Question to the Department for Science, Innovation & Technology:

To ask His Majesty's Government what steps they are taking to reduce cybersecurity risks arising from the continued use of legacy IT systems in the public sector.

Earlier this year, DSIT published the Government Cyber Action Plan (GCAP). It represents a radical shift in the government’s approach, by holding organisations to account for managing cyber and digital resilience risks, setting much stronger central direction on minimum standards and priorities for transformation, and investing in scalable digital services and operational capability to better enable risk mitigation. The GCAP has a phased implementation through to 2030, but improvements are already visible. DSIT has established new risk structures to better manage cross government technology risk.

DSIT is taking forward wider work to understand, manage and remediate legacy technology across the public sector, including the development of a Legacy IT Action Plan.