Separate government entities (approximate): ~465 (Source: Infosecurity Magazine, published September 24, 2026, citing UK Civil Service Deputy CISO Breandán Knowlton-Hung's September 23 talk at the Gartner Security & Risk Management Summit, London)
A Federated System and the Limits of a Mandate
The UK Civil Service is changing the operating model behind its 2022 National Cyber Security Strategy. The centre will issue fewer instructions and build more services that departments adopt voluntarily. Hard central authority stays in place for risks that cut across government. The account comes from Breandán Knowlton-Hung, the Civil Service's Deputy CISO, who spoke to a Gartner Security & Risk Management Summit audience in London on September 23. Infosecurity Magazine reported the talk the following day. He said the trigger was a 2025 National Audit Office (NAO) report, which in his summary found "no proper implementation plan" three years into the strategy. Any central policy has to reach roughly 465 separate ministries, agencies and public bodies, each with its own leadership, budget and systems.
The Audit That Forced a Rethink
By Knowlton-Hung's account, the 2022 design rested on an unspoken assumption: publish standards, require assurance, and compliance will follow. In his summary, the NAO could not tell whether the effort was delivering results. The audit also exposed a staffing gap. One in three cyber roles was vacant or filled by temporary contractors, and most specialist architects were not permanent employees. His point was that an instruction with no one at the receiving end "won't get picked up." He rejected the idea that departments were being obstinate, saying "They just couldn't," because of budgets, systems and competing risks they themselves carry.
Where the Centre Built Something Teams Chose to Use
Knowlton-Hung's lead example is a centrally run monitoring service. It checks thousands of public sector bodies from the outside for about a thousand classes of exposed weakness, then forwards actionable findings to the responsible owner. No one was ordered to remediate, he said. Local teams did the work because the alerts fitted the way they already operated. He put the median time to fix domain-level vulnerabilities at about eight days, down from around 50. That figure comes from his conference talk. The source does not describe it as independently audited, and it offers no comparison with a mandate aimed at the same problem.
What Federated Organisations Can Take From It
Knowlton-Hung argued that the gap between policy and practice widens in any federation, including a private company assembled through acquisitions. He calls the new model "polycentric governance": several overlapping decision-making centres that coordinate with one another rather than answer to one chain of command. In practice, he said, the centre should keep few responsibilities and hold them firmly. Beyond that core, it should compete on usefulness and aim to be "unmissably useful." Setting direction and intervening on shared risks that no single agency should carry alone remain central functions, he added. He acknowledged that assurance scores are rising year on year but not fast enough against the threat, and an action plan is being layered on top of the model to speed results. This is a reported operational shift, not a solved problem.
Questions for Your Security Leadership
Ask how many of last year's security mandates were implemented by every business unit, and how that was measured rather than assumed. Ask what share of security roles across the organization, including acquired or federated units, are vacant or filled by contractors, and whether that gap was weighed when policies were signed off. Ask whether central security teams ship any tool or service that local teams adopt voluntarily because it makes their work easier. If the answer is no, ask what it would take to build one before the next mandate is written. Finally, ask which few systemic risks justify hard central authority, and which do not.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Infosecurity Magazine.
