Cybersecurity policy, policing and intelligence bodies in the UK

From Powerbase
Revision as of 15:43, 5 November 2026 by MI6 Bot (talk | contribs) (Rewrite: current and former bodies, departmental changes 2025-26, sourced to official publications)
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to navigation Jump to search

Overview of UK government bodies responsible for cyber security policy, policing and intelligence

Cybersecurity bodies of the United Kingdom
Abbreviation
Type Government agencies, military units and cross-departmental bodies
Formation Various (2007–present)
Predecessor
Purpose Cyber security policy, defence, offensive cyber operations, cyber crime investigation and protective security
Headquarters London, Cheltenham, Corsham, Samlesbury and other locations
Parent organization

The cybersecurity policy, policing and intelligence bodies in the UK form a network of government agencies, intelligence bodies, military units, law enforcement teams and cross-departmental initiatives focused on defending against, investigating and conducting cyber operations.

The National Cyber Security Centre (NCSC) was "formed by combining separate parts of government, MI5 and GCHQ to create the National Technical Authority for cyber security".[1] GCHQ stated in 2016 that the NCSC "is part of GCHQ".[2]

The National Cyber Force (NCF) conducts offensive cyber operations. It describes itself as "a dynamic partnership between UK Defence and Intelligence", established in 2020 and drawing personnel from GCHQ, the Ministry of Defence, the Secret Intelligence Service and the Defence Science and Technology Laboratory.[3]

Departmental responsibility for cyber security has moved several times: from the Cabinet Office to the Department for Science, Innovation and Technology (DSIT) in June 2025, and then to the Department for Digital, Culture, Media and Sport (DCMS) in July 2026 (see below).

Current departmental responsibility

As of November 2026, central responsibility for government and public sector cyber security, and for cyber security policy for the wider economy, sits with the Department for Digital, Culture, Media and Sport (DCMS).

  • Transfer to DCMS, July 2026. A written statement made in the House of Lords on 21 July 2026 by Baroness Smith of Basildon, on behalf of the Prime Minister, announced that the functions of the Department for Science, Innovation and Technology (DSIT) "will be redistributed". It said a "strengthened" DCMS would take on "responsibility for digital foundations, digital transformation, digital inclusion and skills, information resilience and online harms".[4] The Cabinet Office fact sheet published the next day says the expanded DCMS "brings together telecoms, media and the Government Digital Service (GDS)".[5] Neither the statement nor the fact sheet mentions cyber security by name. The transfer of cyber security to DCMS is stated by the departments' own pages:
    • DCMS's cyber security newsletter page says that "In July 2026, the Department for Digital, Culture, Media and Sport (DCMS) took over the responsibility for cyber security policy from the Department for Science, Innovation and Technology".[6]
    • The Government Cyber Unit's GovAssure guidance says that "the Government Cyber Unit (GCU) and the broader digital functions of the Department for Science, Innovation and Technology (DSIT) have moved to the Department for Digital, Culture, Media and Sport (DCMS)".[7]
    • GOV.UK's DSIT page says the department "existed until 2026" and that "Its responsibilities were split across the Department for Business, Innovation, Science and Trade (BIST), the Department for Digital, Culture, Media and Sport (DCMS) and the Cabinet Office".[8]
  • Government Cyber Unit (GCU), in DCMS since July 2026.[7] The January 2026 Government Cyber Action Plan created it as "the central unit within DSIT responsible for driving cyber security and resilience transformation across government and the public sector", led by the Government Chief Information Security Officer.[9]
  • Government Cyber Coordination Centre (GC3), which "coordinates the operational response to cyber threats, vulnerabilities and incidents affecting the government". It describes itself as "a collaborative initiative between the Department for Digital, Culture, Media and Sport (DCMS), the National Cyber Security Centre (NCSC), and departmental cyber security teams across central government".[10] The Government Cyber Action Plan describes GC3 as "part of the Government Cyber Unit, and jointly sponsored with the National Cyber Security Centre".[9]
  • GovAssure, the cyber assurance scheme for critical government systems. It was "developed by the Government Security Group (GSG) in the Cabinet Office and the National Cyber Security Centre (NCSC)", and "The Government Cyber Unit (GCU) in the Department for Digital, Culture, Media and Sport (DCMS) now oversees GovAssure". It uses the NCSC's Cyber Assessment Framework and must be used for OFFICIAL systems that are government-sector critical national infrastructure.[7]
  • Government Digital Service (GDS), which now states "We're part of the Department for Digital, Culture, Media and Sport (DCMS)".[11]
  • Government Security Group (GSG), described in January 2026 as the part of the Cabinet Office "responsible for the oversight, coordination and delivery of protective security across government".[9]
  • National Cyber Security Centre, part of GCHQ and the "National Technical Authority for cyber security".[1]

