System is being established by various government departments working with the National Cyber Security Centre and other stakeholders, with aim of providing a ‘holistic’ view of security and major threats

The government is developing a new methodology for measuring the cyber resilience of key UK infrastructure across all critical sectors.

Work on creating the Cyber Resilience Index (CRI) is being led by the Cabinet Office, which is working cooperatively with the National Cyber Security Centre and Whitehall departments involved in overseeing critical national infrastructure (CNI).

Security minister Dan Jarvis said: “We are keen for this to be a collaborative process so that the Index delivers for all CNI sectors.”

Jarvis, who was answering several written parliamentary questions from Conservative MP Ben Obese-Jecty, added that the government “is working tirelessly to improve the cyber-resilience of our most critical services and systems” and that “improving our understanding of the cyber risk we are carrying as a nation is fundamental to this”.

Related content

• ‘We have to move the cyber baseline all the time’ – Scottish public sector resilience leader
• How GovAssure is bringing ‘rigour and objectivity’ to departments’ cyber credentials
• Cyber Essentials: Updated government procurement policy advises ‘alternative controls’ are required to secure legacy tech

“In order to build a better understanding of cyber risk, we are developing [the] CRI, which will build on existing measures of cyber resilience to provide a cross-sector, holistic overview of cyber resilience for UK CNI, allowing us to target resilience building efforts.”

The new government-backed metric for measuring resilience and risk will be complemented by “the upcoming Cyber Security and Resilience Bill, [which] will also address the evolving cyber risk picture for CNI sectors across the UK”, according to the minister.

In answer to a query regarding specialist businesses that have provided the government with advice on security and resilience, Jarvis added that “the government is actively engaging with the private sector to ensure a whole-of-society approach to building and strengthening resilience”.

“This takes place via a range of conduits to build on existing relationships and expertise, including through business networks, such as Resilience First and the Confederation of British Industry,” he said. “Lead government departments hold responsibility for sector-specific engagement.”

The minister, whose role sits within the Home Office, indicated that “there are no plans to publish a list of business engagements, given the different fora that these conversations take place within”.