The rapidly evolving cyber threat landscape poses significant challenges for police forces and fire and rescue services across the United Kingdom, necessitating an urgent and comprehensive response. This stark warning comes from an independent assessment published by His Majesty’s Inspectorate of Constabulary and Fire & Rescue Services (HMICFRS) on October 27, 2026. The report, titled Cybersecurity in Police Forces and Fire and Rescue Services, underscores the pressing need for enhanced cybersecurity frameworks within these critical public sectors.
The assessment was the culmination of a meticulous three-phase inspection carried out between January and May 2026. It involved a thorough examination of various operational protocols, enriched by dozens of interviews, “reality testing,” and close scrutiny of over 260 documents pertaining to police and fire services. The findings reveal a mixed picture of progress; while there have been gradual improvements in certain areas, many forces are still lagging behind in their response strategies to an increasingly hostile cyber environment.
Michelle Skeer, His Majesty’s inspector of constabulary, remarked on the urgency of the situation: "Cybersecurity should be viewed as a core organizational priority and not solely a technical risk. Leaders need to prioritize and invest in their cybersecurity arrangements." She emphasized that not only is it vital to prevent and detect cyber threats, but organizations must also develop robust responses and recovery plans to tackle the inevitable attacks that arise in this digital era.
The report highlights several critical weaknesses within police and fire services, outlining areas where urgent improvements are required. Among these weaknesses are outdated Information and Communication Technology (ICT) systems, which have been classified as a “strategic risk” due to the challenges associated with patching and integration. Furthermore, the exposure to third-party risks is alarming; many police forces depend on ICT suppliers who manage sensitive data, leaving them vulnerable to breaches stemming from human error or inadequate external service protocols.
The assessment pointed to a lack of preparedness and resilience within the emergency services, particularly regarding backup systems and incident response capabilities. Fundamental control issues, including inadequate access management and authentication processes, further exacerbate the problem. The report also highlighted a disturbing trend of insufficient accountability at senior leadership levels, with numerous leaders within police and fire services claiming that cybersecurity is not considered in their daily operational decisions. This insight clearly illustrates a disconnect between the pressing need for cybersecurity and its prioritization within organizational hierarchies.
Another concerning finding was the poor coordination at a national level, which has led to disparate levels of cyber maturity across various forces and fire rescue services. This inconsistency not only impacts operational effectiveness but also heightens overall vulnerability to cyber threats.
In light of these findings, HMICFRS has put forth 13 recommendations aimed at enhancing the cybersecurity positions across the nation’s police and fire services. Among these recommendations is the introduction of baseline cybersecurity standards to elevate maturity levels universally. Additionally, the report advocates for third-party assessments of cybersecurity capabilities and stresses the importance of rigorous procurement and contract management for ICT suppliers, including mandatory Cyber Essentials certification.
Another recommendation is to foster better collaboration between government and policing cybersecurity leads. This collaboration could take the form of a national management center akin to the one already in place for the Police Digital Service, which should also be extended to fire and rescue services. Improving service preparedness for cyber-attacks, through enhanced backup, restore capabilities, and conducting incident response exercises, is also a focal point of the recommendations. Furthermore, HMICFRS calls for increased learning and development opportunities for senior leaders and cybersecurity personnel, establishing a well-informed leadership bedrock for these public services.
In conclusion, Michelle Skeer underscores the transformative potential of the government’s police reform initiatives alongside local government reorganization efforts. She stated, "These opportunities to strengthen cybersecurity cannot be missed. Protecting systems and data is essential to protecting the public." The stakes have never been higher, as robust cybersecurity measures are critical not only for the integrity of police functions and fire services but ultimately for the safety and security of the public they serve.