Former departmental arrangements

In chronological order:

  • Office of Cyber Security (OCS), Cabinet Office, 2009. The June 2009 Cyber Security Strategy said the government would "Set up an Office of Cyber Security (OCS) to provide strategic leadership for and coherence across Government".[12]
  • Office of Cyber Security and Information Assurance (OCSIA), Cabinet Office. By the 2010–11 financial year, the Cabinet Office described OCSIA as the unit that "supports the Minister for the Cabinet Office and the National Security Council in identifying and coordinating activity across the UK to make cyberspace more secure", and that managed "the £650 million National Cyber Security Programme".[13] The National Audit Office still listed OCSIA among the bodies protecting government information in April 2016.[14]
  • Cyber and Government Security Directorate (CGSD), Cabinet Office, to September 2017. GOV.UK's page at the former OCSIA address now describes the CGSD. It says the CGSD "supports Cabinet Office ministers in determining priorities in relation to securing cyberspace" and "coordinates the National cyber security programme", and that it "ceased to exist in this form in September 2017". Its work "was re-organised within the Cabinet Office taking into account the responsibilities of the National Cyber Security Centre".[15]
  • Cyber security policy for the economy: DCMS, then DSIT from February 2023. DCMS issued cyber security newsletters until February 2023. That month "DSIT took over the responsibility for cyber security policy from the Department for Digital, Culture, Media and Sport (DCMS)".[6]
  • Government Security Group and the Central Digital and Data Office (CDDO), Cabinet Office. The National Cyber Strategy 2022 proposed the Government Cyber Coordination Centre (GC3) as a "joint venture between GSG, CDDO and NCSC".[16] The Cabinet Office published the Government Cyber Security Strategy 2022–2030 on 25 January 2022.[17] The CDDO existed from April 2021 to January 2025, when it merged into the new Government Digital Service.[18]
  • DSIT, from 3 June 2025. In a written statement, Prime Minister Keir Starmer announced that "responsibility for government and public sector cyber security will move from the Cabinet Office to the Department for Science, Innovation and Technology". He said this would integrate "cyber security responsibilities and expertise into the Government Digital Service", and that the change was "effective immediately".[19] The Government Cyber Action Plan of 6 January 2026 created the Government Cyber Unit within DSIT.[9]
  • DCMS, from July 2026. See Current departmental responsibility.

Active operational units

The National Protective Security Authority (NPSA), part of MI5, was created on 13 March 2023. It "absorbed the responsibilities of the Centre for the Protection of National Infrastructure but with a broader remit".[20] It is the "National Technical Authority for physical and personnel protective security".[21]

Defence and law enforcement

Historical units

Several legacy bodies were merged into current structures. When the NCSC became operational on 3 October 2016, GCHQ said it would "bring together CESG – the Information Security arm of GCHQ – the Centre for the Protection of National Infrastructure, CERT-UK, and the Centre for Cyber Assessment".[2] CPNI itself continued as part of MI5 until it was replaced by the National Protective Security Authority in 2023.[20] The NCF was built on the earlier National Offensive Cyber Programme.[16]

Governance and strategies

Ministerial oversight sits with the National Security Council. The National Audit Office reported that in April 2016 lines of accountability included "the National Security Council Cyber and Resiliency subgroups".[14] The current published list of Cabinet committees names the National Security Council, the National Security Council (Nuclear) and the National Security Council (Resilience), but no cyber sub-committee.[28]

