# Police and fire IT systems must become much more secure, HMICFRS says The inspectorate found old systems, gaps in supplier checks and backups, and leaders who do not treat cyber security as an everyday decision. The Assurance Desk, news. Published 27 October 2026. HMICFRS, the inspectorate of police and of fire and rescue services, published its report on their cyber security on 27 October 2026. It makes 13 recommendations ([hmicfrs.justiceinspectorates.gov.uk, Cybersecurity in police forces and fire and rescue services, His Majesty’s Inspectorate of Constabulary and Fire & Rescue Services](https://hmicfrs.justiceinspectorates.gov.uk/publication-html/cybersecurity-in-police-forces-and-fire-and-rescue-services/), checked 27 October 2026). ## The report covers police in England and Wales and fire in England HMICFRS is His Majesty's Inspectorate of Constabulary and Fire & Rescue Services. Its report covers the 43 Home Office police forces in England and Wales, and the 44 fire and rescue services in England ([hmicfrs.justiceinspectorates.gov.uk, Cybersecurity in police forces and fire and rescue services, His Majesty’s Inspectorate of Constabulary and Fire & Rescue Services](https://hmicfrs.justiceinspectorates.gov.uk/publication-html/cybersecurity-in-police-forces-and-fire-and-rescue-services/), checked 27 October 2026). Michelle Skeer is His Majesty's Inspector of Constabulary and of Fire & Rescue Services. In the report, Skeer wrote that police and fire and rescue ICT systems need to become much more secure ([hmicfrs.justiceinspectorates.gov.uk, Cybersecurity in police forces and fire and rescue services, His Majesty’s Inspectorate of Constabulary and Fire & Rescue Services](https://hmicfrs.justiceinspectorates.gov.uk/publication-html/cybersecurity-in-police-forces-and-fire-and-rescue-services/), checked 27 October 2026). ## Old systems, suppliers, backups and leadership were the weak points Leaders in both sectors named legacy systems as their highest strategic risk for cyber security ([hmicfrs.justiceinspectorates.gov.uk, Cybersecurity in police forces and fire and rescue services, His Majesty’s Inspectorate of Constabulary and Fire & Rescue Services](https://hmicfrs.justiceinspectorates.gov.uk/publication-html/cybersecurity-in-police-forces-and-fire-and-rescue-services/), checked 27 October 2026). The report says that using external suppliers to manage ICT systems or hold data creates extra governance and assurance challenges ([hmicfrs.justiceinspectorates.gov.uk, Cybersecurity in police forces and fire and rescue services, His Majesty’s Inspectorate of Constabulary and Fire & Rescue Services](https://hmicfrs.justiceinspectorates.gov.uk/publication-html/cybersecurity-in-police-forces-and-fire-and-rescue-services/), checked 27 October 2026). In some organisations, the inspectorate found poor controls when staff join, move or leave, and poor password management. It also found a lack of up-to-date approaches such as multi-factor authentication ([hmicfrs.justiceinspectorates.gov.uk, Cybersecurity in police forces and fire and rescue services, His Majesty’s Inspectorate of Constabulary and Fire & Rescue Services](https://hmicfrs.justiceinspectorates.gov.uk/publication-html/cybersecurity-in-police-forces-and-fire-and-rescue-services/), checked 27 October 2026). Both sectors had examples of unsatisfactory arrangements for ICT backups and restoration. Several senior police and fire leaders said they did not consider cyber security part of daily operational decisions ([hmicfrs.justiceinspectorates.gov.uk, Cybersecurity in police forces and fire and rescue services, His Majesty’s Inspectorate of Constabulary and Fire & Rescue Services](https://hmicfrs.justiceinspectorates.gov.uk/publication-html/cybersecurity-in-police-forces-and-fire-and-rescue-services/), checked 27 October 2026). **What the inspectorate found, and what it asks for** - **What it found** - Legacy systems are the highest strategic risk. - External ICT suppliers add governance and assurance challenges. - Weak controls for staff joining and