Watchdog Urges Police and Fire Service to Improve Cybersecurity

The cyber threat to UK police forces and fire and rescue services is growing rapidly and demands a more urgent response, an independent assessment has warned.

The Cybersecurity in Police Forces and Fire and Rescue Services report from His Majesty’s Inspectorate of Constabulary and Fire & Rescue Services (HMICFRS) was published on October 27.

It was compiled from a three-phase inspection carried out between January and May 2026, and involved dozens of interviews, “reality testing,” and scrutiny of over 260 police service and fire and rescue service documents.

“While there have been gradual improvements, many forces and services still need to urgently redouble their efforts to respond to the increased risk of cyber-attacks,” warned Michelle Skeer, His Majesty’s inspector of constabulary.

“Cybersecurity should be viewed as a core organizational priority and not solely a technical risk. Leaders need to prioritize and invest in their cybersecurity arrangements to improve their organization’s ability to prevent, detect, respond to and recover from attacks.”

Read more on threats to policing infrastructure: Government Updates UK’s National Risk Register with Cyber Warnings

The report highlighted multiple areas of weakness:

• Legacy ICT systems identified as a “strategic risk” due to difficulties with patching and integration
• Exposure to third-party risk, especially ICT suppliers that manage sensitive police data, and human error when using external services
• Underdeveloped preparedness and resilience, including backups and incident response
• Basic control issues, including access management, authentication and provisioning/deprovisioning
• A lack of accountability at a senior level, with several police and fire leaders claiming cybersecurity isn’t part of daily operational decision-making
• Poor coordination at a national level, leading to uneven levels of cyber maturity across the various forces and fire/rescue services

A Plan for Improvement

HMICFRS made 13 recommendations for improving the cybersecurity posture of the nation’s police forces and fire and rescue services.

These include:

• Introducing baseline cybersecurity standards to improve maturity across the board (ie Cyber Assessment Framework)
• Third-party assessment of cybersecurity capabilities
• Improving procurement and contract management of third-party ICT suppliers (including mandatory Cyber Essentials certification)
• Enhancing collaboration between government and policing cybersecurity leads
• Promoting the use of the Police Digital Service’s National Management Centre, and creating a similar national capability for fire and rescue services
• Improving the preparedness of services to respond to an attack (eg backup and restore and incident response exercises)
• Improving learning and development for senior leaders and cybersecurity staff

“The government’s program of police reform and local government reorganization could offer both sectors opportunities to improve and better co-ordinate the approach to cybersecurity,” said Skeer. “These opportunities to strengthen cybersecurity cannot be missed. Protecting systems and data is essential to protecting the public.”