View all newsletters
Receive our newsletter - data, insights and analysis delivered to you

Opaque and Success Poorly Measured: NAO on National Cyber Security Programme

"The Strategy set out 48 measures of success but by July 2018 only 17 were being measured.”

By CBR Staff Writer

The Cabinet Office’s National Cyber Security Programme (NCSP) has failed to produce a detailed breakdown of exactly what it has spent and where, a report today from the National Audit Office (NAO) reiterated, urging improved transparency and external scrutiny.

Progress of the NCSP programme that runs from 2016-2012 is also being inadequately measured, the NAO found, saying that one-third (107) of the key performance indicators (KPIs) of success are currently not being measured, “either because the Department
has low confidence in the evidence underpinning a metric or it is planned as a future measure of performance.”

The report comes after the Joint Committee on the National Security Strategy attacked the programme, saying “lack of transparency about such large sums of public money is of serious concern.”

NAO On National Cyber Security Programme

The NAO has found that once the NCSP project was established the government concluded that: “It needed to prioritise additional funding on counter-terrorism activities.”

While the NAO notes these actions contributed to enhancing cyber and national security, they were not originally planned for the project. As a result this action: “Delayed work on projects such as elements of work to understand the cyber threat.”

Many of the early issues with the programme appear to stem from the fact that when the HM Treasury set the funding in 2015 the department did not have an overall programme business case.

This resulted in a situation where money was coming in, but the project had “no way to assess how much funding was required.”

Content from our partners
Scan and deliver
GenAI cybersecurity: "A super-human analyst, with a brain the size of a planet."
Cloud, AI, and cyber security – highlights from DTX Manchester

Meg Hillier MP, Chair of the Committee of Public Accounts comment in an emailed statement that the: “Government’s £1.3 billion flagship cyber security programme is yet another example of an important government programme launched without getting the basics right.”

“There were serious weaknesses in its initial set up, undermining its contribution to government’s overall cyber security strategy.”

Red Amber Green

NAO National Cyber Security Programme

The NAO found that the programme has inefficiently used its time in assessing the projects benefits and strategic outcomes. The office said it belives that the NCSP does not have a robust framework in place to measure how the project has performed.

Rather than establish a comprehensive review structure, officials at the programme were asked to rate risk involved in achieving the projects strategic outcomes via Red, Amber and Green indicators.

NAO National Cyber Security Programme

As the NAO states: “There is little evidence to support these assessments, which makes it difficult to assess how well the Programme has performed so far. The Strategy set out 48 measures of success but by July 2018 only 17 were being measured.”

The NAO noticed improvement in these systems as the Department now requires lead departments to spend between two and ten percent of their funding on measuring performance. However the NAO notes that the: “Department is not checking whether this is being done.”

NAO National Cyber Security Programme

The issue of performance measuring is compounded by the fact that the department has little confidence in the evidence underpinning some of their metrics. The NAO found a lack of quantitative measures of impact.

This is making it very hard for any lessons to be learnt from the programme running from 2016-2021 as the Department has ‘limited historical data’ to gain insights from.

The NAO has expressed concerns for the future of the programme as they state that: “The Department has started preparations for an approach to cyber security after 2021, but risks repeating previous mistakes.”

See Also: Parliament Tears Into National Cyber Security Programme, Calls for Audit

Websites in our network
Select and enter your corporate email address Tech Monitor's research, insight and analysis examines the frontiers of digital transformation to help tech leaders navigate the future. Our Changelog newsletter delivers our best work to your inbox every week.
  • CIO
  • CTO
  • CISO
  • CSO
  • CFO
  • CDO
  • CEO
  • Architect Founder
  • MD
  • Director
  • Manager
  • Other
Visit our privacy policy for more information about our services, how Progressive Media Investments may use, process and share your personal data, including information on your rights in respect of your personal data and how you can unsubscribe from future marketing communications. Our services are intended for corporate subscribers and you warrant that the email address submitted is your corporate email address.