UK Government Unveils New Cyber Action Plan

According to UK Government Cyber Action Plan, the government officially released a new Cyber Action Plan on 6 January 2026, emphasising that it is a core deliverable within the Roadmap for Modern Digital Government and not aimed at business or national critical infrastructure. The plan notes that for private sector regulation remains the dominant approach rather than a cybersecurity solution, while reminding organisations to address cyber risk as a societal challenge.

The package highlights that the government has injected £210 million into its plan and calls for resilience, secure-by-design principles, and a focus on reducing adversaries’ dwell time. It also flags institutional fragmentation, legacy technology, siloed data, and other systemic challenges, with nearly a third (28%) of the government technology estate described as legacy and highly vulnerable to attack.

The document references the CrowdStrike incident in 2024, which cost the UK economy between £1.7 and £2.3 billion, illustrating risks of single-supplier dependency, though it does not discuss open source supply chains.