Question

To ask the Secretary of State for Digital, Culture, Media and Sport, what assessment she has made of the adequacy of the security of GOV.UK's One Login system; and if she will introduce a statutory guarantee of free and equivalent non-digital alternatives.

GOV.UK One Login’s delivery is tightly governed through departmental controls, HM Treasury oversight and independent assurance by the National Infrastructure and Service Transformation Authority (NISTA) as part of the Government Major Projects Portfolio (GMPP). GOV.UK One Login is also independently assured and certified under the UK Digital Verification Services Trust Framework.

The programme follows the highest security standards for government and private sector services - including dedicated 24/7 eyes-on monitoring, incident response and appropriate security controls. It has a risk-based and multi-layered approach to security, with dedicated security experts and additional assurance provided through independent testing and National Cyber Security Centre (NCSC) advice.

GOV.UK One Login is not mandatory to use. Users who do not wish to or cannot use One Login also have alternative routes to accessing the service, provided by the relevant government service.