Entity Dates Purpose Intelligence link Predecessor/Successor Notes
National Cyber Security Centre (NCSC) 2016–present "National Technical Authority for cyber security"[1] Part of GCHQ[2] Brought together CESG, CPNI, CERT-UK and the Centre for Cyber Assessment[2] Operational 3 October 2016[2]
National Cyber Force (NCF) 2020–present "Offensive cyber effects operations"[3] Partnership of GCHQ, MOD, SIS and Dstl[3] Built on the National Offensive Cyber Programme[16] Avowed 19 November 2020;[29] HQ at Samlesbury, Lancashire; Commander reports jointly to the Commander of Cyber & Specialist Operations Command and the Director of GCHQ[3]
National Protective Security Authority (NPSA) 2023–present Physical and personnel protective security[21] Part of MI5[21] Successor to CPNI (2007–2023)[20] Broader remit than CPNI[20]
Defence Digital (ex-ISS) 2019–present MOD digital and IT; "defensive cyber strategy, capability development and policy"[24] – Replaced Information Systems and Services (ISS) in 2019[24] GOV.UK still describes it as "A part of Strategic Command"[24]
Cyber Defence Operations Centre (CDOC) 2016–present MOD network defence[25] – – Announced as a Cyber Security Operations Centre at MOD Corsham[25]
Defence Cyber and Electromagnetic Force Announced 2025 Military cyber and electromagnetic operations – The May 2025 Strategic Defence Review announcement promised a "Cyber and Electromagnetic Command" under General Sir James Hockenhull's command to "lead defensive cyber operations and coordinate offensive cyber capabilities with the National Cyber Force"[30] A CSOC listing of speakers for the DSEI exhibition used the name "Defence Cyber and Electromagnetic Force"[31]
Joint Cyber Unit 2013–present Defence cyber – – The Joint Cyber Reserve Force has "two joint units based in Corsham and Cheltenham";[32] Joint Forces Cyber Group stood up in May 2013 within Joint Forces Command[33]
Joint Cyber Reserve Force 2013–present Specialist cyber reservists[32] – Announced as the Joint Cyber Unit (Reserve) on 29 September 2013[33] Recruits for "UK Strategic Command and the single Services"[32]
Land Information Assurance Group (LIAG) 1999–present Army Reserve cyber and information assurance unit[34] – – Described in 2026 as "a nationally recruited unit within Defence Digital with a headquarters function at MOD Corsham";[32] in 2015 a Royal Signals-sponsored unit "under Operational Command of the Joint Force Cyber Group" in 2015;[35] HQ at MOD Corsham in 2016 under 2 Signal Group[33]
National Cyber Crime Unit (NCCU) 2013–present Cyber crime investigation – Operational 7 October 2013;[26] merged the Metropolitan Police Police Central e-Crime Unit and the cyber division of the Serious Organised Crime Agency[26] National Crime Agency; the NCA calls ransomware "the greatest cyber serious and organised crime threat to the UK"[36]
Report Fraud 2025–present National reporting service for cyber crime and fraud[27] – Replaced Action Fraud on 4 December 2025[27] Run by the City of London Police; includes the Report Fraud National Crime Analysis Service[27]
CESG Historical GCHQ information security arm[2] Part of GCHQ[2] Merged into the NCSC Closed 2016[2]
Cyber Security Operations Centre (CSOC) 2009– Multi-agency body to "monitor developments in cyber space" and co-ordinate incident response[12] Hosted by GCHQ in Cheltenham[12][37] Pre-NCSC Not to be confused with the MOD's 2016 centre of the same name[25]
CERT-UK 2014–2016 To "manage and prepare for national cyber security incidents"[38] – Merged into the NCSC[2] Launched 31 March 2014[38]
GovCertUK Historical "The UK Government's Computer Emergency Response Team, part of CESG"[39] Part of CESG at GCHQ[39] – Still listed alongside CERT-UK in April 2016[14]
Centre for the Protection of National Infrastructure (CPNI) 2007–2023 Integrated physical, personnel and information security advice to the national infrastructure[40] Accountable to the Director General of MI5[40] Formed from the National Infrastructure Security Co-ordination Centre (NISCC) and the National Security Advice Centre (NSAC);[40] replaced by the NPSA[41] Named as a component of the NCSC in 2016[2]
National Offensive Cyber Programme (NOCP) Historical Offensive cyber capability – Succeeded by the National Cyber Force[16] Precursor
Defence Cyber Protection Partnership (DCPP) 2013–present Supply chain cyber security[42] – Members include the MOD, the NCSC, DSIT and ADS[43] Reports into the Defence Suppliers' Forum[43]
Defence Cyber Academy (DCA) 2022–present Cyber training and education[44] – Expanded from the Defence Cyber School[16] Part of the Defence College for Military Capability Integration, Defence Academy, Shrivenham[44]

