Whitehall shuffles cyber duties after DSIT axed, forcing boards to own resilience
The scrapping of the Department for Science, Innovation and Technology forces public service leaders to treat cyber risk as a boardroom priority rather than an IT issue.
Key points
- The UK government has dissolved DSIT, redistributing its digital and cyber policy responsibilities across Whitehall.
- Recent ransomware attacks on NHS suppliers have demonstrated that cyber incidents cause direct service disruption and public safety risks.
- The National Cyber Security Centre requires organisations to adopt the Cyber Resilience Pledge, making security a board-level obligation.
The dissolution of the Department for Science, Innovation and Technology has fundamentally altered the cyber resilience landscape for UK public services. According to The Register, this machinery-of-government change redistributes digital and cyber policy responsibilities across Whitehall, creating a new operational environment for public sector leaders. This structural shift coincides with rising expectations for board-level accountability in cybersecurity, moving the discipline from technical teams to executive oversight.
Root cause
The primary driver for this change is the recognition that the previous model of delegating cyber security to specialist operational teams is no longer sustainable. The Register reports that pressure is now coming from three directions: policy changes raising expectations for senior leaders, organisational reforms reshaping service connections, and technology shifts involving cloud, hybrid work and AI. These factors expand both opportunity and exposure, necessitating a higher level of strategic attention to cyber risk.
Attack path
Recent incidents illustrate how technical failures translate into operational crises. The Register cites the 2024 ransomware attack on Synnovis, a pathology services provider for parts of the NHS. The attack significantly reduced capacity to process blood, urine and specimen tests, causing disruption across south-east London. This led to delays affecting more than 11,000 outpatient and elective procedure appointments, demonstrating how supply chain compromises directly impact public service delivery and safety.
Affected versions
Public services across healthcare, benefits, transport, education, local government and emergency response are affected by this policy shift. The Register notes that these sectors are now so digitally dependent that a cyber incident poses a risk to public trust and the continuity of government. There are no specific software versions or CVE IDs mentioned in the source material; the impact is structural and policy-based rather than tied to a specific technical vulnerability.
Mitigation
The National Cyber Security Centre has issued clear direction through the Cyber Resilience Pledge. Organisations are asked to make cyber security a board-level responsibility, register for NCSC Early Warning, and take a risk-based approach to Cyber Essentials across their supply chains. The Register states that this guidance shapes cyber resilience into a leadership obligation, requiring active engagement from senior management rather than passive technical compliance.
What it means for organisations
Leaders must now integrate cyber resilience into strategic planning and board agendas. Teams usually need to review supplier contracts to ensure security obligations are clear and enforceable. Organisations should check whether their current incident response plans account for supply chain disruptions and service continuity. Senior management needs to be informed of the new policy landscape, ensuring that cyber risk is treated as a business risk rather than a purely technical issue.
Background: Supply chain attacks
Supply chain attacks in cyber security exploit the trust you place in third-party software components. Attackers inject malicious code into legitimate updates or build pipelines. You receive the payload as if it were benign. Defending requires verifying code origins, isolating build environments and treating all external inputs as hostile.
Read the full guide: Supply chain attacks in cyber security: how they work and how to stop them
What to do and how to stay safe: DSIT
- Review current supplier security obligations and ensure they align with the Cyber Resilience Pledge requirements.
- Register for the NCSC Early Warning system to receive timely alerts about emerging threats.
- Conduct a risk-based assessment of Cyber Essentials compliance across your entire supply chain.
- Ensure board-level discussions include cyber resilience as a core component of operational continuity planning.
General security guidance from the TechSec Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What happened to the Department for Science, Innovation and Technology?
The UK government has scrapped DSIT, redistributing its digital, technology and cyber policy responsibilities across other parts of Whitehall.
Why is cyber resilience now a boardroom priority?
Because public services are highly digitally dependent, cyber incidents now pose risks to public trust, safety and government continuity, requiring executive oversight.
What does the Cyber Resilience Pledge require?
It asks organisations to make cyber security a board-level responsibility, register for NCSC Early Warning and adopt a risk-based approach to Cyber Essentials.
