iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The UK government published its Government Cyber Action Plan on 6 January 2026, backed by over £210 million in central investment to strengthen cyber security and digital resilience across government and the wider public sector. The plan creates a coordinating Government Cyber Unit within the Department for Science, Innovation and Technology (DSIT), while departments and public bodies remain responsible for managing their own cyber risks. The published material does not give a complete breakdown of how the funding will be allocated.
What is the Government Cyber Action Plan?
The plan is part of the government’s broader Roadmap for a Modern Digital Government. It responds to concerns about legacy technology, accumulated technical debt, persistent cyber threats and uneven resilience across public services. Its central premise is that digital public services must remain trustworthy and available, including when organisations face an attack or a serious technical disruption. The official plan sets out a framework for risk oversight, support and services, response and recovery, and skills.
What the new Government Cyber Unit does
The Government Cyber Unit sits within DSIT and is intended to coordinate and drive improvements through direction, accountability and targeted support. It works alongside the National Cyber Security Centre (NCSC), which provides specialist technical expertise and guidance. This is a central coordinating role, not a transfer of every organisation’s operational responsibility to DSIT or the NCSC.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsWhat will the over-£210 million fund?
DSIT describes the investment as establishing the Government Cyber Unit and enabling scalable services, support and response capability. The plan identifies areas for action, but the official descriptions consulted do not publish a complete pound-by-pound allocation across programmes. They also do not establish how much of the investment had been committed or spent.
#1 Best Overall
Rather than treating the headline sum as a grant pot for a single project, the plan presents it as central investment to support a more joined-up public-sector approach. Proposed delivery includes a service finder, technical advisory capability, common measures for the impact of incidents on services, and a Government Cyber Incident Response Plan. These are plan commitments and delivery intentions; they should not all be read as services already completed or available.
Delivery priorities
- Risk oversight: improve visibility of cyber risks and establish measurable outcomes for reporting.
- Support and services: make shared help and technical advice easier to identify and use, while strengthening adoption of Secure by Design.
- Response and recovery: improve incident readiness, response coordination and recovery, including through a planned Government Cyber Incident Response Plan.
- Skills: develop the public-sector cyber workforce and measure progress.
- Supplier risk: encourage organisations to address supply-chain security through procurement, contractual requirements and review.
The announcement also says departments will be required to have robust incident-response arrangements. The plan’s measurable outcomes include incident readiness and supplier risk, alongside reporting, shared services and workforce development.
Which public services and organisations are covered?
The plan uses “government organisations” broadly. It includes government departments, arm’s-length bodies and wider public-sector organisations that are publicly funded to deliver services, often at local or regional level. Examples given include NHS trusts and local authorities. The plan’s scope is therefore broader than central government departments alone.
Devolved governments are invited to support and align with the plan where doing so does not affect their devolved functions. The invitation does not remove the distinction between reserved and devolved responsibilities.
Rank #3
Who is responsible for public-sector cyber resilience?
Each department and public body remains responsible for its own cyber security and risk management. Lead government departments also have a sector oversight role for the organisations within their remit. They are expected to report on sector-wide risk, apply appropriate standards and manage escalation. The plan strengthens coordination and support, but it does not make the central unit the sole accountable party for every public body’s security.
Organisations are expected to address supplier exposure through procurement decisions, contractual security requirements and ongoing review. That matters because public services depend on external software and service providers as well as their own systems.
How the plan relates to existing government cyber measures
The Government Cyber Action Plan builds on existing structures rather than presenting the new unit as the only government cyber function. In a 6 January 2026 written ministerial statement, ministers described the Government Cyber Coordination Centre (GC3) as coordinating government incident response and identified GovAssure and Secure by Design as existing measures. The plan sets out a more joined-up operating model around such structures. The ministerial statement provides that context.
Why ministers say the plan is needed
In the same 6 January 2026 written ministerial statement, ministers cited a Legal Aid Agency incident that compromised personal data and affected digital processing of legal aid applications and bills. They also cited the attack on Synnovis, an NHS pathology supplier, saying it delayed over 11,000 outpatient and elective procedure appointments and contributed to a patient’s death. These examples were cited by ministers to illustrate the potential consequences of disruption to public services; the statement is not an independent investigation by the action plan.
Best Value
Software supply-chain security and the ambassador scheme
Alongside the plan, DSIT announced a Software Security Ambassador Scheme to encourage adoption of its voluntary Software Security Code of Practice. The announcement names Cisco, Palo Alto Networks, Sage, Santander and NCC Group among firms participating as ambassadors. Participation does not make these firms government-endorsed product recommendations or establish that they are suppliers to the funded programme.
DSIT said that 59% of organisations had experienced software supply-chain attacks in the past year, attributing the statistic to Ponemon Institute LLC’s State of Software Supply Chain Security Risks. The announcement does not state the report year, so the figure should not be assigned a year-specific date based on that announcement alone. The DSIT announcement also presents up to £45 billion in productivity savings from digitising public services as a potential government estimate, not a realised or guaranteed saving.
What is confirmed about progress and funding?
In a written parliamentary answer dated 22 May 2026, DSIT reiterated that the over-£210 million investment establishes the Government Cyber Unit and enables scalable services, support and response capability. The answer also reported the Cyber Security and Resilience Bill’s parliamentary stage at that time; bill progress is date-sensitive and that statement is only a snapshot as of 22 May 2026. Neither the announcement nor that answer establishes how much of the investment had been committed or spent. The parliamentary answer records DSIT’s response.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →The official publication record for the plan says it was published on 6 January 2026 and updated on 20 March 2026. Check the publication record for the current document and any updates.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
