UK watchdog urges police and fire services to boost cyber defences

A HM Inspectorate report has warned that the cyber threat to UK police forces and fire and rescue services is growing rapidly and requires a more urgent response. The Cybersecurity in Police Forces and Fire and Rescue Services report, published by HMICFRS on 27 October 2026 after a three-phase inspection between January and May 2026, is based on dozens of interviews, “reality testing” and examination of over 260 service documents.

Michelle Skeer, HMICFRS inspector of constabulary, said that while there have been gradual improvements, many forces and services still need to redouble efforts to counter increased cyber risk, urging leaders to treat cybersecurity as a core organisational priority and to invest to prevent, detect, respond to and recover from attacks.

The assessment identifies several weaknesses: legacy ICT systems that are hard to patch, exposure to third‑party risk, underdeveloped preparedness and resilience (backups and incident response), basic control failures around access management and provisioning, a lack of senior‑level accountability for cybersecurity, and uneven national coordination causing varying cyber maturity.

HMICFRS outlines 13 recommendations, including baseline cybersecurity standards (the Cyber Assessment Framework), third‑party assessments, better procurement and management of ICT suppliers (including mandatory Cyber Essentials), and enhanced collaboration between government and policing cyber leads.

It also calls for greater use of the Police Digital Service’s National Management Centre and a national capability for fire and rescue services, alongside improved preparedness, backup/restore testing and leadership development for senior staff. Skeer emphasised that reform opportunities should be seized to strengthen protection of systems and data.