Security Operations

Police and fire cyber recovery plans unsatisfactory, says HMICFRS

HMICFRS finds legacy IT, weak account controls, supplier risk and poor backup recovery across police and fire services, with a 2028 deadline for forces.

Shield graphic with the headline Police and fire told to fix cyber basics

The policing and fire inspectorate says police forces across England and Wales, and England’s fire services, are still too exposed to cyber attack, with legacy IT, weak account controls and poor recovery planning top of the list. Its 13 recommendations include a 2028 deadline for police maturity and a national monitoring capability for fire.

What happened

On 27 October 2026, His Majesty’s Inspectorate of Constabulary and Fire & Rescue Services (HMICFRS) published Cybersecurity in police forces and fire and rescue services. It examines how well both sectors can stop, spot, handle and bounce back from attacks. The evidence came from a three-phase inspection run between January and May 2026. It drew on dozens of interviews, reality testing and more than 260 documents. According to Deeside.com, inspectors visited six organisations, three from each sector, and the report does not name them.

Some gradual improvement has happened, but His Majesty’s Inspector of Constabulary Michelle Skeer warned that “a major cyberattack is not a hypothetical scenario”, as reported by ITPro. She said successful attacks on these services had already disrupted operations, endangered the public and cost a lot to put right. The inspectorate made 13 recommendations and says it will reinspect both sectors to check progress.

The detail

Every organisation inspected depended to some degree on outdated systems, and technology leaders in both sectors named that legacy estate as their biggest strategic cyber risk.

Identity was the next problem. Inspectors found poor password management, patchy multi-factor authentication and weak processes for staff who join, move roles or leave. Deeside.com reports that some organisations still had live accounts belonging to people who had already left. Training gaps compounded the problem.

Third-party risk runs through the whole report. Suppliers hold some of the most sensitive data policing has: victim records, safeguarding files, intelligence and live investigations. According to Deeside.com, the report found that in every attack between 2021 and 2025 that put police data at risk, the compromised party was a company holding police information, not police systems themselves. Deeside.com cites Police Digital Service figures showing 252 cyber security incidents and 796 near misses across policing in the first three months of 2026.

Recovery was a particular concern. Arrangements for backing up and restoring systems after an attack were judged “unsatisfactory”, and preparedness overall needs significant improvement. The inspectorate also found a leadership gap: several senior police and fire leaders said cyber security was not part of their daily operational decisions. Weak national coordination has left maturity uneven.

The recommendations fall broadly into three groups. The first sets baselines: every force and service should meet a minimum standard, with the Cyber Assessment Framework named as a model, and self-assessments should be checked externally. According to Deeside.com, by September 2028 every police force in England and Wales should score at least 3.0 on the national police cyber assessment, a scale running from 1.0 to 5.0. The fire recommendations cover only the 44 services in England. The second group is about suppliers: tighter procurement and contract management, with Infosecurity Magazine reporting that Cyber Essentials certification is part of this. The third group is operational. It calls for wider use of the Police Digital Service’s National Management Centre and a similar national capability for fire, better backup-and-restore work and incident response exercises, closer working between government and policing cyber leads, and better training for both security staff and senior leaders.

Checklist of six HMICFRS recommendations for police and fire cyber security, from baseline standards to leadership training

Why it matters for UK organisations

For the public, this is about whether 999 services and investigations keep running during an incident. The finding that supplier compromises, not attacks on force networks, caused the police data exposures examined is a warning for every organisation that outsources sensitive processing. You can outsource the work, but you cannot outsource the accountability.

The report also matters to suppliers. Expect more police and fire contracts to require Cyber Essentials, evidence of controls and proper incident notification terms. Companies that sell case management, records, command and control or managed IT into these sectors should get their evidence ready before buyers ask.

Deeside.com also reports the inspectorate concluded that cost was as much about priorities as affordability, a point that will resonate in many boardrooms.

Expert view

None of this surprises me, and that is the uncomfortable part. When we test large public sector environments, the routes in are rarely exotic. A dormant account for someone who left two years ago, a legacy server nobody dares patch, or a supplier with standing remote access into a sensitive system: these are what turn a phishing email into a serious incident.

What I most welcome is the focus on recovery and on central monitoring. In my experience, many organisations treat backups as an IT housekeeping task, not a security control. The first real restore test then happens mid-ransomware, on backups reachable from the compromised domain. A backup you have never restored under pressure is a hope, not a plan. Most individual forces and fire services cannot staff round-the-clock detection and response, so pooling it nationally is realistic, and extending that to fire is overdue.

My reservation is the timescale. A September 2028 target for a mid-point maturity level is a long runway when attackers move in days. Leadership also matters more than the framework. Skeer’s line, reported by Infosecurity Magazine, that “cybersecurity should be viewed as a core organisational priority” is right. Until chief constables and chief fire officers own cyber risk the way they own operational risk, the baseline will keep slipping.

What to do now

These apply to police, fire and any organisation with a similar estate.

  1. Clean up identities this month. Reconcile active accounts against HR leaver records, disable dormant and shared accounts, and enforce MFA on all remote and privileged access. This maps to the Cyber Essentials user access control requirement.
  2. Prove you can recover. Keep at least one backup copy offline or immutable, separate from your main identity domain, and run a timed restore of a critical system against your recovery targets.
  3. Map supplier data flows. List every third party that stores or accesses sensitive data, check their certification and breach notification terms, and remove standing remote access that is not needed. Make Cyber Essentials Plus a minimum for suppliers handling sensitive records.
  4. Ring-fence legacy systems. Where a platform cannot be patched, segment it, restrict who and what can reach it, and monitor it closely. This supports the Cyber Essentials firewall and security update controls.
  5. Connect to central monitoring. Police bodies should make full use of the National Management Centre. Other organisations without a 24/7 SOC should sign up to the NCSC’s Early Warning service and consider a managed detection and response service.
  6. Exercise the leadership. Run a scenario-based incident exercise with the senior team, not just IT, covering command decisions, communications and manual workarounds.

Bottom line

The HMICFRS report confirms what defenders have long suspected: the biggest risks in policing and fire are basic ones. Legacy kit, loose account management, supplier exposure and untested recovery are fixable, and the recommendations point the right way. The test now is whether leaders treat cyber resilience as part of keeping the public safe, rather than waiting for the 2028 deadline or a major incident to force the issue.

Sources

Related Posts