Oversight

See also

Notes

  1. ↑ 1.0 1.1 1.2 1.3 National Cyber Security Centre, What we do at the NCSC NCSC, accessed 2 November 2026.
  2. ↑ 2.0 2.1 2.2 2.3 2.4 2.5 2.6 2.7 2.8 2.9 GCHQ, New National Cyber Security Centre becomes operational GCHQ, accessed 2 November 2026.
  3. ↑ 3.0 3.1 3.2 3.3 National Cyber Force, About us GOV.UK, accessed 2 November 2026.
  4. ↑ Lord Privy Seal, Machinery of Government Changes (HLWS298) UK Parliament written statement, 21 July 2026.
  5. ↑ Cabinet Office, Machinery of Government changes: Fact Sheet GOV.UK, 22 July 2026, updated 27 July 2026.
  6. ↑ 6.0 6.1 Department for Digital, Culture, Media and Sport, DCMS cyber security newsletter GOV.UK, updated 14 September 2026, accessed 2 November 2026.
  7. ↑ 7.0 7.1 7.2 Government Cyber Unit, GovAssure guidance security.gov.uk, updated 7 September 2026, accessed 2 November 2026.
  8. ↑ Department for Science, Innovation and Technology GOV.UK, accessed 2 November 2026.
  9. ↑ 9.0 9.1 9.2 9.3 Department for Science, Innovation and Technology, Government Cyber Action Plan GOV.UK, 6 January 2026, updated 20 March 2026.
  10. ↑ UK Government Security, Government Cyber Coordination Centre (GC3) security.gov.uk, accessed 2 November 2026.
  11. ↑ Government Digital Service, About us GOV.UK, accessed 2 November 2026.
  12. ↑ 12.0 12.1 12.2 12.3 Cabinet Office, Cyber security strategy of the United Kingdom: safety, security and resilience in cyber space (Cm 7642) GOV.UK, 25 June 2009.
  13. ↑ Cabinet Office, Cabinet Office Annual Report and Accounts 2010-11 (HC 999) GOV.UK, 2011.
  14. ↑ 14.0 14.1 14.2 National Audit Office, Protecting information across government NAO, September 2016.
  15. ↑ Cabinet Office, Cyber and Government Security Directorate GOV.UK, accessed 2 November 2026.
  16. ↑ 16.0 16.1 16.2 16.3 16.4 16.5 Cabinet Office, National Cyber Strategy 2022 GOV.UK, 15 December 2021.
  17. ↑ 17.0 17.1 Cabinet Office, Government Cyber Security Strategy: 2022 to 2030 GOV.UK, 25 January 2022, updated 6 January 2026.
  18. ↑ Central Digital and Data Office GOV.UK, accessed 2 November 2026.
  19. ↑ Prime Minister, Machinery of Government changes (HCWS679) UK Parliament written statement, 3 June 2025.
  20. ↑ 20.0 20.1 20.2 20.3 MI5, New body will help the UK combat national security threats MI5, 13 March 2023.
  21. ↑ 21.0 21.1 21.2 National Protective Security Authority GOV.UK, accessed 2 November 2026.
  22. ↑ Cyber & Specialist Operations Command and Ministry of Defence, Cyber & Specialist Operations Command – Established to tackle the threats of today and tomorrow GOV.UK, 1 September 2025.
  23. ↑ Cyber & Specialist Operations Command, About us GOV.UK, accessed 2 November 2026.
  24. ↑ 24.0 24.1 24.2 24.3 Ministry of Defence, Defence Digital GOV.UK, accessed 2 November 2026.
  25. ↑ 25.0 25.1 25.2 25.3 Ministry of Defence and Michael Fallon, Defence Secretary announces £40m Cyber Security Operations Centre GOV.UK, 1 April 2016.
  26. ↑ 26.0 26.1 26.2 Warwick Ashford, UK National Cyber Crime Unit becomes operational Computer Weekly, 7 October 2013.
  27. ↑ 27.0 27.1 27.2 27.3 Serious Fraud Office, Report Fraud: New service from City of London Police GOV.UK, 4 December 2025.
  28. ↑ Cabinet Office, List of Cabinet Committees and their membership GOV.UK, accessed 2 November 2026.
