Police and fire IT systems must become much more secure, HMICFRS says

The report covers police in England and Wales and fire in England

HMICFRS is His Majesty's Inspectorate of Constabulary and Fire & Rescue Services. Its report covers the 43 Home Office police forces in England and Wales, and the 44 fire and rescue services in England.

Michelle Skeer is His Majesty's Inspector of Constabulary and of Fire & Rescue Services. In the report, Skeer wrote that police and fire and rescue ICT systems need to become much more secure.

Old systems, suppliers, backups and leadership were the weak points

Leaders in both sectors named legacy systems as their highest strategic risk for cyber security.

The report says that using external suppliers to manage ICT systems or hold data creates extra governance and assurance challenges.

In some organisations, the inspectorate found poor controls when staff join, move or leave, and poor password management. It also found a lack of up-to-date approaches such as multi-factor authentication.

Both sectors had examples of unsatisfactory arrangements for ICT backups and restoration. Several senior police and fire leaders said they did not consider cyber security part of daily operational decisions.

Fire services and police contracts get deadlines

By November 2027, all chief fire officers in England should adopt the NCSC's Cyber Assessment Framework. Every fire and rescue service in England should reach at least its baseline standard.

By May 2027, chief fire officers should make sure that new or renewed supplier contracts meet the standards set out in Cyber Essentials. By the same date, each chief constable in England and Wales should review police ICT contracts. Contracts without adequate cyber security assurance should be improved.

What it means for suppliers and other public bodies

Cyber Essentials is the minimum standard of cyber security the UK government recommends for organisations of all sizes. It rests on five technical controls against the most common internet threats.

The NCSC says a growing number of organisations already require suppliers to be certified before they can bid for work.

The Cyber Assessment Framework is an NCSC tool to help organisations assess and improve their cyber security and resilience. It is meant for, among others, public sector organisations that support core government functions.