leaving, and weak passwords. - Unsatisfactory backup and restoration arrangements. - Cyber security is not part of daily decisions for several leaders. - **What it asks for** - Fire services in England adopt the Cyber Assessment Framework by November 2027. - Fire service supplier contracts meet Cyber Essentials standards by May 2027. - Police forces review ICT contracts for cyber security assurance by May 2027. A selection of the findings and recommendations in the HMICFRS report of 27 October 2026. The report has 13 recommendations in all. Source: hmicfrs.justiceinspectorates.gov.uk, Cybersecurity in police forces and fire and rescue services, His Majesty’s Inspectorate of Constabulary and Fire & Rescue Services, https://hmicfrs.justiceinspectorates.gov.uk/publication-html/cybersecurity-in-police-forces-and-fire-and-rescue-services/ (checked 27 October 2026) ## Fire services and police contracts get deadlines By November 2027, all chief fire officers in England should adopt the NCSC's Cyber Assessment Framework. Every fire and rescue service in England should reach at least its baseline standard ([hmicfrs.justiceinspectorates.gov.uk, Cybersecurity in police forces and fire and rescue services, His Majesty’s Inspectorate of Constabulary and Fire & Rescue Services](https://hmicfrs.justiceinspectorates.gov.uk/publication-html/cybersecurity-in-police-forces-and-fire-and-rescue-services/), checked 27 October 2026). By May 2027, chief fire officers should make sure that new or renewed supplier contracts meet the standards set out in Cyber Essentials. By the same date, each chief constable in England and Wales should review police ICT contracts. Contracts without adequate cyber security assurance should be improved ([hmicfrs.justiceinspectorates.gov.uk, Cybersecurity in police forces and fire and rescue services, His Majesty’s Inspectorate of Constabulary and Fire & Rescue Services](https://hmicfrs.justiceinspectorates.gov.uk/publication-html/cybersecurity-in-police-forces-and-fire-and-rescue-services/), checked 27 October 2026). ## What it means for suppliers and other public bodies Cyber Essentials is the minimum standard of cyber security the UK government recommends for organisations of all sizes. It rests on five technical controls against the most common internet threats ([NCSC, Cyber Essentials](https://www.ncsc.gov.uk/cyberessentials/overview), checked 27 October 2026). The NCSC says a growing number of organisations already require suppliers to be certified before they can bid for work ([NCSC, Cyber Essentials](https://www.ncsc.gov.uk/cyberessentials/overview), checked 27 October 2026). The Cyber Assessment Framework is an NCSC tool to help organisations assess and improve their cyber security and resilience. It is meant for, among others, public sector organisations that support core government functions ([NCSC, Cyber Assessment Framework](https://www.ncsc.gov.uk/collection/cyber-assessment-framework), checked 27 October 2026). ## Read next - [Cyber security: the section](https://theassurancedesk.com/cyber-security) - [How much is Cyber Essentials, and what does it ask?](https://theassurancedesk.com/guides/cyber-essentials-cost-and-requirements) - [What is supplier assurance, and what do buyers check?](https://theassurancedesk.com/guides/supplier-assurance-what-buyers-check) - [Regulated sectors](https://theassurancedesk.com/best/sector-regulated) ## Sources - hmicfrs.justiceinspectorates.gov.uk, Cybersecurity in police forces and fire and rescue services, His Majesty’s Inspectorate of Constabulary and Fire & Rescue Services: https://hmicfrs.justiceinspectorates.gov.uk/publication-html/cybersecurity-in-police-forces-and-fire-and-rescue-services/ (checked 27 October 2026) - NCSC, Cyber Essentials: https://www.ncsc.gov.uk/cyberessentials/overview (checked 27 October 2026) - NCSC, Cyber Assessment Framework: https://www.ncsc.gov.uk/collection/cyber-assessment-framework (checked 27 October 2026) This is an independent editorial guide, not legal advice. --- **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.