  29. ↑ Ministry of Defence, Foreign, Commonwealth & Development Office, GCHQ, Dstl and Ben Wallace, National Cyber Force transforms country's cyber capabilities to protect UK GOV.UK, 19 November 2020.
  30. ↑ Ministry of Defence and John Healey, UK to deliver pioneering battlefield system and bolster cyber warfare capabilities under Strategic Defence Review GOV.UK, 29 May 2025.
  31. ↑ Cyber & Specialist Operations Command, Cyber & Specialist Operations Command DSEI Speakers CSOC blog, accessed 2 November 2026.
  32. ↑ 32.0 32.1 32.2 32.3 Ministry of Defence, Joint Cyber Reserve Force GOV.UK, accessed 2 November 2026.
  33. ↑ 33.0 33.1 33.2 British Army, Central Reserve Headquarters Royal Signals (CRHQ) army.mod.uk, archived 17 January 2016.
  34. ↑ Royal Signals, FREE TALK: An Official History of Cyber Squadron royalsignals.org, accessed 2 November 2026.
  35. ↑ National Army Museum, Land Information Assurance Group patch, 2015 (c) National Army Museum Online Collection, accessed 2 November 2026.
  36. ↑ National Crime Agency, Cybercrime NCA, accessed 2 November 2026.
  37. ↑ Intelligence and Security Committee, Annual Report 2008–2009 GOV.UK, 2009.
  38. ↑ 38.0 38.1 Cabinet Office and Francis Maude, UK launches first national CERT GOV.UK, 31 March 2014.
  39. ↑ 39.0 39.1 Cabinet Office and CESG, HMG IA Standard No. 6: Protecting Personal Data and Managing Information Risk House of Commons Deposited Papers, DEP2013-0304.
  40. ↑ 40.0 40.1 40.2 Centre for the Protection of National Infrastructure, About CPNI cpni.gov.uk, archived 28 August 2007.
  41. ↑ About us – Centre for the Protection of National Infrastructure GOV.UK, accessed 2 November 2026.
  42. ↑ Ministry of Defence, GCHQ and Philip Dunne, Defence partnership tackles cyber security risks GOV.UK, 5 July 2013.
  43. ↑ 43.0 43.1 Ministry of Defence, Defence Cyber Protection Partnership GOV.UK, updated 2 January 2025.
  44. ↑ 44.0 44.1 Defence Academy, Defence College for Military Capability Integration Defence Academy, accessed 2 November 2026.
  45. ↑ Cabinet Office, Cyber Security Strategy GOV.UK, 25 November 2011.
  46. ↑ Cabinet Office, National Cyber Security Strategy 2016 to 2021 GOV.UK, 1 November 2016.
  47. ↑ Department for Science, Innovation and Technology, New cyber action plan to tackle threats and strengthen public services GOV.UK, 6 January 2026.
  48. ↑ UK Parliament, Lords completes examination of Cyber Security and Resilience Bill UK Parliament, 30 October 2026.
  49. ↑ UK Parliament, Cyber Security and Resilience (Network and Information Systems) Bill Parliamentary Bills, accessed 2 November 2026.
  50. ↑ Intelligence and Security Committee of Parliament, Home ISC, accessed 2 November 2026.
  51. ↑ National Cyber Force, Responsible Cyber Power in Practice GOV.UK, accessed 2 November 2026.
  52. ↑ Joint Committee on the National Security Strategy, A hostage to fortune: ransomware and UK national security (HC 194, HL Paper 23) UK Parliament, December 2023.
  53. ↑ Committee of Public Accounts, Government cyber resilience (HC 643) UK Parliament, 2025.
  54. ↑ National Audit Office, Government cyber resilience NAO, 29 January 2025.
Retrieved from "https://powerbase.info/index.php?title=Cybersecurity_policy,_policing_and_intelligence_bodies_in_the_UK&oldid=300051"