The UK public sector has reached a cyber resilience inflection point. A new Prime Minister has taken office, and significant machinery-of-government changes have already been announced, including the scrapping of DSIT, the department that had become the center of government digital, technology and cyber policy. Its responsibilities are now being redistributed across other parts of Whitehall, creating a new policy and delivery landscape for public sector leaders to navigate. For years, cyber security was treated as a specialist operational discipline that was essential but largely delegated to technical teams. That model is no longer sustainable. Pressure is now coming from three directions at once, as policy raises expectations for boards and senior leaders, organizational reform reshapes how services, systems and suppliers connect, and technology change, from cloud and hybrid work to AI, expands both opportunity and exposure. Together, these forces mean cyber resilience can no longer sit below board level. Public services, from healthcare and benefits to transport, education, local government and emergency response, are now so digitally dependent that a cyber incident is not simply an IT outage. It is a risk to public trust, public safety and the continuity of government itself. Recent history shows what this means in practice. The 2024 ransomware attack on Synnovis, a pathology services provider to parts of the NHS, significantly reduced the capacity to process blood, urine and specimen tests, caused disruption across south-east London and contributed to delays affecting more than 11,000 outpatient and elective procedure appointments. Incidents like this turn abstract cyber risk into real-world service disruption, making resilience a boardroom issue rather than a back-office concern. Cyber resilience is no longer a technical aspiration, but a leadership obligation shaped by policy, organizational and technology change. Policy change has made cyber resilience a leadership obligation
The direction from government and the National Cyber Security Centre is clear. The Cyber Resilience Pledge asks organizations to make cyber security a board-level responsibility, register for NCSC Early Warning and take a risk-based approach to Cyber Essentials across their supply chains. The NCSC’s Cyber Governance Code of Practice reinforces the point that cyber risk must be governed like any other material organizational risk. The Cyber Security and Resilience Bill will further expand expectations across essential and digital services, strengthening incident reporting and bringing more critical suppliers into scope. This matters because the scale and impact of cyber threats facing the UK are increasing sharply. The NCSC handled 204 nationally significant cyber incidents in the year to September 2025, up from 89 the previous year. That means the UK is now experiencing an average of four nationally significant cyber attacks every week. Policy has therefore changed the boardroom question. Leaders should no longer ask only whether an organization has invested in security tools. They need to ask whether they can prove resilience, evidence accountability and continue delivering critical services when systems are under pressure, suppliers are compromised, data access is disrupted or attackers are already inside the network. Organisational change is creating hidden cyber risk
The second force is organizational change. Local Government Reorganisation is redrawing structures and responsibilities across England. Rail renationalization and other shifts in public ownership are changing who owns, manages and secures critical data and systems. Departmental priorities and delivery models are also evolving under a new Prime Minister, with DSIT being dismantled and functions including digital transformation, public sector AI adoption, information resilience and online harms moving into different departments and central government structures. Every one of these transitions creates potential gaps. Systems need to be integrated. Identity and access privileges need to be reassessed…