested; this could only be provided at disproportionate cost.
Asked by: Matt Rodda (Labour - Reading Central)
Question to the Ministry of Defence:
To ask the Secretary of State for Defence, with reference to the guidance by the Central Digital and Data Office entitled Guidance on the Legacy IT Risk Assessment Framework, published on 29 September 2023, how many red-rated IT systems are used by their Department.
Answered by James Cartlidge - Shadow Secretary of State for Defence
As of 21 November 2023, the Ministry of Defence (MOD) has 11 red-rated legacy IT systems as defined in the Central Digital and Data Office (CDDO) Legacy IT Risk Assessment Framework.
The MOD takes the issue of the resilience of our IT networks extremely seriously, and we are driving forward with a number of initiatives to improve it. Work that has been undertaken in line with the CDDO framework includes conducting of obsolescence risk assessments for our critical systems, and creating remediation plans at pace for any of those requiring immediate attention.
Asked by: Matt Rodda (Labour - Reading Central)
Question to the Ministry of Defence:
To ask the Secretary of State for Defence, pursuant to the Answer of 28 June 2021 to Question 18564 on Merchant Navy Officers Pension Fund, what estimate he has made of the projected average future entitlement for members of the Merchant Navy Ratings Pension Fund scheme through the Royal Fleet Auxiliary.
Answered by Leo Docherty
Royal Fleet Auxiliary (RFA) seafarers are Ministry of Defence (MOD) employees and members of the Civil Service Pension Scheme. The RFA does not sponsor the Merchant Navy Ratings Pension Fund and the MOD is not responsible for any costs or entitlements associated with it.
In addition, my answer to Questions 18563 and 18564 on 28 June 2021 contained an error. It stated:
The RFA does not sponsor the Merchant Navy Officers Pension Fund and the MOD is not responsible for any costs or entitlements associated with it.
It should have said:
The RFA does not sponsor the Merchant Navy Ratings Pension Fund and the MOD is not responsible for any costs or entitlements associated with it.
Asked by: Matt Rodda (Labour - Reading Central)
Question to the Ministry of Defence:
To ask the Secretary of State for Defence, pursuant to the Answer of 28 June 2021 to Question 18563 on Merchant Navy Officers Pension Fund, what estimate he has made of the potential future cost to the public purse in the (a) short term and (b) long term in relation to the Royal Fleet Auxiliary’s role as a sponsoring employer of the Merchant Navy Ratings Pension Fund scheme.
Answered by Leo Docherty
The Royal Navy is a participating employer for the Merchant Navy Pension Fund for Royal Fleet Auxiliary (RFA) personnel who were members of this scheme prior to the RFA transitioning to the main Civil Service Pension Scheme. The fund closed to new members on 31 May 2001 and is in the process of running down.
Asked by: Matt Rodda (Labour - Reading Central)
Question to the Ministry of Defence:
To ask the Secretary of State for Defence, what estimate he has made of the projected average future entitlement for members of the Merchant Navy Ratings Pension Fund scheme through the Royal Fleet Auxiliary.
Answered by Leo Docherty
Royal Fleet Auxiliary (RFA) seafarers are Ministry of Defence (MOD) employees and members of the Civil Service Pension Scheme. The RFA does not sponsor the Merchant Navy Officers Pension Fund and the MOD is not responsible for any costs or entitlements associated with it.
Asked by: Matt Rodda (Labour - Reading Central)
Question to the Ministry of Defence:
To ask the Secretary of State for Defence, what estimate he has made of the potential future cost to the public purse in the (a) short term and (b) long term in relation to the Royal Fleet Auxiliary’s role as a sponsoring employer of the Merchant Navy Ratings Pension Fund scheme.
Answered by Leo Docherty
Royal Fleet Auxiliary (RFA) seafarers are Ministry of Defence (MOD) employees and members of the Civil Service Pension Scheme. The RFA does not sponsor the Merchant Navy Officers Pension Fund and the MOD is not responsible for any costs or entitlements associated with it.